Beyoğlu Professional

DATA PROCESSING AGREEMENT GDPR Article 28 Data Processing Agreement

Version: 1.0
Effective Date: 1 October 2026

This Data Processing Agreement (“DPA”) is entered into between:

(1) the Customer legal entity identified in the applicable Client Portal account, Order Form or other Agreement (“Controller”); and

(2) THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ, having its registered office at Tatlısu Mah. Aziz Blv. Çağrı Sitesi B Blok No:48, İç Kapı No:42, 34774 Ümraniye, İstanbul, Türkiye (“Processor” or “Beyoğlu Professional”).

Controller and Processor are individually a “Party” and collectively the “Parties”.

This DPA forms part of the agreement governing Controller’s access to and use of the Beyoğlu Professional PPWR-EPR Compliance platform, including any order form, master services agreement, subscription agreement, authorised representative agreement or other services agreement between the Parties (collectively, the “Agreement”).

1. Purpose and Scope

1.1. This DPA governs the Processing of Personal Data by Processor on behalf of Controller in connection with the services provided under the Agreement.

1.2. The purpose of this DPA is to satisfy the requirements of Regulation (EU) 2016/679 (“GDPR”), in particular Article 28, and any other applicable European data-protection legislation governing Processing performed on behalf of Controller.

1.3. The Processing covered by this DPA includes, where enabled or used by Controller, the operation of the Beyoğlu Professional platform in relation to:

(a) user and workspace administration;

(b) products, SKUs and packaging profiles;

(d) sales, orders, returns, shipments and placed-on-market records;

(e) country compliance accounts;

(f) EPR and PPWR calculations and regulatory obligations;

(g) registrations, reporting, declarations and submissions;

(h) regulatory documents, evidence and correspondence;

(i) authorised representative workflows;

(j) communications, messages and email;

(k) payments, funding and financial reconciliation;

(l) integrations and connected applications;

(m) audit, security and compliance records;

(n) AI-assisted functionality where explicitly used or enabled; and

(o) technical support and related Platform operations.

1.4. This DPA applies only to Personal Data for which Controller determines the purposes and essential means of Processing and Processor Processes such Personal Data on Controller’s behalf.

1.5. To the extent Processor independently determines the purposes and means of Processing, including Processing required for Processor’s own corporate administration, fraud prevention, legal compliance, billing, security governance or defence of legal claims, Processor acts as an independent Controller and such Processing falls outside this DPA.

2. Definitions

For purposes of this DPA:

“Applicable Data Protection Law” means the GDPR and any applicable national legislation implementing or supplementing the GDPR.

“Controller Personal Data” means Personal Data Processed by Processor on behalf of Controller under the Agreement.

“Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, “Processor”, “Controller”, “Supervisory Authority” and “Special Categories of Personal Data” have the meanings assigned to them by the GDPR.

“Services” means the Beyoğlu Professional PPWR-EPR Compliance platform and associated services provided under the Agreement.

“Subprocessor” means another processor engaged by Processor to Process Controller Personal Data on behalf of Controller.

“Third Country” means a country outside the European Economic Area where a transfer is subject to Chapter V GDPR.

“SCCs” means, where applicable, the European Commission Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914, as amended or replaced.

3. Roles of the Parties

3.1. Controller acts as Controller of Controller Personal Data.

3.2. Processor acts as Processor in respect of such Personal Data.

3.3. Controller is responsible for determining:

the purposes of Processing;

the lawful basis for Processing;

which Personal Data may lawfully be submitted to the Services;

the relevant Data Subjects;

the permitted retention period;

the persons authorised to access the Personal Data; and

the instructions provided to Processor.

3.4. Processor shall Process Controller Personal Data only on documented instructions from Controller, including instructions contained in:

the Agreement;

this DPA;

Controller’s configuration and authorised use of the Services;

instructions issued through authorised Platform functionality; and

written support or operational instructions issued by an authorised representative of Controller.

3.5. Processor shall not sell Controller Personal Data.

3.6. Processor shall not use Controller Personal Data for behavioural advertising.

3.7. Processor shall not use Controller Personal Data to train, fine-tune or improve a general-purpose artificial-intelligence model for the benefit of unrelated customers or third parties unless Controller has expressly agreed to such Processing in writing and an appropriate lawful basis exists.

