Data Processing Agreement (DPA)

1. Parties, scope and acceptance

Convenience translation: this English version is provided for information only. The Turkish version is the binding text and prevails in case of any discrepancy.

This Data Processing Agreement ("DPA") is concluded under the Terms of Service (the "Main Agreement") between the Customer as data controller and [LEGAL_TRADE_NAME] ("İzin360") as data processor, pursuant to Article 12(2) of the Personal Data Protection Law No. 6698 ("KVKK"), and forms an integral part of the Main Agreement.

The DPA is accepted together with the Main Agreement when the account is opened; the accepting user, document version, time and IP address are kept in an unalterable record. A negotiated version may be signed separately with enterprise customers. In the event of a conflict between the DPA and the Main Agreement on matters of personal data protection, the DPA prevails.

2. Subject matter, purpose, duration, data categories and data subjects

The subject matter and purpose of processing is managing the leave processes of the Customer's employees (requests, approvals, balance and entitlement calculation, calendar, reporting, notifications, payroll and integration exports) on the Platform. Processing continues for the term of the Main Agreement and, after it ends, for the period set out in the "Return and deletion at the end of the agreement" section.

The Customer sets the retention period for records of employees who have left in the Platform settings (5–30 years after employment ends, default 10). When the period expires, İzin360 irreversibly anonymises the record through a monthly destruction job: identity and contact details, personnel and Turkish ID numbers, date of birth, gender, salary; documents (the stored file, its file name, content hash and file encryption key); leave reasons, decision notes, approval comments, event dates (birth, marriage, death), the child's date of birth, schedules and reasons in nursing leave and half-time work arrangements; balance adjustment descriptions; the employee's KVKK request texts and responses; IP address and browser information in the legal-text ledger; sessions, invitations, calendar subscription, notifications and event-queue records are deleted. Start and leaving dates are generalised to the year and team and manager links are removed. In the audit log, personal data in the content of rows about the person is erased and the IP address and browser information of the person's own actions are cleared; the chain remains verifiable and the erasure itself is recorded in the chain. Leave type, period, number of days, status and department remain as statistics that cannot be linked to the person. Records under a legal hold set by the Customer are not destroyed. Technical records are deleted as follows: notifications after 1 year (unread ones after 2 years), webhook delivery records after 90 days, ended sessions after 180 days, full account archives 7 days after they are prepared, concluded archive request records after 1 year.

3. Processing only on instructions

İzin360 processes personal data only on the Customer's documented instructions. The Main Agreement, this DPA, the settings and actions the Customer performs on the Platform (including integration, export and retention settings) and additional written instructions constitute the Customer's instructions.

• İzin360 does not process personal data for its own purposes or outside the instructions, and does not combine it with other customers' data.
• If it considers an instruction to be unlawful, it informs the Customer immediately.
• If processing or disclosure is required by law, it informs the Customer in advance unless the law prohibits this.

The Platform provides a draft employee privacy notice containing the elements of Article 4 of the Communiqué on the obligation to inform. Completing and publishing the notice and ensuring that its content is accurate are the Customer's responsibility as data controller; a notice with incomplete fields is not shown to employees.

4. Confidentiality

İzin360 ensures that its staff and sub-processors who access personal data are bound by written confidentiality obligations. Under Article 12(4) of the KVKK, the obligation not to disclose personal data learned and not to use it for purposes other than processing continues indefinitely, including after leaving the position and after this DPA ends.

5. Technical and organisational measures

Under Article 12(2) of the KVKK, the parties are jointly responsible for taking data security measures. Within the Platform, İzin360 applies at least the following measures:

