BEYOĞLU PROFESSIONAL PPWR-EPR COMPLIANCE PRIVACY POLICY

BEYOĞLU PROFESSIONAL PPWR-EPR COMPLIANCE PRIVACY POLICY

Version: 1.0
Effective Date: 1 October 2026
Last Updated: 1 October 2026

1. Who We Are and Scope of This Privacy Policy

Beyoğlu Professional PPWR-EPR Compliance (“Beyoğlu Professional”, “we”, “us” or “our”) provides a professional regulatory compliance platform supporting packaging, extended producer responsibility (“EPR”), packaging and packaging waste compliance (“PPWR”), product and packaging data management, country compliance accounts, regulatory reporting, declarations, authorised representative activities, regulatory documentation, communications, payments, integrations and related compliance operations.

For processing activities where Beyoğlu Professional determines why and how personal data is processed, the data controller is:

THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ
Registered office: Tatlısu Mah. Aziz Blv. Çağrı Sitesi B Blok No:48, İç Kapı No:42, 34774 Ümraniye, İstanbul, Türkiye
Company / tax registration: Tax No. 8430730980 · Alemdağ Vergi Dairesi
Privacy contact: https://beyogluprofessional.com/contact
Data protection / DPO contact: https://beyogluprofessional.com/contact

This Privacy Policy applies to personal data processed through the Beyoğlu Professional web applications and portals, including Client, Authorised Representative (“AR”) and internal/HQ workspaces; related APIs; communications and document systems; integrations; regulatory and finance workflows; and associated support and administrative operations.

It applies to registered users, prospective customers, customer and AR personnel, corporate representatives, invitees, professional contacts and other natural persons whose personal data is lawfully entered into or generated within the Platform.

Where a customer uploads or connects personal data relating to its customers, employees, representatives, counterparties or other individuals and determines the purposes of that processing, the customer ordinarily acts as controller and Beyoğlu Professional acts as processor. Those processing activities are governed additionally by the applicable Data Processing Agreement.

2. Our Role as Controller and Processor

Beyoğlu Professional acts as a controller principally for account creation and identity management, Platform security, user administration, subscription and commercial relationships, our own communications with users, billing and financial administration, regulatory service administration, fraud and misuse prevention, legal compliance, product security, service improvement and our own audit obligations.

Beyoğlu Professional may act as a processor where a client organisation determines the purposes and essential means of processing data uploaded to or synchronised with the Platform, including commercial records, connected commerce data, communications, documents or other client-controlled information.

An authorised representative, authority, Producer Responsibility Organisation (“PRO”), payment institution, financial institution or other regulatory operator may, depending on the circumstances and applicable law, act as a separate controller rather than our processor.

Nothing in this Privacy Policy alters the allocation of GDPR responsibilities established by applicable law or an applicable Data Processing Agreement.

3. Personal Data We Process

The Platform is primarily a business compliance system. Nevertheless, a number of records can constitute personal data.

We may process identity and account information including name, business email address, display name, profile image, authentication identifier, preferred language, time zone, account status, memberships, assigned roles, permissions and workspace relationships.

We may process company and professional-contact information including organisation name, registration number, VAT or tax identifiers, EORI information, business address, business telephone number, contact person, job-related contact information and authorised representative information.

We process authentication and security information necessary to operate protected accounts, including authentication tokens, session information, MFA status, security events, account state, access rights, request correlation identifiers and related audit records.

The current Platform uses Firebase-based identity services. Browser authentication is configured for ephemeral in-memory persistence. After authentication, protected server-side sessions are used. The current Client application establishes HTTP-only session cookies and CSRF protections rather than exposing the Platform session token to normal client-side scripts.

Where a user elects to remember an account identifier, the browser may retain that identifier locally for login convenience.

We process product and packaging information including products, SKUs, GTINs, packaging profiles, materials, components, weights, quantities, packaging roles and classification data. Such data will ordinarily be business data, but it may become personal data if linked to an identifiable sole trader or individual.

