BEYOĞLU PROFESSIONAL SUBPROCESSOR SCHEDULE

BEYOĞLU PROFESSIONAL SUBPROCESSOR SCHEDULE

Version: 1.0
Effective Date: 1 October 2026
Last Updated: 1 October 2026

This Subprocessor Schedule forms part of the Data Processing Agreement (“DPA”) applicable to the Beyoğlu Professional PPWR-EPR Client Portal and related services.

Capitalised terms not defined in this Schedule have the meanings given in the DPA.

For purposes of this Schedule, “Beyoğlu” means the Beyoğlu Professional contracting entity identified in the applicable DPA, Order Form or Service Agreement.

1. Purpose

Where Beyoğlu processes Personal Data on behalf of a Customer as a Processor, Beyoğlu may engage third-party service providers to perform limited processing activities necessary to provide, secure, operate or support the Services.

Such service providers are “Subprocessors” only to the extent that they process Customer Personal Data on behalf of Beyoğlu in Beyoğlu’s capacity as Processor.

This Schedule identifies Beyoğlu’s authorised Subprocessors and describes the framework applicable to their engagement.

2. General Authorisation

By entering into the DPA, the Customer grants Beyoğlu general written authorisation under Article 28(2) GDPR to engage the Subprocessors identified in this Schedule.

Beyoğlu will not permit a Subprocessor to process Customer Personal Data unless the Subprocessor has been subjected to written data-protection obligations that provide protection materially equivalent to the obligations applicable to Beyoğlu under the DPA, including the requirements of Article 28 GDPR where applicable.

Beyoğlu remains responsible to the Customer for the performance of its Subprocessors’ data-protection obligations to the extent required by Article 28(4) GDPR.

3. Current Authorised Subprocessors

Google Cloud’s published contracting-entity information currently identifies Google Cloud EMEA Limited as the contracting entity for Google Cloud customers in EMEA other than specified countries, and gives its Dublin address as 70 Sir John Rogerson’s Quay. Google Cloud The production architecture we reviewed specifies europe-west3; Google identifies that Cloud Run region as Frankfurt, Germany. Google Cloud Documentation

Firebase’s current processing terms expressly address Google’s role as processor, onward Subprocessors, contractual flow-down obligations and advance notice of new Subprocessors. Firebase

Resend’s DPA identifies its legal entity as Plus Five Five, Inc., at the San Francisco address above, and its own materials state that stored data is held in the United States with SCCs used for relevant EU/UK transfers. Resend

4. Feature-Dependent Processing

Not every Subprocessor processes Personal Data for every Customer.

A Subprocessor may process Customer Personal Data only where the relevant functionality is enabled, used or required for the Customer’s Services.

For example, Vertex AI processing occurs only where an applicable AI-assisted feature is enabled and used. Google Calendar or Google Meet processing occurs only where meeting functionality is used. Firebase Cloud Messaging processes device or browser push information only where the applicable notification functionality is enabled.

The presence of a Subprocessor in this Schedule therefore does not mean that Personal Data is necessarily transferred to that Subprocessor for every Customer.

5. Downstream Subprocessors

Certain Subprocessors, including Google and Resend, maintain their own networks of authorised downstream subprocessors.

Beyoğlu requires its Subprocessors to impose appropriate data-protection obligations upon their downstream processors in accordance with applicable law and the relevant processing agreement.

Upon reasonable request, Beyoğlu will make available information reasonably necessary for the Customer to identify applicable downstream processors involved in the processing of Customer Personal Data, including their identity, processing function and location where such information is available to Beyoğlu and may lawfully be disclosed.

Beyoğlu may satisfy this obligation by providing or referencing the then-current official subprocessor information maintained by the applicable service provider, together with supplementary information where reasonably necessary.

Google’s Firebase terms expressly require written flow-down protections for its own subprocessors and make their names, locations and activities available through Google’s published subprocessor information. Firebase Resend likewise maintains a current public downstream subprocessor list; as of its August 2026 update, that list includes infrastructure, security, monitoring and delivery providers used by Resend. Resend

6. Addition or Replacement of Subprocessors

Beyoğlu will provide the Customer with at least 30 calendar days’ prior written notice before a new direct Subprocessor begins processing Customer Personal Data or an existing direct Subprocessor is replaced.