3.8. Processor may generate and use information that has been irreversibly anonymised so that it no longer constitutes Personal Data, provided Processor does not attempt to re-identify such information.

4. Documented Instructions

4.1. Processor shall Process Controller Personal Data only in accordance with Controller’s documented instructions unless Processor is required to Process such Personal Data by Union or Member State law.

4.2. Where Processor is legally required to Process Personal Data other than on Controller’s instructions, Processor shall inform Controller of that legal requirement before Processing unless applicable law prohibits such notification on important grounds of public interest.

4.3. If Processor reasonably believes that an instruction infringes Applicable Data Protection Law, Processor shall inform Controller without undue delay.

4.4. Processor may suspend implementation of the affected instruction to the extent reasonably necessary to avoid unlawful Processing while the Parties seek to resolve the matter.

4.5. Nothing in this DPA requires Processor to comply with an instruction that would itself violate applicable law.

5. Controller Responsibilities

5.1. Controller warrants that:

it has a lawful basis for Processing Controller Personal Data;

it has provided any required privacy information to Data Subjects;

its instructions comply with Applicable Data Protection Law;

it has the necessary rights and authority to provide Personal Data to Processor;

it has lawfully authorised any third-party platform, marketplace, financial provider or other system connected to the Services; and

its use of the Services will not cause Processor to Process Personal Data unlawfully.

5.2. Controller shall use reasonable efforts to ensure that Personal Data submitted to the Services is adequate, relevant, accurate and limited to what is necessary for Controller’s purposes.

5.3. Controller shall not intentionally submit Special Categories of Personal Data unless such Processing is necessary, lawful and authorised under both Articles 6 and 9 GDPR.

5.4. The Services are not intended for routine Processing of Special Categories of Personal Data.

6. Confidentiality

6.1. Processor shall ensure that persons authorised to Process Controller Personal Data:

are subject to an appropriate duty of confidentiality;

receive access only where necessary for their role;

receive appropriate data-protection and information-security instructions; and

Process Controller Personal Data only in accordance with authorised instructions.

6.2. Processor shall maintain appropriate measures to prevent unauthorised personnel from obtaining access to Controller Personal Data.

6.3. Confidentiality obligations shall continue after termination of a person’s employment, engagement or access rights.

7. Security of Processing

7.1. Processor shall implement and maintain appropriate technical and organisational measures designed to ensure a level of security appropriate to the risks presented by the Processing.

7.2. In determining the appropriate measures, Processor shall take account of:

the state of the art;

implementation costs;

the nature, scope, context and purposes of Processing; and

the likelihood and severity of risks to Data Subjects.

7.3. Processor’s measures shall be designed to support, as appropriate:

confidentiality;

integrity;

availability;

resilience;

secure access control;

recovery from incidents;

security testing;

protection against unauthorised disclosure;

protection against alteration or destruction;

and effective security governance.

These requirements reflect GDPR Article 32. Eur-Lex

7.4. Processor’s minimum technical and organisational measures are described in Annex II.

7.5. Processor may update its technical and organisational measures where necessary to maintain or improve security, provided that the overall level of protection is not materially reduced.

8. Access Control and Tenant Separation

8.1. Processor shall maintain logical access controls appropriate to the Platform architecture.

8.2. Access to Controller Personal Data shall be governed by user identity, organisational membership, assigned roles and authorised capabilities.

8.3. Processor shall maintain reasonable safeguards intended to prevent users belonging to one customer organisation from obtaining access to Personal Data belonging to another customer organisation.

8.4. Administrative or privileged access shall be limited to authorised personnel with a legitimate operational requirement.

8.5. Privileged administrative access shall be subject to enhanced safeguards, which may include multi-factor authentication, privileged role restrictions and audit logging.

9. Authentication and Session Security

9.1. Processor shall maintain reasonable authentication and session-management safeguards.

9.2. These may include:

protected authentication mechanisms;

short-lived authenticated sessions;

secure session cookies;

HTTP-only protections where appropriate;

SameSite protections;

cross-site request forgery controls;

session invalidation;

role verification; and

access revocation procedures.