We process sales, order, shipment and placed-on-market information required for regulatory calculations. The Platform architecture deliberately minimises canonical commerce data. The principal records include provider identifiers, product/SKU identifiers, quantities, order and fulfilment identifiers, event dates, destination country, commercial attributes and return or cancellation relationships. The regulatory system does not require ordinary end-customer names, street addresses or telephone numbers for its canonical packaging ledger.

Connected platforms can nevertheless transmit additional fields within provider API or webhook payloads. We therefore apply data-minimisation rules and restrict use of such information to connection processing, reconciliation, troubleshooting, security and the requested integration operation.

We process compliance and regulatory information including country compliance accounts, registrations, regulatory identifiers, obligations, reporting periods, declarations, submissions, authority or PRO references, compliance cases, tasks, regulatory calculations, material quantities, regulatory contributions, filing history and related operational evidence.

We process documents and evidence uploaded by users or generated by the Platform. This may include contracts, registration certificates, declarations, invoices, payment evidence, authority correspondence, submission receipts, signature records and other regulatory evidence. Documents may contain personal data contained in the source material supplied by the user or issuing body.

We process communications data including conversation membership, message bodies, edits, message versions, mentions, reactions, read state, meeting information and linked compliance resources.

Where Platform email functionality is used, we may process sender and recipient addresses, CC/BCC information, subject lines, text and HTML content, email headers, provider identifiers, delivery state, reply relationships and attachments.

We process notification information including notification preferences, read states, browser-push registration tokens or endpoints and, where relevant, the browser user-agent associated with a push subscription.

We process finance and payment information connected to compliance operations, which may include amounts, currency, payment references, transaction and transfer identifiers, settlement state, regulatory payment evidence, beneficiary information, account-holder information supplied by payment providers, reconciliation information and associated provider records.

The Platform is not designed to store complete payment-card numbers or card security codes.

We process integration information including connection identifiers, authentication method, granted scopes, external account references, synchronization status, webhook records, provider event identifiers, mappings, errors and operational logs.

Authentication credentials and API secrets are designed to be maintained through secret references and dedicated secret-management infrastructure rather than being exposed as ordinary plaintext application records.

We process audit and governance information including actor identity, organisation, event type, affected resource, timestamp, correlation ID and limited metadata necessary for accountability, incident investigation, compliance and security.

4. Sources of Personal Data

We obtain personal data directly from you; from your employer, organisation administrator or another authorised user; from an authorised representative or professional adviser; from connected commerce platforms, marketplaces and business systems; from payment or banking providers; from regulatory authorities, PROs and other compliance operators; from documents and correspondence submitted through the Platform; and from Platform-generated operational and security records.

We may also process regulatory information obtained from official or publicly accessible sources. Public regulatory information is generally not personal data, but a source may contain professional details relating to identifiable officials or representatives.

Where GDPR Article 14 applies because information was obtained from a source other than the individual, we provide the required information unless an applicable statutory exception applies.

5. Why We Process Personal Data and Our Legal Bases

We process personal data to create, authenticate and administer accounts; provide contracted Platform and compliance services; maintain client, AR and country-account workspaces; calculate and administer packaging obligations; prepare declarations and regulatory submissions; manage regulatory documents and evidence; operate communications and notifications; connect authorised third-party services; administer payments; provide customer support; maintain security and auditability; establish or defend legal claims; meet statutory and regulatory duties; and maintain and improve Platform reliability.

Where necessary to provide services requested by an individual or under a contract with that individual, processing is based on GDPR Article 6(1)(b).

Where processing is required by EU or Member-State legislation, regulatory recordkeeping requirements, accounting obligations or other binding law, processing is based on Article 6(1)(c).

Where necessary for Platform security, fraud prevention, service administration, network protection, auditability, protection of legal rights, B2B relationship management and proportionate service improvement, we may rely on our legitimate interests under Article 6(1)(f), subject to the required balancing assessment.

Where consent is the appropriate basis, including for optional processing for which consent is legally required, processing is based on Article 6(1)(a). Consent may be withdrawn at any time without affecting processing lawfully undertaken before withdrawal. EDPB guidance requires GDPR consent to meet the requirements of a genuine and valid consent mechanism. European Data Protection Board

Where processing is required for the establishment, exercise or defence of legal claims, the applicable provisions of the GDPR and national law may also apply.

