Data Processing Agreement

This English translation is provided for convenience. The Turkish text is the governing version.

This agreement governs the relationship between a company that subscribes to IWB and Firmanet with respect to the personal data processed in that company’s workspace. It is an annex to the subscription agreement and is expressly accepted together with it. The text on this page is for information purposes. The text that binds the parties is the one attached to the subscription agreement and identified by its version label.

1. Parties and definitions

1.1 One party is the company that subscribes to IWB and signs the subscription agreement (the “Customer”). The other party is:

Firmanet Yazılım ve Teknoloji A.Ş. (“Firmanet”), Büyükkayacık OSB Mahallesi, 101. Cadde, InnoPark Konya TGB, B Blok, No:4/105, 42160 Selçuklu / Konya. Phone: +90 (312) 439 3940. Email: [email protected]

1.2 The terms used in this agreement have the meanings below. Terms not defined here have the same meaning as in Law No. 6698 on the Protection of Personal Data (KVKK).

Term	Meaning
Subscription agreement	The main agreement between the Customer and Firmanet for the provision of IWB. This agreement is an annex to it.
IWB	The business management software developed and provided by Firmanet, including the IWB application and IWB AI.
Cloud deployment	The deployment model in which IWB runs on servers provided by Firmanet and the Customer uses it through app.iwb.com.tr or through an iwb.com.tr subdomain dedicated to the Customer.
On-premises deployment	The deployment model in which IWB runs on the Customer’s own server.
Workspace	The area in IWB allocated to the Customer, in which the Customer’s data is kept.
User	A person whom the Customer defines and authorizes in IWB.
Customer data	The personal data that Firmanet processes on behalf of the Customer under this agreement.
Data subject	The natural person to whom customer data relates.
Data controller	The person who determines the purposes and means of processing.
Data processor	The person who processes personal data on behalf of the data controller, based on the authority granted by the data controller.
Sub-processor	A third-party service provider that Firmanet uses to process customer data and that has access to customer data.
Instruction	The Customer’s direction regarding the processing of customer data. Its forms are set out in Article 4.
Data breach	Customer data being unlawfully obtained by others, disclosed, altered, or lost, or becoming inaccessible.
IWB AI	The artificial intelligence features of IWB: chat, tender document reading, receipt reading, service suggestions, and natural language filtering.
Admin panel	The internal tool that Firmanet uses to operate the cloud deployment.
Written	Any correspondence of which a record can be kept, including documents bearing a wet-ink signature and email.
Board, Authority	The Personal Data Protection Board (the Board) and the Personal Data Protection Authority (the Authority).

1.3 If this agreement and the subscription agreement conflict on a matter relating to the processing of personal data, this agreement applies.

2. Scope

2.1 In the cloud deployment, this agreement applies to all business data in the workspace. This includes contact, employee, document, email, file, service, and location records, and any other personal data that the Customer enters into IWB or receives through IWB. The agreement also applies to the following processing:

• processing carried out with IWB AI, and IWB AI conversation records;
• transmission, on the Customer’s instructions, to services that the Customer connects with its own account (e-document integrator, SMS, WhatsApp, bank transaction feed, mailbox);
• customer data in screenshots and files attached to support requests;
• actions that Firmanet staff perform through the admin panel on behalf of the Customer (creating users, lifting account locks, resetting passwords, anonymization);
• the migration of data from a legacy ERP to IWB, and the migration export taken for this purpose;
• usage counters of the Tasks module (daily totals per workspace).

2.2 In an on-premises deployment, customer data is on the Customer’s server. No inbound connection is opened for administration, and the license is verified without an internet connection. As a rule, Firmanet does not access this data. In an on-premises deployment, this agreement applies only in the following cases:

• processing in which Firmanet accesses customer data for installation, data migration, customization, and support, with the Customer’s permission and by a method the Customer provides;
• external services that the Customer turns on in its own installation and that run on Firmanet’s account (such as IWB AI and support tickets). These services are off unless configured. If they are turned on, the rules set out in this agreement for the cloud deployment apply.

