This agreement is made under Article 12(2) of KVKK between the Customer (data controller) and Diyaval (data processor) and forms part of the Platform Service and Licence Agreement.
1. Subject
Diyaval processes personal data in Customer Data only to provide the Platform: hosting, display, transmission to the integrations the Customer switches on, backup, support and security.
2. Data subjects and categories
Depending on the modules used: the Customer's employees and users (identity, contact, Turkish identity number, role, attendance and overtime, location recorded at clock-in/out, payroll inputs, documents); the Customer's customers, dealers and suppliers (identity, contact, tax number, address, orders, invoices, receivables and payables, correspondence); product images and documents uploaded by Users; access and audit logs.
3. Diyaval's obligations
- Process data only on the Customer's documented instructions, which are the Platform functions the Customer uses and any written instruction.
- Bind personnel with access to confidentiality and grant access on a need-to-know basis.
- Apply the technical and organisational measures in the Personal Data Security Guide published by the Authority, including encrypted connections, role-based access, logging, separated environments and backups.
- Notify the Customer without undue delay and in any case within 24 hours of becoming aware of a personal data breach, with the information needed for the Customer's own notification to the Board within 72 hours.
- Help the Customer answer data subject applications and forward any application received directly.
- Not transfer data abroad except as listed below or instructed in writing, and only in compliance with KVKK Article 9.
- At the end of the agreement, return data by export and then delete it as described in the Platform Service and Licence Agreement.
- Provide information reasonably needed to demonstrate compliance and allow audits on reasonable notice, at the Customer's cost and without access to other customers' data.
4. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hosting infrastructure | Servers, storage, backups | — |
| Yandex 360 (Yandex LLC) | Sending system emails (password, notifications) | Outside Türkiye |
| Netgsm İletişim ve Bilgi Teknolojileri A.Ş. | Sending one-time sign-in verification and e-document signature codes by SMS | Türkiye |
Integrations the Customer switches on (for example the Revenue Administration, marketplaces or banks) are third parties chosen by the Customer, not Diyaval sub-processors. Diyaval informs the Customer at least 30 days before adding or replacing a sub-processor; the Customer may object on reasonable grounds.
5. Customer's obligations
The Customer ensures that it has a legal basis for the data it enters, gives the notices required to its data subjects (including employees about location recording at clock-in), and processes special categories of data (such as health reports) only with the additional measures required by the Board.