6. Special Categories of Personal Data

Beyoğlu Professional is not intended to collect health data, biometric data, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, genetic data or information about a person's sex life or sexual orientation as part of its ordinary business functions.

Users should not upload such information unless it is strictly necessary, legally permitted and appropriate for the relevant regulatory or legal process.

If special-category personal data must exceptionally be processed, a valid GDPR Article 9 condition must apply in addition to an Article 6 lawful basis.

7. Connected Services and Third-Party Integrations

The Platform supports connections to external systems selected or authorised by users or their organisations.

Current architecture includes commerce and marketplace integrations capable of connecting to services such as WooCommerce, Wix, Tilda, Etsy, Amazon, eBay, Allegro, BigCommerce and PrestaShop. Available providers can change over time.

Connections may use APIs, OAuth, API keys, webhooks, polling or file exchange according to the provider.

A connection is used only within its authorised scope. We seek to import the minimum data required for product identity, regulatory quantities, order/fulfilment evidence, shipment evidence, cancellation or return reconciliation and other requested compliance functions.

Third-party services process information under their own contractual and privacy terms where they act as independent controllers.

Disconnecting an integration prevents future synchronisation but does not automatically require deletion of regulatory evidence already lawfully incorporated into the Platform where continued retention is required.

8. Communications and Email

Platform communications may be exchanged between client users, authorised representatives, Beyoğlu Professional personnel and other authorised participants.

Communication records can be associated with a particular organisation, country compliance account, compliance case, document or other regulatory resource.

Platform email infrastructure currently supports the Resend service for outbound and inbound email operations. Email messages processed through this functionality may be transmitted to and processed by the email provider for delivery and receipt.

Inbound email attachments may, where relevant to the compliance workflow, be converted into canonical Platform documents and retained as regulatory evidence.

Deleting or hiding an item from an individual user's interface does not necessarily erase the underlying communication where it remains part of another participant's lawful correspondence record, regulatory evidence, contractual file or audit history.

9. Documents, Evidence and Storage

Documents can pass through controlled storage states, including quarantine or validation stages, before becoming operational or evidence records.

Production document storage is designed to use Google Cloud Storage. Records can include content hashes, immutable version information, provenance, signature status, issuing country, retention class and legal-hold status.

The Platform may create time-limited signed links when access to an object is required.

Evidence incorporated into a declaration, regulatory submission, payment, signed agreement, evidence pack or comparable regulated record may become immutable or subject to a preservation rule.

A user's deletion request therefore does not necessarily permit destruction of documents that must be retained under regulatory, accounting, evidentiary or legal requirements.

10. Artificial Intelligence Features

Certain Platform features use artificial intelligence to assist users with tasks such as communication summarisation, translation, rewriting, reply drafting, document translation or interpretation, catalogue mapping, regulatory research, compliance explanations and financial-state explanations.

The current AI gateway is implemented using Google Vertex AI and applies feature-level data classifications and access controls before an inference request is made.

Depending on the function, information submitted to an AI service may include communication content, document content, client business data, packaging or shipment data, financial operational data, regulatory information or an instruction entered by a user.

AI features are subject to role and workspace authorisation. The Platform maintains AI governance and audit information such as the feature used, model routing information, data classification, actor and organisation context, prompt/output hashes, token usage, status and correlation identifiers.

For communication AI, the architecture records AI output as draft material and expressly marks authoritative action as none. Raw communication content is not duplicated into the AI artifact record merely for audit purposes.

Beyoğlu Professional does not treat generative AI output as an authoritative regulatory determination. Users remain responsible for reviewing AI-assisted content before relying on or submitting it.

The current Platform architecture is not designed to make a decision based solely on AI processing that produces legal effects concerning an individual or similarly significantly affects that individual. If such functionality is introduced, we will perform the required GDPR assessment and provide the information and safeguards required by Article 22 before deployment.

11. Recipients of Personal Data

Personal data may be disclosed where necessary to authorised personnel within the relevant client, AR or Beyoğlu Professional workspace; infrastructure and technology providers; authentication providers; email and notification providers; document-hosting providers; AI service providers; payment and financial-service providers; customer-selected commerce and marketplace platforms; professional advisers and auditors; authorised representatives; PROs; competent authorities and regulatory bodies; courts and law-enforcement authorities where disclosure is legally required; and other recipients authorised by the customer or data subject.