2.3 In an on-premises deployment, the operational information that the optional update agent sends to Firmanet (version, health, disk, backup status, server IP address) is not customer data. Firmanet processes this information for its own purposes, as a data controller (3.3).

3. Roles

3.1 The Customer is the data controller of customer data. The Customer decides which data is collected, for what purpose and from whom, with whom it is shared, and how long it is kept. Firmanet is the data processor that processes customer data on behalf of the Customer. The roles have been determined according to actual decision-making power over the processing, not according to the labels used in the agreement.

3.2 Within the limits of this agreement, the Customer leaves the following decisions on the technical details of processing to Firmanet: the IT infrastructure to be used, the storage method, the details of the security measures, the transfer method, how retention periods are applied, and the method of deletion, destruction, or anonymization. These decisions do not make Firmanet a data controller.

3.3 Firmanet is a data controller, for its own purposes, in the processing listed below. This processing is not the subject of this agreement; it is governed by the Privacy Notice: customers, product users, business partners, and suppliers:

• data of representatives of customers, business partners, and suppliers, processed for quotes, contracts, installation, training, invoicing, and collections;
• processing of users’ sign-in, two-step verification, account lockout, device limit, and session records, and of invitation, password reset, and verification code emails, for the purpose of platform security;
• in support requests, the requester’s name, email, workspace, and company name, page and browser information, and the description of the request;
• subscription, plan, invoicing, and contract records;
• the number of users and the amount of IWB AI usage, for plan limits and invoicing (in aggregate, without being linked to individuals);
• in an on-premises deployment, the operational information sent by the update agent.

3.4 The Customer also sees sign-in and session records for its own administrative purposes. For this use, Firmanet is a data processor acting on behalf of the Customer.

3.5 If Firmanet processes customer data for a purpose other than the one stated in this agreement and in the Customer’s instructions, it is deemed a data controller with respect to that processing. Liability arising from this lies with Firmanet.

4. Instructions

4.1 Firmanet processes customer data only on the Customer’s instructions and only to provide the IWB service. The instructions are:

• this agreement and the subscription agreement;
• the Customer’s settings in IWB and the actions its users take in IWB (for example, turning on a module or IWB AI, connecting a service, deleting a record);
• written instructions from the Customer’s authorized representative.

4.2 If Firmanet considers that an instruction violates the KVKK or applicable legislation, it notifies the Customer in writing without delay. It may suspend the relevant processing until the Customer corrects the instruction or confirms it in writing.

4.3 Firmanet does not use customer data for product development, AI model training, or marketing. It does not sell customer data or share it with third parties for its own purposes. The aggregate figures used for plan limits and invoicing (3.3) are outside this rule and are not linked to individuals.

4.4 If a competent public authority requests customer data, Firmanet notifies the Customer without delay, unless legally prohibited from doing so. It meets the request only to the extent required by law.

5. Customer’s obligations

5.1 Duty to inform. The Customer informs the data subjects whose data it processes in IWB, in accordance with KVKK Article 10. These include the Customer’s employees, users, and job candidates, representatives of its customers and suppliers, service customers, and portal users. In its privacy notice, the Customer states that the data is transferred to a software service provider, and which of the transfers abroad described in Article 9 apply to it.

5.2 Legal basis. For each processing activity, the Customer relies on one of the conditions for processing in KVKK Article 5. For special categories of personal data, it relies on one of the conditions in KVKK Article 6(3) and takes, within its own organization, the adequate measures determined by the Board for special categories of personal data. The additional measures that Firmanet provides in IWB for special categories of personal data are set out in Annex 1.

5.3 Monitoring of employee communications. If the Customer uses IWB’s email, messaging, customer relationship management, and task modules to monitor its own employees’ correspondence or activities, the Customer is the data controller for that monitoring. Compliance with the Board’s Principle Decision No. 2026/2035 dated September 16, 2026 is the Customer’s obligation. In particular, this decision requires that the purpose, scope, and method of monitoring be clearly communicated to employees in advance and that access to content be proportionate.