9.3. Authentication credentials, integration secrets and equivalent sensitive credentials shall not be intentionally exposed as ordinary plaintext application records where dedicated secret-management mechanisms are available.

10. Encryption and Transmission Security

10.1. Processor shall use encrypted transport protocols for transmission of Controller Personal Data over public networks.

10.2. Personal Data stored in managed cloud infrastructure shall be protected using appropriate storage security controls, including encryption-at-rest capabilities provided by the applicable infrastructure provider where available and appropriate.

10.3. Access to stored documents and objects may be mediated using controlled or time-limited access mechanisms.

11. Documents and Regulatory Evidence

11.1. Controller Personal Data may be contained within regulatory documents, contracts, declarations, invoices, payment evidence, authority correspondence, submission evidence, registration certificates or other documents uploaded, received or generated through the Services.

11.2. Processor may use document integrity mechanisms, version information, content hashes, provenance information and access controls in order to preserve regulatory and evidentiary integrity.

11.3. Where a document forms part of an immutable regulatory or evidentiary record, Processor shall not alter that document except in accordance with Controller’s documented instructions and the applicable record-governance rules.

12. Artificial Intelligence Processing

12.1. Where Controller elects to use an AI-assisted feature, Processor may Process Controller Personal Data necessary to perform the requested function.

12.2. AI-assisted Processing may include, depending on functionality:

summarisation;

translation;

draft preparation;

classification;

document interpretation;

catalogue or data mapping;

regulatory assistance;

compliance explanation; and

financial or operational explanation.

12.3. Processor shall apply access controls and data-governance controls to AI-assisted Processing.

12.4. AI outputs generated on behalf of Controller shall be treated as assistive output and shall not, solely by virtue of being generated by the Service, constitute an authoritative regulatory determination.

12.5. Processor shall not intentionally authorise an AI Subprocessor to use Controller Personal Data for unrelated advertising or general-purpose model training unless Controller separately agrees in writing.

12.6. Where an AI provider acts as a Subprocessor, it shall be subject to Section 15.

13. Data Minimisation

13.1. Processor shall use reasonable measures designed to limit Controller Personal Data Processed by the Services to information necessary for the requested functionality.

13.2. For packaging and regulatory calculations, Processor may minimise commerce data so that regulatory records rely primarily on product identifiers, SKU identifiers, quantities, dates, country information, transaction or fulfilment references and regulatory attributes rather than unnecessary end-customer identity information.

13.3. Where a connected provider sends additional Personal Data in an API or webhook payload, Processor shall not use that additional data for unrelated purposes.

14. Data Subject Rights

14.1. Taking into account the nature of the Processing, Processor shall assist Controller by appropriate technical and organisational measures, insofar as reasonably possible, in fulfilling Controller’s obligations to respond to requests concerning:

access;

rectification;

erasure;

restriction;

data portability;

objection; and

rights concerning qualifying automated decision-making.

14.2. If Processor receives a request directly from a Data Subject concerning Controller Personal Data, Processor shall, unless legally prohibited:

promptly notify Controller; and

not respond substantively to the request except on Controller’s documented instructions or where required by law.

14.3. Processor may provide self-service functionality allowing Controller to retrieve, amend, export or delete certain Personal Data.

14.4. Controller remains responsible for determining whether and to what extent a Data Subject request must legally be granted.

15. Subprocessors

15.1. Controller grants Processor general written authorisation to engage Subprocessors in accordance with this Section.

15.2. Processor shall maintain an up-to-date list of authorised Subprocessors.

15.3. Processor shall ensure that each Subprocessor is bound by written data-protection obligations that provide a level of protection for Controller Personal Data materially equivalent to the obligations imposed on Processor under this DPA, to the extent applicable to the services performed by that Subprocessor.

15.4. Processor shall remain responsible to Controller for the performance of its Subprocessors’ obligations to the extent required by Article 28 GDPR.

15.5. Processor shall provide Controller with reasonable advance notice of a new Subprocessor where the new engagement involves material Processing of Controller Personal Data.

15.6. Unless another period is stated in the Agreement, Processor shall endeavour to provide at least 30 days’ notice before a new material Subprocessor begins Processing.