Access is role- and workspace-dependent. Membership in one client organisation does not by itself provide access to another organisation's data.

Where an external entity receives information as an independent controller, its own privacy rules apply to its subsequent processing.

12. Key Technology Providers

At the time of this version, the inspected Platform architecture includes Google services for authentication and cloud infrastructure, Google Cloud Storage for document storage, Google Secret Manager for sensitive integration secrets, Firebase Cloud Messaging for browser notifications where enabled, Google Vertex AI for governed AI functionality, Resend for email functions, and Wise integration for supported financial/payment operations.

Additional third-party platforms process data only when the relevant integration or service is enabled.

A maintained Subprocessor List should form part of the production privacy and contractual documentation and identify the contracting entity, processing function, processing location and applicable international-transfer safeguard for each processor.

13. International Transfers

Some service providers or connected systems may process information outside the European Economic Area.

Where GDPR Chapter V applies, Beyoğlu Professional uses an applicable lawful transfer mechanism, which may include an adequacy decision, the European Commission's Standard Contractual Clauses, or another mechanism recognised under the GDPR, together with supplementary safeguards where required.

The European Commission's current SCC framework expressly provides contractual safeguards for transfers of personal data from the EU/EEA to relevant third-country recipients. European Commission

Where feasible, infrastructure and provider regions will be configured to reduce unnecessary international transfers.

14. Data Retention

Personal data is not retained indefinitely merely because storage is technically possible.

Retention is determined according to the purpose for which data was collected, the duration of the client or user relationship, statutory limitation periods, regulatory and EPR recordkeeping requirements, financial and accounting obligations, evidence requirements, pending disputes, security obligations and any applicable legal hold.

The Platform architecture supports explicit retention classes, retention periods, preserve-until dates, legal holds and immutable regulatory evidence.

For example, regulatory declarations, filings, acknowledgements and supporting compliance evidence may be subject to multi-year preservation requirements. The operational system presently provides for five-year retention evidence in certain compliance-account workflows, but this is not a universal retention period for every category of data.

A retention policy applicable to a particular regulated record takes precedence over an ordinary deletion workflow while that policy remains legally justified.

Account authentication and operational information that is no longer required is deleted or anonymised in accordance with the applicable retention schedule.

15. Account Export and Erasure

The Platform architecture provides mechanisms capable of compiling account-related database records and associated stored files into an export archive before eligible account deletion.

Account deletion includes removal of the relevant identity account, associated database records within the eligible deletion scope and associated stored objects where deletion is permitted.

Deletion is not absolute. We may retain information where continued processing is necessary to comply with a legal obligation, establish or defend legal claims, preserve valid financial or regulatory records, protect the rights of other users or organisations, preserve shared-workspace integrity or fulfil another GDPR exception.

For example, a country-compliance account that has become operational, a completed regulatory payment or an effective regulatory relationship may give rise to records that can no longer simply be erased as if the underlying compliance activity never occurred.

Where only part of a dataset must be retained, we will limit processing of the retained information to the applicable lawful purpose.

16. Cookies and Local Browser Storage

The authenticated Platform uses strictly necessary technical cookies to secure user sessions and requests.

The current Client implementation uses session, CSRF and workspace cookies with security controls including HTTP-only access where appropriate, Secure-cookie operation in protected deployments and SameSite restrictions.

The current session design uses relatively short-lived authenticated sessions. The inspected implementation specifies a 45-minute server session, while CSRF tokens are shorter lived.

A user may optionally ask the login interface to remember an identifier in browser storage.

The inspected Platform source does not presently show implementation of advertising trackers, behavioural advertising pixels or general-purpose third-party analytics tracking in the authenticated application.

If non-essential cookies, analytics or marketing technologies are introduced, they will be covered by a separate consent mechanism and Cookie Policy where legally required.

17. Security

We implement technical and organisational controls appropriate to the nature and risk of the Platform.

