CONFIDENTIALITY AND PERSONAL DATA PROCESSING AGREEMENT

1. Parties

This Agreement ("Agreement") is entered into by and between Küresel Çözüm Bilgi Teknolojileri Pazarlama ve Ticaret Limited Şirketi (Data Controller), with its registered office at “Küçükbakkalköy Mahallesi Dereboyu Caddesi R5 Blok No:3A İç Kapı No:48 Ataşehir/İSTANBUL”, and ……… Inc., with its registered office at ……… (Data Recipient).

Each shall be referred to individually as a “Party” and collectively as the “Parties.”

2. Purpose

The Parties have signed this Agreement to ensure the protection of confidentiality of the information obtained and compliance with the obligations set forth by the Law No. 6698 on the Protection of Personal Data (“KVKK”) and secondary regulations regarding the commercial/business relationship (“Business”) between them, whether ongoing or planned for the future.

3. Definitions

4. Nature and Scope of the Agreement

• This Agreement serves as an annex to all existing or future agreements between the Parties.
• All Personal Data and Confidential Information shared verbally, in writing, or digitally fall within its scope

5. Confidentiality Provisions

• 5.1. Depending on the nature of the Business, Parties may act as either the Disclosing or Receiving Party.
• 5.2. The Recipient shall use all Confidential Information solely for the purposes of this Agreement.
• 5.3. All intellectual and financial rights of the Confidential Information belong to the Disclosing Party.
• 5.4.The Recipient shall not share Confidential Information with third parties, shall store it securely, and take all necessary administrative and technical precautions.
• 5.5. Copying is prohibited without written consent; all copies remain the property of the Disclosing Party.
• 5.6. Even in legally obligatory situations, prior consent of the Disclosing Party must be sought.
• 5.7. These obligations continue indefinitely, even after the termination of the Parties’ relationship.
• 5.8. In the event of a breach, the Recipient shall compensate for all direct and indirect damages.
• 5.9.Upon termination of the relationship or this Agreement, all materials shall be returned or destroyed.
• 5.10. Representatives agree to comply with these obligations even after leaving the Party.

6. PERSONAL DATA PROCESSING PROVISIONS

• The Parties undertake to act in accordance with the KVKK legislation, the Guidelines, and this Agreement.
• 6.1. The Data Controller confirms that the data transferred to the Data Processor has been collected lawfully.
• 6.2. The Data Processor shall immediately inform the Controller of any notice regarding unlawful processing.
• 6.3. All technical and administrative security measures are the responsibility of the Data Processor.
• 6.4. Audit requests shall be responded to in writing and timely; on-site/remote audits shall be permitted.
• 6.5. Data subject applications shall be managed in coordination with the Data Controller.
• 6.6. In case of a Data Breach, notification shall be made within a maximum of 12 hours.
• 6.7. In case of sanctions or compensation, the right of recourse is reserved according to fault.
• 6.8. At the end of retention periods, data shall be either destroyed or returned.
• 6.9. Explicit consent and information obligations shall be fulfilled and recorded by the Data Processor.
• 6.10. Additional measures specified in Board decisions shall be applied for Special Category Data.
• 6.11. The Parties, acting as Data Controllers, shall only process each other’s data for the stated purpose.
• 6.12. Coordination shall be ensured in case of data subject applications or official requests.
• 6.13. The Parties are also responsible for any breach by their Representatives.

Signature Section