• Enforced database row-level security between customers and role-based access control,
• Encrypted transmission (HTTPS/TLS), irreversible password storage, session security and brute-force protection,
• Two-factor authentication mandatory by default for users who can access health data (human resources roles, the Account Owner and managers); these users cannot use the Platform until they set it up. Only the Account Owner, from a session opened with two-factor authentication and with a reason and an acknowledgement of the legal risk, can lift the requirement; the decision is written to the audit log and is the Customer's responsibility as data controller. Opening another person's health document always requires two-factor authentication,
• Encryption of Turkish ID number, date of birth and salary fields with a customer-specific key,
• Encryption of uploaded documents with a per-file key and virus scanning on our own infrastructure,
• Limiting access to health-related leave documents to the requester, human resources and the direct manager; logging every document download and every view of the details of another person's health-related leave record (who, which record, when, from which IP address and browser),
• A tamper-evident audit log that the application cannot delete; successful and failed sign-ins, two-factor authentication and password change events are written to it with IP address, browser information and request trace ID,
• In an İzin360 support session (read-only), Turkish ID number, salary, date of birth and free-text fields are hidden, document and export downloads are blocked, and every request of the session is written to the Customer's audit log with the identity of the support staff member,
• Daily, encrypted backups on a rolling 14-day basis,
• Limiting access rights to what each role requires and confidentiality obligations for staff.

For special categories of personal data, the adequate measures set by the Personal Data Protection Board in Decision No. 2018/10 of 31.01.2018 are taken into account. Details are set out in the Privacy Policy. İzin360 may update the measures in line with technological developments but may not lower the level of protection.

6. Sub-processors

The Customer gives general written authorisation for İzin360 to work with the sub-processors in the list annexed to this DPA. İzin360:

• Enters into a written agreement with each sub-processor containing data protection obligations no less protective than those in this DPA, and remains liable to the Customer for the sub-processor's performance of its obligations.
• Notifies the Account Owner by e-mail at least 30 days before adding or replacing a sub-processor, and updates the list on this page.

The Customer may object on reasonable data protection grounds within 30 days of the notice. If the parties cannot reach a reasonable solution, the Customer may end its subscription before the change takes effect, in which case prepaid fees for the unused period are refunded pro rata.

7. Personal data breach notification

When İzin360 becomes aware that personal data held by it or its sub-processors has been obtained by others unlawfully, it notifies the Customer without undue delay (target: within 24 hours) by in-app notification and e-mail to the Account Owner and human resources managers; reading of the notice is recorded. To the extent known at the time, and to be completed in stages later, the notice contains:

• The start and detection time and the nature of the breach,
• The categories of data affected (including whether special categories are involved) and the approximate number of data subjects,
• The likely consequences and the measures taken or proposed,
• A contact person from whom more information can be obtained.

The obligation to notify the Board within 72 hours and to notify data subjects lies with the Customer as data controller; İzin360 provides reasonable support in preparing these notifications.

8. Data subject requests

İzin360 forwards data subject requests it receives directly to the Customer without delay and without responding to them itself, and informs the requester that the Customer is the data controller.

To enable the Customer to respond within thirty days under Article 13 of the KVKK, the Platform provides: employees sending requests to their employer from the app and downloading a copy of their own data (including the documents attached to their leave requests) as a ZIP file; the Account Owner and human resources managers concluding requests in writing (a reason is mandatory for rejections) and receiving reminders before the deadline; and the Account Owner and human resources managers exporting an employee's data together with their documents (in a session signed in with two-factor authentication if another employee's health documents are included). İzin360 provides reasonable technical support where necessary.