15.7. Controller may object during the notification period on reasonable data-protection grounds.

15.8. An objection must explain the specific data-protection concern.

15.9. The Parties shall work in good faith to resolve the objection.

15.10. Where the Parties cannot reasonably resolve the objection, Processor may:

avoid use of the disputed Subprocessor for Controller where technically and commercially practicable;

offer an alternative configuration; or

permit Controller to terminate the affected Service without penalty for the unused portion of any prepaid affected Service, where no reasonable alternative is available.

15.11. An initial Subprocessor schedule is contained in Annex III.

16. Customer-Directed Third-Party Services

16.1. A third-party platform selected and independently authorised by Controller shall not automatically be considered a Subprocessor merely because the Services integrate with that platform.

16.2. Examples may include marketplaces, commerce systems, banks, payment institutions, regulatory portals, PRO systems or other services selected by Controller.

16.3. Depending on the legal relationship, such provider may act as:

Controller’s processor;

a separate controller;

a joint controller; or

another recipient authorised by Controller.

16.4. Controller is responsible for its contractual relationship with a customer-directed third-party service except where Processor separately contracts with that provider as a Subprocessor.

17. Personal Data Breach

17.1. Processor shall maintain procedures designed to detect, assess, respond to and document Personal Data Breaches.

17.2. Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data.

17.3. Where reasonably practicable, Processor shall provide initial notification within 24 hours after confirming that a Personal Data Breach affecting Controller Personal Data has occurred.

17.4. Processor’s notification shall, to the extent reasonably available at that time, include:

the nature of the incident;

the categories of affected Personal Data;

the categories or approximate number of affected Data Subjects;

the approximate number of affected records;

known or likely consequences;

measures taken or proposed to contain or mitigate the incident; and

a contact point for follow-up.

17.5. Information may be supplied in phases where all facts are not immediately available.

17.6. Processor shall reasonably cooperate with Controller’s investigation, risk assessment and regulatory notification obligations.

17.7. Processor’s notification of an incident does not constitute an admission of fault or liability.

17.8. Controller remains responsible for determining whether notification to a Supervisory Authority or Data Subjects is legally required.

The GDPR requires a processor to notify the controller without undue delay after becoming aware of a Personal Data Breach, while the controller may itself have a 72-hour supervisory-authority notification obligation. Eur-Lex

18. Unsuccessful Security Events

18.1. A Personal Data Breach does not include an unsuccessful attempt that does not result in unauthorised access to, acquisition of, alteration of, destruction of or disclosure of Controller Personal Data.

18.2. Examples may include unsuccessful login attempts, network scans, blocked attacks or unsuccessful probes, provided no Personal Data Breach occurs.

19. DPIAs and Prior Consultation

19.1. Taking into account the nature of the Processing and information available to Processor, Processor shall provide reasonable assistance to Controller in connection with:

data protection impact assessments under Article 35 GDPR; and

prior consultation with a Supervisory Authority under Article 36 GDPR.

19.2. Where the requested assistance is unusually extensive and is not caused by Processor’s breach of this DPA, reasonable professional-service charges may apply subject to prior agreement.

20. Records and Regulatory Cooperation

20.1. Processor shall maintain records of categories of Processing activities to the extent required by Article 30 GDPR.

20.2. Processor shall cooperate with competent Supervisory Authorities to the extent required by Article 31 GDPR.

20.3. Processor shall make information reasonably necessary to demonstrate compliance with Article 28 available to Controller in accordance with Section 24.

21. International Transfers

21.1. Processor shall not transfer Controller Personal Data to a Third Country except where the transfer complies with Chapter V GDPR.

21.2. A transfer may be based on:

an adequacy decision;

appropriate safeguards recognised under Article 46 GDPR;

the applicable SCCs; or

another lawful transfer mechanism permitted by the GDPR.

21.3. Where SCCs are required for a transfer between the Parties, the SCCs shall be incorporated into this DPA by reference using the module applicable to the Parties’ roles.

21.4. Where Processor transfers Controller Personal Data to a Subprocessor in a Third Country and SCCs are required, Processor shall enter into the appropriate SCC module or otherwise ensure a valid Chapter V mechanism.