These include authenticated access, short-lived sessions, CSRF protection, role- and capability-based authorisation, workspace segregation, MFA requirements for privileged root-level access, dedicated secret-management infrastructure, credential revocation and rotation mechanisms, document integrity hashes, audit trails, controlled document storage, scoped integrations, webhook verification mechanisms, restricted AI gateways, regulatory record immutability and controlled deletion procedures.

No information-security system can guarantee absolute security. Our controls are reviewed and adjusted in accordance with risk, technology and legal obligations.

Where a personal-data breach is subject to GDPR Articles 33 or 34, we will undertake the required assessment and notify the competent supervisory authority and affected individuals where the applicable legal thresholds are met.

18. Your GDPR Rights

Subject to the conditions and limitations in applicable law, you may request confirmation whether we process your personal data and access to that data; correction of inaccurate or incomplete information; erasure; restriction; portability where Article 20 applies; objection to processing based on legitimate interests; objection at any time to direct marketing; withdrawal of consent; and safeguards concerning qualifying solely automated decisions.

The right of access includes information about the purposes and categories of processing, recipients, storage period or criteria, and other information required by GDPR Article 15. The EDPB's current access guidance explains how controllers should implement that right. European Data Protection Board

Requests should be submitted through https://beyogluprofessional.com/contact.

We may need to verify your identity before fulfilling a request. We will not request more verification information than reasonably necessary.

GDPR requests will ordinarily be answered without undue delay and within one month, subject to the extensions permitted by the GDPR for complex or numerous requests. European Commission

Where Beyoğlu Professional processes data solely as processor for a client organisation, we may direct the request to, or cooperate with, the relevant controller.

19. Right to Object and Direct Marketing

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation.

Where personal data is processed for direct marketing, you may object at any time and the affected data will no longer be processed for that purpose.

Marketing preferences do not affect service communications that are necessary for an active account, requested transaction, regulatory workflow, security event or other non-marketing purpose.

20. Data Accuracy

Users and organisations are expected to maintain accurate business and contact details relevant to the services.

Where the Platform receives data from an external system, changes may need to be made either within the Platform or within the external source depending on which system is designated as the canonical source.

We may retain a historical version where required to demonstrate what information was relied upon for a prior regulatory filing, payment, decision or evidential event.

21. Confidentiality of Client Data

Client information is not made public merely because it is stored in the Platform.

Information is made available only to authorised users, organisations, representatives, service providers and recipients with a legitimate operational or legal basis for access.

We do not sell personal data.

We do not disclose client data to advertisers for behavioural advertising.

22. Children

The Platform is a professional B2B regulatory service and is not directed at children.

Users must be legally capable of acting for themselves or the organisation they represent. We do not knowingly create professional Platform accounts for children.

23. Regulatory Authorities and Legal Disclosure

Where Beyoğlu Professional or an authorised representative is required to prepare, file, evidence or administer a statutory regulatory obligation, necessary information may be transmitted to the competent authority, PRO, registry, payment recipient or other legally designated recipient.

Such disclosure is limited to information reasonably necessary for the applicable obligation or expressly authorised operation.

We may also disclose information where required by law, a binding court order or other enforceable legal process, or where necessary to establish, exercise or defend legal claims.

24. Changes to this Privacy Policy

We may amend this Privacy Policy to reflect material changes in the Platform, applicable law, processors, international-transfer mechanisms or processing purposes.

The current version and effective date will be published on the Platform or website.

Where a change materially affects how existing personal data is processed, we will provide additional notice where required by law.

A policy update will not retrospectively create a new lawful basis where one is required.

25. Complaints

You may first contact us through https://beyogluprofessional.com/contact so that we can investigate a privacy concern.

You also have the right to lodge a complaint with a competent data-protection supervisory authority, in particular in the EU/EEA Member State of your habitual residence, place of work or the place of the alleged infringement.

Exercising this right does not affect any other administrative or judicial remedy available to you.

26. Contact

Privacy and GDPR enquiries:

THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ
Tatlısu Mah. Aziz Blv. Çağrı Sitesi B Blok No:48, İç Kapı No:42, 34774 Ümraniye, İstanbul, Türkiye
Privacy contact: https://beyogluprofessional.com/contact
Data protection / DPO contact: https://beyogluprofessional.com/contact