Notice will be provided to the Customer’s registered administrative email address and/or through a specific Portal legal or contractual notification.

Merely changing this webpage without direct notice will not constitute the sole notification mechanism where Article 28(2) GDPR requires the Customer to be given an opportunity to object.

The notice will identify, as reasonably applicable, the new Subprocessor, its processing purpose, principal processing location and the relevant international-transfer safeguards.

7. Customer Objection

The Customer may object to the proposed engagement of a new or replacement Subprocessor on reasonable grounds relating to the protection of Personal Data.

Any objection must be submitted in writing within 15 calendar days after receipt of the applicable notice and must describe the Customer’s specific data-protection concerns.

Beyoğlu and the Customer will work in good faith to resolve a valid objection, including by considering reasonable technical or contractual safeguards, configuration changes or another commercially reasonable processing arrangement.

A Customer may not object solely because a Subprocessor is located outside the Customer’s own country where the proposed processing otherwise complies with applicable data-protection law.

8. Unresolved Objections

If the parties cannot reasonably resolve a valid objection before the proposed Subprocessor is scheduled to begin processing Customer Personal Data, Beyoğlu will not use that Subprocessor for the affected Customer processing until the objection is resolved, except where the Customer expressly authorises such processing.

Where no commercially reasonable alternative can be provided without the proposed Subprocessor, either party may terminate the affected portion of the Services before the Subprocessor begins processing the affected Personal Data.

Termination under this Section affects only the functionality or Services that reasonably require the disputed Subprocessor.

9. Security or Emergency Changes

Beyoğlu will not intentionally bypass the Article 28(2) notification and objection process by characterising an ordinary vendor change as an emergency.

If an urgent security, legal or service-continuity matter requires replacement of an infrastructure provider, Beyoğlu will, where practicable, suspend or restrict the affected functionality until the required Subprocessor authorisation process is completed.

Where applicable law allows another approach, Beyoğlu will provide the Customer with notice and information as soon as legally and operationally possible.

10. Subprocessor Due Diligence

Before engaging a Subprocessor that will process Customer Personal Data, Beyoğlu will assess whether the Subprocessor provides sufficient guarantees regarding appropriate technical and organisational measures.

The assessment may consider security documentation, certifications, audit reports, data-processing terms, confidentiality commitments, incident-response procedures, data-location arrangements, access controls, international-transfer mechanisms, business continuity and other safeguards relevant to the processing.

The scope and depth of due diligence may be proportionate to the nature, sensitivity, volume and risk of the processing, without reducing the obligation to ensure sufficient guarantees.

11. International Transfers

Where a Subprocessor processes Customer Personal Data outside the European Economic Area or otherwise conducts a Restricted Transfer under applicable Data Protection Law, Beyoğlu will ensure that an appropriate transfer mechanism is in place.

Depending on the circumstances, this may include an adequacy decision, the European Commission Standard Contractual Clauses, an approved certification or framework, binding corporate rules or another lawful transfer mechanism.

Where required, appropriate supplementary technical, organisational or contractual measures and transfer-risk assessments will be applied.

The existence of a cloud region within the EEA does not by itself mean that all support, maintenance, telemetry or downstream processing necessarily occurs exclusively within the EEA.

12. Information Available to Customers

Upon reasonable request relating to the Customer’s GDPR accountability obligations, Beyoğlu will provide information reasonably necessary to evaluate an authorised Subprocessor.

This may include the Subprocessor’s legal identity, address, processing activities, principal processing locations, applicable data-protection agreement, relevant security assurance and international-transfer mechanism.

Commercially sensitive information, security-sensitive material and third-party confidential information may be provided subject to appropriate confidentiality protections.

This approach is consistent with the EDPB’s view that controller organisations should have information about the identity of processors and subprocessors available in order to fulfil their Article 28 accountability obligations. European Data Protection Board

13. Subprocessor Agreements

Each direct Subprocessor processing Customer Personal Data on Beyoğlu’s behalf must be bound by a written agreement containing appropriate data-protection obligations.