21.5. The European Commission adopted the current international-transfer SCC framework under Implementing Decision (EU) 2021/914. European Commission

21.6. Where required, Processor shall assess relevant transfer risks and implement supplementary measures appropriate to the circumstances.

22. Government and Law-Enforcement Requests

22.1. Where Processor receives a legally binding demand from a public authority for Controller Personal Data, Processor shall, unless prohibited by law:

notify Controller before disclosure;

review the validity and scope of the request;

seek clarification where appropriate;

challenge an unlawful or manifestly disproportionate request where reasonably available; and

disclose no more Personal Data than legally required.

22.2. Processor shall document such requests to the extent permitted by law.

23. Return and Deletion of Personal Data

23.1. Upon termination or expiry of the Services, and at Controller’s choice, Processor shall delete or return Controller Personal Data, subject to this Section.

23.2. Unless otherwise agreed or technically required by the applicable Service, active production copies shall ordinarily be deleted or rendered inaccessible within 60 days after the applicable deletion instruction or termination.

23.3. Residual backup copies may remain until completion of normal backup-rotation periods, which shall ordinarily not exceed 90 additional days, unless a longer period is required by law or documented disaster-recovery architecture.

23.4. During any residual backup period, Controller Personal Data shall remain protected and shall not be restored for ordinary commercial use.

23.5. Processor may retain Personal Data beyond deletion periods where:

Union or Member State law requires Processor to retain it;

Controller has instructed Processor to preserve it;

a valid legal hold applies; or

retention is necessary for establishment, exercise or defence of legal claims.

23.6. Where retention is required, Processor shall restrict the retained Personal Data to the applicable lawful purpose.

23.7. Regulatory evidence maintained on behalf of Controller may be retained for the retention period instructed by Controller or required for the Controller’s compliance workflow.

24. Audit and Demonstration of Compliance

24.1. Processor shall make available to Controller information reasonably necessary to demonstrate compliance with Article 28 GDPR.

24.2. Processor may satisfy reasonable assurance requests through documentation including, where available:

security descriptions;

independent audit reports;

certifications;

penetration-test summaries;

technical and organisational measures;

Subprocessor information;

compliance questionnaires; and

relevant policies.

24.3. If documentation is not reasonably sufficient, Controller may request an audit.

24.4. Except following a material security incident or reasonably suspected material breach, an audit shall normally:

occur no more than once in any 12-month period;

be conducted during normal business hours;

be subject to reasonable advance notice;

avoid unreasonable disruption to Processor’s operations;

protect information relating to other customers;

be conducted by Controller or an independent auditor bound by confidentiality; and

not require disclosure of information that would create a security vulnerability.

24.5. Processor shall not be required to provide:

access to another customer’s information;

unrestricted access to production environments;

source code, except where legally required;

information that would materially impair system security;

or privileged legal communications.

24.6. Controller shall bear reasonable audit costs unless the audit establishes a material breach by Processor of this DPA, in which case Processor shall bear reasonable costs directly attributable to verifying remediation.

25. Regulatory Requests

25.1. Processor shall reasonably assist Controller with a legally valid request or investigation by a competent Supervisory Authority relating to Processing under this DPA.

25.2. Each Party remains responsible for its own obligations toward the Supervisory Authority.

26. Processing Personnel

26.1. Processor shall ensure that personnel with access to Controller Personal Data receive access only as necessary for legitimate operational responsibilities.

26.2. Processor shall maintain procedures for modification or revocation of access when responsibilities change or access is no longer required.

27. Security Testing and Vulnerability Management

27.1. Processor shall maintain reasonable processes appropriate to the nature of the Services for identifying and addressing security vulnerabilities.

27.2. Such processes may include:

secure software-development practices;

dependency management;

code review;

automated security controls;

security testing;

vulnerability remediation;

access-control review;

incident-response testing; and

security monitoring.

27.3. Remediation priority shall take account of severity, exploitability and risk to Controller Personal Data.

28. Logging and Auditability

28.1. Processor may maintain audit and security records necessary to establish:

who performed an action;

which organisation or workspace was affected;

the affected resource;

the type of event;

the event time;

correlation or trace information; and

the outcome of relevant operations.