9. Return and deletion at the end of the agreement

• When the subscription ends, the account is closed or a suspended account is closed automatically, the account moves to a "closed" state. An account suspended at the end of the trial or for an unpaid renewal is closed if no package is chosen or no payment is made within 60 days of the suspension; the closure date is stated in the suspension notice and the Account Owner is reminded 30 and 7 days before closure. No data is deleted during the suspension.
• For 90 days from closure the Account Owner can sign in to the Platform and take back all Customer Data with the full account archive described below; the per-employee personal data archive (ZIP, including documents) and billing documents can also be downloaded at any time, and the audit log (CSV), payroll export files and advanced report exports if they were included in the last package in service (if only the trial was used, within the trial scope). Reminder e-mails stating the deletion date are sent on days 60, 80, 90 after closure.
• Full account archive (Settings › Data archive): the Account Owner requests it in a session signed in with two-factor authentication; the archive is prepared in the background and, when it is ready, the Account Owner receives an e-mail and an in-app notification (the e-mail contains no file or download link; the archive is downloaded only from the Platform). The archive contains all Customer Data: company and organisation structure, user and employee records (with the encrypted Turkish ID number, date of birth and salary decrypted), roles, leave types, policies and approval workflows, leave requests and approval history, balance and entitlement entries, nursing leave and half-time arrangements, holidays, delegations, KVKK records (legal text ledger, data subject requests, privacy notice versions and acknowledgements, breach notices), the audit log, notification and integration settings and billing records as machine-readable JSON, with the main tables also as CSV; the uploaded documents in their original form, each mapped to its record; official invoice PDFs; and a manifest showing the schema version and the SHA-256 of every file. For security, password hashes, two-factor secrets, session and verification tokens, API key hashes and webhook signing secrets are not included; for documents that were deleted, found infected or not yet virus-scanned only the record (with the reason) is included. The archive is stored encrypted and is deleted automatically 7 days after it is prepared; the Account Owner can delete it earlier. One archive is prepared at a time and at most 3 requests can be made in 24 hours. The archive is available at any time during the agreement and, while the account is suspended or closed, until the data is deleted, regardless of the package; requests, downloads and deletions are written to the audit log.
• During this period the Customer can reopen the account with its data by buying a paid package or, if the number of active users fits within the Free package's user limit, by choosing the Free package; no deletion then takes place and this DPA continues with the new subscription.
• If a return need cannot be met with these tools, the Customer may notify it in writing within this period; İzin360 provides reasonable support.
• At the end of the period, all personal data in the Customer account (database records, documents and their file encryption keys, the audit log) is permanently deleted from live systems and the deletion is written to the destruction record. Copies in backups are destroyed automatically when the 14-day backup retention period expires.
• Records that İzin360 keeps as data controller under its own legal obligations are outside the scope of this deletion and are deleted when their period ends: billing records 10 years from the end of the calendar year in which they were created, contract and DPA acceptance records 10 years from the end of the calendar year in which the contract ended, and users' records of consent to and refusal of commercial messages 3 years from the end of the consent (only with the e-mail address, consent type, version, time and IP address).
• On request, deletion is confirmed to the Customer in writing on the basis of the destruction record.

10. Information and audits

On the Customer's request, İzin360 provides the information and documents necessary to demonstrate compliance with this DPA. If this information is insufficient, the Customer may carry out an audit at most once a year, with at least 30 days' written notice, at its own expense and through an independent auditor bound by confidentiality. The audit is conducted so as not to jeopardise access to or the security of other customers' data or disrupt the service. These limitations do not apply in the event of a personal data breach or an investigation by the Board.

11. Transfers abroad

The Customer instructs and authorises İzin360 to transfer data to the sub-processors stated in the sub-processor list as located outside Türkiye (Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, Art. 5(1)). These transfers are made under Article 9 of the KVKK: [LEGAL_CROSS_BORDER_SAFEGUARD]. The same safeguards apply to onward transfers.

Transfers made through integrations initiated by the Customer itself (for example webhook addresses, calendar subscriptions and transfers using API keys) are made on the Customer's instructions and under its responsibility; if the destination is abroad, the obligations under Article 9 of the KVKK lie with the Customer. In these transfers, health-related leave types are sent only as "On leave".

12. Governing law

This DPA is governed by the laws of the Republic of Türkiye. The jurisdiction clause of the Main Agreement applies to disputes.

13. Annex: Sub-processors and service providers

Components and providers that are not sub-processors

• The database (PostgreSQL), document storage (SeaweedFS), virus scanning (ClamAV), queue (RabbitMQ), cache (Valkey) and monitoring (Grafana/OpenTelemetry) software run under İzin360's own management on the hosting servers above; no data is sent to a third party for these components.
• PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (Türkiye): collects subscription payments; processes only the payment details of the Customer representative who pays, has no access to employee data and is an independent data controller for card data.
• [LEGAL_EINVOICE_PROVIDER] (Türkiye): issues the Customer's official invoices; processes only billing details and has no access to employee data. This falls under processing for which İzin360 is the data controller.

Changes to the list are notified at least 30 days in advance. Questions: [LEGAL_PRIVACY_EMAIL]