Such obligations will include, as applicable, processing only for authorised purposes, confidentiality, security, assistance with data-subject rights, breach notification, deletion or return of Personal Data, international-transfer safeguards and appropriate audit or assurance provisions.

Beyoğlu is not required to disclose unrelated commercial terms of its agreements with Subprocessors.

Where disclosure of relevant contractual provisions is reasonably required for a Customer’s GDPR compliance assessment, Beyoğlu may provide an appropriately redacted version, summary, certification or equivalent evidence.

14. Security Incidents

A Subprocessor must notify Beyoğlu of a Personal Data Breach affecting Customer Personal Data in accordance with its contractual obligations and applicable law.

Beyoğlu remains responsible for notifying the Customer in accordance with the DPA.

A notification by a Subprocessor does not relieve Beyoğlu of its obligations to the Customer.

15. Return and Deletion

Subprocessors may retain Customer Personal Data only for as long as required to provide the subcontracted services, comply with lawful retention requirements or complete ordinary backup deletion cycles consistent with their applicable agreements.

On termination of the relevant service or on Beyoğlu’s lawful instruction, the Subprocessor must delete or return Customer Personal Data in accordance with the applicable processing agreement, subject to mandatory legal retention.

16. Services That Are Not Necessarily Subprocessors

Certain third parties interacting with the Portal are not automatically Subprocessors.

Banks, Wise and other payment institutions generally determine their own purposes for payment, KYC, AML, fraud-prevention and banking processing and may therefore act as independent Controllers.

Producer Responsibility Organisations, competent authorities, regulatory authorities and Authorized Representative entities may act as independent Controllers, joint Controllers or Processors depending on the relevant statutory mandate and contractual arrangement.

Customer-selected commerce, marketplace, ERP or logistics providers such as Shopify, WooCommerce, Wix, Tilda, Etsy, Amazon, eBay, Allegro, BigCommerce or PrestaShop ordinarily process data under the Customer’s own relationship with that provider. Merely connecting such a service to the Portal does not make that provider a Subprocessor of Beyoğlu.

Google or another provider may likewise act under a different role where a Customer directly connects its own account or independently determines how that provider will process Personal Data.

The Portal’s own privacy analysis already distinguishes these classes: Wise/banks are generally treated as independent Controllers; commerce providers operate under their own provider/customer relationship; and ARs, PROs and authorities require role analysis based on the specific mandate.

17. Corporate and Internal Service Providers

A vendor used solely for Beyoğlu’s own corporate administration, accounting, internal HR, legal services, sales administration or other independent-controller activity is not included in this Schedule unless that vendor processes Customer Personal Data on behalf of Beyoğlu in Beyoğlu’s capacity as Processor.

If such a vendor later begins processing Customer Personal Data as part of the Services, it will be assessed under this Schedule before such processing begins.

18. Subprocessor Register

Beyoğlu will maintain an internal register of direct Subprocessors used for Processor activities.

The register should contain, as applicable, the Subprocessor’s legal name, address, contact or privacy contact, contracted service, processing activity, Personal Data categories, Data Subject categories, processing locations, transfer mechanism, DPA status, security-review status, onboarding date, last-review date and termination date.

The public Schedule may present a simplified version of that information, provided that Customer organisations can obtain the additional information reasonably necessary for GDPR accountability.

19. Relationship with the DPA

This Schedule forms part of and is incorporated into the DPA.

If this Schedule conflicts with the DPA, the DPA prevails unless this Schedule expressly states that it amends the relevant provision.

Nothing in this Schedule reduces the protections afforded to Data Subjects under applicable Data Protection Law.

20. Contact for Subprocessor Matters

Questions, objections or requests concerning Subprocessors should be sent to:

Beyoğlu Professional
Data Protection / Privacy
Privacy contact: https://beyogluprofessional.com/contact
Legal entity: THEMİR MEDYA İNŞAAT İTHALAT İHRACAT SANAYİ TİCARET ANONİM ŞİRKETİ
Registered address: Tatlısu Mah. Aziz Blv. Çağrı Sitesi B Blok No:48, İç Kapı No:42, 34774 Ümraniye, İstanbul, Türkiye

A Customer submitting an objection to a proposed Subprocessor should include the Customer organisation name, account identifier, affected processing activity and specific data-protection grounds for the objection.