This Data Processing Agreement (“DPA”) is Annex-2 to the Çözüm Hanem Subscription and Service Agreement (“Agreement”) and governs the rights and obligations relating to the processing of personal data recorded on the Platform under Personal Data Protection Law No. 6698 (“the Law”). The identity details of the company providing services as data processor are set out below:

Trade name: Akıl Yapay Zeka ve Yazılım Teknolojileri Anonim Şirketi
Brand: Çözüm Hanem
MERSİS number: 0025117079500001
Tax office / number: Şehitkamil / 0251170795
Trade registry: Gaziantep Trade Registry Office – 80814
Head office address: OSB 2. Bölge 83235 Nolu Cd. No:8, Başpınar (Organize) OSB, 27620 Şehitkamil/Gaziantep
Phone: +90 551 678 89 15
Email: [email protected]
Website: https://www.cozumhanem.com

1. Roles

The Subscriber is the data controller and the Company is the data processor with respect to the personal data the Subscriber records on the Platform. The Company is the data controller with respect to its own account, security, agreement, billing and payment intermediation records.

2. Instruction

The Company processes personal data only for the performance of the Agreement and in line with the Subscriber’s Platform settings and written instructions; if it considers an instruction to be contrary to legislation, it informs the Subscriber immediately.

3. Data Processed and Data Subjects

Data subjects: residents (unit owners, tenants, independent unit users), management and staff users, supplier representatives. Data categories: identity, contact, independent unit, financial (maintenance fees, debts, collections), requests, meters, access logs and, to the extent entered by the Subscriber, special category personal data (for example, disability information in payroll).

4. Security

The Company takes the technical and administrative measures set out in Article 12 of the Law; a summary of these measures is provided in the annex to this document. Company personnel are under a confidentiality obligation and access data only to the extent required by their duties.

5. Sub-processors

The current list of sub-processors used by the Company is published in the annex to this document. A new sub-processor is notified to the Subscriber at least fourteen days in advance, and the Subscriber may object on reasonable grounds. Payment institutions and banks are not sub-processors; they are independent data controllers under their own legislation.

6. Transfers abroad

Where sub-processors' servers are located abroad, transfers are carried out based on the adequacy decision under Article 9 of the Law or on appropriate safeguards (including signing the standard contract announced by the Personal Data Protection Board and notifying the Board).

7. Breach notification

The Company notifies the Subscriber within twenty-four hours at the latest from the moment it becomes aware of a personal data breach affecting the Subscriber's data, and assists the Subscriber in fulfilling its obligation to notify the Board and the relevant data subjects.

8. Data subject requests

The Company forwards requests it receives directly and that relate to data for which the Subscriber is the data controller to the Subscriber without delay and provides whatever support is technically possible.

9. Data during the restriction period

If access is restricted due to non-payment, the Company does not delete or alter data, and does not prevent the Subscriber from exporting their data.

10. Termination: Refunds and Deletion

When the agreement ends, the Company offers the Subscriber the ability to export their data in machine-readable format (Excel/CSV and PDF) and deletes or anonymizes the data within the periods set out in Article 11 of the agreement: the export period is 30 days from termination, and deletion takes place within 90 days of termination at the latest. The Company keeps a record of the deletion for at least three years and sends the Subscriber a deletion confirmation.

11. Audit

The Subscriber may request information and documents regarding the Company's compliance with this ISMS, with reasonable notice and no more than once a year.

Appendix: Summary of Technical and Administrative Measures

Encryption of communication (HTTPS/TLS), storing passwords as one-way hashes and protection against brute-force attempts,
Role- and permission-based access, so that each management's data can only be accessed by that management's authorized users,
Audit logs showing who made changes and when,
Regular backups and storage of backups with access controls,
Staff confidentiality undertakings and access reviews,
Monitoring security updates and remediating vulnerabilities.

Appendix: Sub-processors

Hosting and database service provider,
Email delivery service provider,
WhatsApp Business (Meta Platforms) — solely for approved WhatsApp notifications and the chat assistant,
Mobile push notification service (Google Firebase),
Content delivery and security service (Cloudflare),
AI-powered assistant service provider,
SMS delivery service provider.