CONFIDENTIALITY AND PERSONAL DATA PROCESSING AGREEMENT

1. Parties

This Agreement ("Agreement") is entered into by and between Küresel Çözüm Bilgi Teknolojileri Pazarlama ve Ticaret Limited Şirketi (Data Controller), with its registered office at “Küçükbakkalköy Mahallesi Dereboyu Caddesi R5 Blok No:3A İç Kapı No:48 Ataşehir/İSTANBUL”, and ……… Inc., with its registered office at ……… (Data Recipient).

Each shall be referred to individually as a “Party” and collectively as the “Parties.”

2. Purpose

The Parties have signed this Agreement to ensure the protection of confidentiality of the information obtained and compliance with the obligations set forth by the Law No. 6698 on the Protection of Personal Data (“KVKK”) and secondary regulations regarding the commercial/business relationship (“Business”) between them, whether ongoing or planned for the future.

3. Definitions

Term	Definition
Receiving Party	The party to whom the Personal Data is transferred
Disclosing Party	The party disclosing Confidential Information
Recipient	The party receiving Confidential Information/td>
Confidential Information	All documents, data, software, and intellectual-material rights related to the Disclosing Party, its suppliers, affiliates, or any third parties in commercial relation, shared or accessible due to the Business. Public information and legally/mandatorily disclosed data are excluded.
Data Subject	The natural person whose Personal Data is processed
KVKK	Law No. 6698 on the Protection of Personal Data
KVKK Legislation	KVKK, its regulations, Board communiqués and decisions, and other related legislation
Personal Data	Any information relating to an identified or identifiable natural person
Processing	Any operation performed on Personal Data, such as obtaining, recording, storing, altering, or transferring it, manually or automatically
Authority	The Personal Data Protection Authorityu
Board	The Personal Data Protection Board
Special Category Data	Data related to race, ethnicity, political opinion, religion, attire, health, sexual life, criminal convictions, biometric/genetic data, etc
Sharing Party	The Party sharing the Personal Data
Guidelines	Guides published on the official website of the KVKK
Representatives	Parties’ partners, employees, agents, consultants, managers, etc.
Data Breach	The acquisition of personal data through illegal means
Data Processor	A natural/legal person authorized by the Data Controller to process data on its behalf
Controller	The person who determines the purpose and means of processing and manages the data recording system

4. Nature and Scope of the Agreement

This Agreement serves as an annex to all existing or future agreements between the Parties.
All Personal Data and Confidential Information shared verbally, in writing, or digitally fall within its scope

5. Confidentiality Provisions

5.1. Depending on the nature of the Business, Parties may act as either the Disclosing or Receiving Party.
5.2. The Recipient shall use all Confidential Information solely for the purposes of this Agreement.
5.3. All intellectual and financial rights of the Confidential Information belong to the Disclosing Party.
5.4.The Recipient shall not share Confidential Information with third parties, shall store it securely, and take all necessary administrative and technical precautions.
5.5. Copying is prohibited without written consent; all copies remain the property of the Disclosing Party.
5.6. Even in legally obligatory situations, prior consent of the Disclosing Party must be sought.
5.7. These obligations continue indefinitely, even after the termination of the Parties’ relationship.
5.8. In the event of a breach, the Recipient shall compensate for all direct and indirect damages.
5.9.Upon termination of the relationship or this Agreement, all materials shall be returned or destroyed.
5.10. Representatives agree to comply with these obligations even after leaving the Party.

6. PERSONAL DATA PROCESSING PROVISIONS

The Parties undertake to act in accordance with the KVKK legislation, the Guidelines, and this Agreement.
6.1. The Data Controller confirms that the data transferred to the Data Processor has been collected lawfully.
6.2. The Data Processor shall immediately inform the Controller of any notice regarding unlawful processing.
6.3. All technical and administrative security measures are the responsibility of the Data Processor.
6.4. Audit requests shall be responded to in writing and timely; on-site/remote audits shall be permitted.
6.5. Data subject applications shall be managed in coordination with the Data Controller.
6.6. In case of a Data Breach, notification shall be made within a maximum of 12 hours.
6.7. In case of sanctions or compensation, the right of recourse is reserved according to fault.
6.8. At the end of retention periods, data shall be either destroyed or returned.
6.9. Explicit consent and information obligations shall be fulfilled and recorded by the Data Processor.
6.10. Additional measures specified in Board decisions shall be applied for Special Category Data.
6.11. The Parties, acting as Data Controllers, shall only process each other’s data for the stated purpose.
6.12. Coordination shall be ensured in case of data subject applications or official requests.
6.13. The Parties are also responsible for any breach by their Representatives.

Signature Section

DATA CONTROLLER

Name Surname: .....................................

Title: ................................................

Signature: ..................................................

VERİ PAYLAŞILAN