28.2. Audit records shall be protected against unauthorised alteration to the extent appropriate to their purpose.

28.3. Audit information shall not be used for unrelated behavioural advertising.

29. Business Continuity and Recovery

29.1. Processor shall maintain reasonable safeguards designed to support restoration of availability and access following material technical incidents.

29.2. Backup and recovery architecture shall be proportionate to the Services and applicable risk.

29.3. Processor shall periodically assess relevant recovery procedures.

30. Data Accuracy and Source Systems

30.1. Where Controller connects an external system designated as a canonical data source, Processor may synchronise Personal Data from that source on Controller’s instructions.

30.2. Processor does not independently guarantee the accuracy of source data supplied by Controller or its chosen providers.

30.3. Processor shall provide reasonable mechanisms for correction where the Service permits correction and Controller is authorised to make it.

31. Notifications and Communications

31.1. Notices under this DPA relating to privacy matters shall be sent to:

For Controller:
the privacy/contact address recorded for Controller in the Client Portal or applicable Agreement

For Processor:
https://beyogluprofessional.com/contact

31.2. Incident notifications may additionally be sent to an operational security contact designated by Controller.

31.3. Controller is responsible for keeping its notification contacts current.

32. Liability

32.1. Liability arising under this DPA is subject to the limitations and exclusions of liability contained in the Agreement, to the maximum extent permitted by applicable law.

32.2. Nothing in the Agreement or this DPA excludes or restricts:

rights of Data Subjects under applicable law;

powers of a Supervisory Authority;

liability that cannot legally be excluded; or

either Party’s independent statutory obligations under the GDPR.

32.3. Each Party remains responsible for damage caused by Processing to the extent prescribed by Article 82 GDPR.

33. Indemnities

33.1. Any contractual indemnities relating to data protection are governed by the Agreement.

33.2. If the Agreement contains no applicable indemnity provision, neither Party creates an unlimited indemnity merely by entering into this DPA.

33.3. This Section does not alter mandatory statutory liability.

34. Term and Termination

34.1. This DPA becomes effective when the Agreement becomes effective or when Processor first Processes Controller Personal Data, whichever is earlier.

34.2. This DPA remains in force for so long as Processor Processes Controller Personal Data on behalf of Controller.

34.3. Provisions which by their nature must survive termination, including confidentiality, deletion, audit, international transfer and liability provisions, shall survive accordingly.

35. Order of Precedence

35.1. In the event of a conflict concerning Processing of Personal Data, the order of precedence is:

applicable mandatory data-protection law;

applicable SCCs;

this DPA;

the Agreement; and

36. Amendments Required by Law

36.1. If a change in Applicable Data Protection Law requires an amendment to this DPA, the Parties shall cooperate in good faith to implement the legally required amendment.

36.2. Processor may update non-material operational details in the Annexes where necessary to reflect changes in Services, infrastructure or Subprocessors, subject to the protections in this DPA.

37. Governing Law and Jurisdiction

37.1. Except where mandatory data-protection law or applicable SCCs provide otherwise, this DPA is governed by the governing law specified in the Agreement.

37.2. If the Agreement does not specify governing law:

Governing Law: Republic of Türkiye

Courts: İstanbul, Türkiye

38. Entire Data Processing Arrangement

38.1. This DPA and its Annexes constitute the Parties’ contractual arrangement under Article 28 GDPR for the Processing covered by this DPA.

38.2. This DPA does not replace additional transfer clauses where Chapter V GDPR requires them.

ANNEX I

DETAILS OF PROCESSING

A. Subject Matter

Provision and operation of the Beyoğlu Professional PPWR-EPR Compliance platform and associated regulatory, technical, communication, document, finance, integration and support services.

B. Duration

For the duration of the Agreement and thereafter only for the period required to return, migrate, securely delete or lawfully retain Controller Personal Data.

C. Nature of Processing

The Processing may include collection, recording, organisation, structuring, storage, retrieval, consultation, use, alignment, calculation, classification, transformation, transmission, disclosure to authorised recipients, restriction, export, backup, restoration and deletion.

D. Purposes

Processing Controller Personal Data as necessary to provide the Services on Controller’s documented instructions, including regulatory and compliance operations, PPWR/EPR workflows, user collaboration, reporting, integrations and technical support.

E. Categories of Data Subjects

Data Subjects may include:

Controller employees;

Controller officers and directors;

Controller administrators;

Controller contractors;

authorised representatives;

professional advisers;

business contacts;

suppliers;

customers or counterparties where their information is introduced by Controller;

users of Controller’s connected systems;

regulatory or PRO contacts;

payment or finance contacts;

correspondents;

and other individuals whose Personal Data Controller lawfully submits to the Services.

F. Categories of Personal Data

Controller Personal Data may include:

identity data;

business contact information;

professional role information;

user-account information;

authentication and access metadata;

communications;

email information;

uploaded documents;

regulatory correspondence;

signatures and evidence;

order and shipment metadata;

transaction references;

business-address information;

payment and reconciliation information;

integration identifiers;

technical logs;

audit records;

IP or device-related security metadata;

support communications;

and AI prompts or outputs where an AI-assisted feature is used.

G. Special Categories

No routine Processing of Special Categories is intended.

If Controller submits such data, Controller is responsible for ensuring a valid Article 9 condition and Processor shall Process it only pursuant to documented instructions and this DPA.

H. Processing Frequency

Continuous or event-driven for the duration of Controller’s use of the Services.

I. Retention

As instructed by Controller, configured through the Services, established in the Agreement or required by applicable law, followed by deletion or return in accordance with Section 23.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES

Processor shall maintain a security programme appropriate to the Services and risks presented by the Processing.

1. Identity and Access Management

Unique user identities where appropriate.

Role- and capability-based access controls.

Organisation/workspace separation.

Least-privilege principles.

Access revocation procedures.

Enhanced safeguards for privileged access.

Multi-factor authentication for privileged administrative access where supported or required.

2. Authentication and Session Controls

Secure authentication mechanisms.

Protected application sessions.

HTTP-only cookie controls where appropriate.

Secure-cookie controls in protected deployments.

SameSite restrictions.

CSRF protection.

Session expiry and invalidation.

3. Transport and Storage Security

Encryption of traffic over public networks using appropriate modern transport security.

Cloud-provider storage encryption where appropriate.

Controlled document/object access.

Time-limited access links where implemented.

4. Secret Management

Sensitive credentials and application secrets maintained using dedicated secret-management controls where technically appropriate.

Restricted administrative access to secrets.

Credential rotation and revocation processes where applicable.

5. Application Authorisation

Capability-based and role-based access.

Workspace and tenant boundary controls.

Server-side authorisation enforcement for protected operations.

6. Documents and Evidence

Controlled document storage.

Document integrity and provenance metadata where applicable.

Content hashing where implemented.

Version controls.

Retention classes and legal-hold controls where applicable.

Controlled download/access mechanisms.

7. Logging

Security logs.

Application audit trails.

Actor and organisation attribution.

Event timestamps.

Correlation identifiers.

Restricted access to logs.

8. Data Minimisation

Purpose-specific data collection.

Reduction of unnecessary end-customer identity data in canonical regulatory ledgers.

Scoped integration data.

Limited audit payloads.

9. Incident Management

Incident-identification procedures.

Triage and escalation.

Containment.

Investigation.

Remediation.

Breach notification process.

Post-incident assessment.

10. Availability and Recovery

Backup mechanisms appropriate to the Service.

Recovery capability.

Resilient cloud infrastructure where applicable.

Recovery procedures.

11. Software Development

Access-controlled repositories.

Code review.

Dependency-management processes.

Testing.

Deployment controls.

Separation of development and protected production functions where appropriate.

12. Vulnerability Management

Identification of relevant vulnerabilities.

Risk-based prioritisation.

Remediation according to severity and exposure.

Periodic security assessment.

13. Personnel Security

Confidentiality obligations.

Role-based access.

Security awareness appropriate to responsibilities.

Access termination or modification processes.

14. Subprocessor Governance

Data-protection assessment.

Written contractual requirements.

International-transfer assessment where applicable.

Security and privacy due diligence proportionate to risk.

15. AI Governance

Authorised AI feature access.

Feature-level processing controls.

Provider/model routing controls where implemented.

Auditability of AI processing.

Restriction on unrelated model training.

Human review of regulatory output where appropriate.

16. Deletion

Application-level deletion mechanisms where applicable.

Account export/deletion functionality where supported.

Object deletion.

Backup expiration.

Legal-hold exceptions.

ANNEX III

INITIAL AUTHORISED SUBPROCESSORS

This Annex must be completed with the actual contracting entity and processing region before signature.

Google Cloud / Google Services

Provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

Services potentially used: cloud infrastructure, managed storage, authentication infrastructure, secret management, browser push infrastructure and AI/Vertex infrastructure.

Processing purpose: hosting, identity/authentication support, storage, secret management, notifications and AI-assisted processing where enabled.

Processing location: Production workloads are configured principally in Google Cloud europe-west3 — Frankfurt, Germany, subject to service-specific architecture and authorised Google support/subprocessor processing.

Transfer mechanism: EEA processing where configured; EU Standard Contractual Clauses or another lawful GDPR Chapter V mechanism where a Restricted Transfer occurs.

Resend

Provider: Plus Five Five, Inc. d/b/a Resend, 2261 Market Street #5039, San Francisco, CA 94114, United States

Purpose: transactional and Platform email transmission, delivery and inbound email functionality where enabled.

Data: email addresses, headers, subject/body, delivery information and attachments where applicable.

Processing location: United States for stored Resend data; selected email sending region does not by itself change storage location.

Transfer mechanism: Resend DPA and EU Standard Contractual Clauses for relevant EU/EEA transfers, together with applicable contractual and technical safeguards.

Additional Infrastructure Providers

No additional direct infrastructure Subprocessor is listed in this Annex at the publication date. Any later addition or replacement is governed by Section 15 of this DPA and the then-current Subprocessor Schedule.

Customer-selected commerce platforms, marketplaces, banks, payment institutions, regulatory portals and other integrations are not automatically classified as Subprocessors under this Annex. Their role must be assessed according to the actual contractual and data-processing relationship.

ANNEX IV

INTERNATIONAL TRANSFER ADDENDUM

Where a transfer covered by this DPA requires the SCCs:

The Parties incorporate the European Commission SCCs adopted pursuant to Implementing Decision (EU) 2021/914.
The applicable module shall be selected according to the Parties’ roles.
Where Controller acts as controller and Processor acts as processor, Module Two shall apply where relevant.
Where Processor transfers Controller Personal Data to a Subprocessor in a Third Country, Module Three shall apply where relevant.
Annex I of this DPA shall populate the Processing-description requirements of the SCCs to the extent applicable.
Annex II shall constitute the description of technical and organisational measures to the extent applicable.
Annex III shall identify relevant Subprocessors.
The Parties shall complete any SCC fields that cannot lawfully be incorporated solely by reference, including competent supervisory authority, governing Member State law and exporter/importer details.
Nothing in this DPA modifies the SCCs in a manner that reduces the rights or safeguards provided by the SCCs.

ANNEX V

CONTROLLER INSTRUCTIONS

Unless Controller provides additional lawful written instructions, Controller instructs Processor to:

Process Personal Data to provide and secure the Services;

host and store Controller Personal Data;

authenticate and authorise users;

operate configured integrations;

process products, SKUs, packaging information, sales and shipment data for regulatory purposes;

prepare and maintain compliance records;

operate country-account and authorised-representative workflows;

operate reporting and declaration functions;

store documents and evidence;

provide communications functionality;

process payment and funding records necessary for configured services;

provide technical support;

create backups;

maintain security and audit records;

use authorised Subprocessors;

perform AI-assisted Processing only where Controller activates or invokes the relevant feature;

return or delete Personal Data in accordance with the Agreement and this DPA; and

perform other Processing reasonably necessary to provide functionality deliberately used or configured by Controller.

SIGNATURES AND ELECTRONIC ACCEPTANCE

For Controller

The Controller is the Customer legal entity identified in the applicable Client Portal account, Order Form or other Agreement. Where this DPA is accepted electronically, the Portal acceptance record identifies the accepting Authorised User, Controller organisation, DPA version, acceptance date and time, and relevant audit reference.

For Processor

THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ, trading as Beyoğlu Professional.

This DPA is offered and incorporated into the Agreement by the Processor. A handwritten signature is not required where electronic acceptance or contractual incorporation is legally valid.