5.4 Connected services. If the Customer connects a service with its own account, such as an e-document integrator, SMS, WhatsApp, a bank transaction feed, or a Google or Microsoft mailbox, the contract with the provider is the Customer’s. These providers are not Firmanet’s sub-processors; Firmanet transmits data to these services only on the Customer’s instructions. If the provider is abroad, the obligations under KVKK Article 9 rest with the Customer as the party transferring the data.

5.5 Users and permissions. The Customer defines its own users. It grants role and field permissions according to job requirements, deactivates without delay any user who leaves the company, and tells its users to keep their passwords confidential. Users can turn on two-step verification for their own accounts; the Customer ensures that its users, especially administrators, turn it on. In an on-premises deployment, the Customer can make two-step verification mandatory across the installation.

5.6 Data minimization. The Customer enters into IWB only the data necessary for its purpose. It informs its users that they should not provide unnecessary personal data, or documents containing special categories of personal data, to IWB AI or in support requests.

5.7 Retention periods. The Customer determines the retention period of customer data. Periods in IWB that the Customer can change (for example, the file trash period) are the Customer’s instructions. IWB’s own periods are set out in Annex 1. In an on-premises deployment, backing up the server and infrastructure security are the Customer’s responsibility.

6. Confidentiality

6.1 Firmanet keeps customer data confidential and does not disclose it to anyone except in the cases listed in this agreement.

6.2 Firmanet obtains a confidentiality undertaking from its staff who can access customer data. Access rights are limited to what their duties require. Firmanet staff access customer data only from Turkey.

6.3 Firmanet also imposes a contractual confidentiality obligation on its sub-processors.

6.4 The confidentiality obligation has no time limit. It continues after staff leave their positions and after this agreement ends (KVKK Article 12(4)).

7. Security measures

7.1 Firmanet takes the technical and administrative measures in Annex 2 to prevent customer data from being unlawfully processed or accessed and to safeguard the data (KVKK Article 12(1)).

7.2 Firmanet maintains the measures in Annex 2 throughout the term of the agreement. If it changes a measure, it does not lower the level of protection, and it updates Annex 2.

7.3 The Customer takes the measures on its own side: user permissions, and device and password security; in an on-premises deployment, also server, network, and backup security.

7.4 Liability arising from security measures is subject to Article 15.

8. Sub-processors

8.1 The Customer gives Firmanet general authorization to use the sub-processors listed in Annex 3.

8.2 Firmanet enters into a written contract with each sub-processor. Through this contract, it imposes on the sub-processor data protection obligations that are no less protective than those in this agreement. Firmanet is liable to the Customer for a sub-processor’s failure to fulfill its obligations.

8.3 At least 30 days before adding a new sub-processor or changing a sub-processor, Firmanet gives the Customer written notice and updates Annex 3. The notice states the sub-processor’s name, the service it will provide, the data it will process, and its country.

8.4 The Customer may object in writing, on justified grounds, within 30 days of the notice. The parties discuss the objection in good faith to resolve it. If the objection cannot be resolved, the Customer may turn off the relevant feature or, before the change takes effect, terminate the subscription agreement without paying a contractual penalty or any additional fee on this account.

8.5 Services that the Customer connects with its own account (5.4) are not sub-processors.

9. Transfers abroad

9.1 The cloud deployment servers are located with a server hosting provider in Turkey. The provider’s trade name is notified in writing in the subscription agreement.

9.2 Customer data is transferred abroad when the following services are used:

• OpenAI is used for IWB AI; in doing so, the data sent to IWB AI (10.2) is transferred abroad.
• If the Customer has not connected its own mailbox, Resend is used for emails of invoices, quotes, and similar documents sent through IWB; in doing so, the recipient’s name and email address and the content and attachments of the message are transferred abroad.
• Microsoft (corporate email service) is used for support requests sent by email; in doing so, the customer data contained in the correspondence and its attachments is transferred abroad.

Since there is no adequacy decision of the Personal Data Protection Board for the country of transfer (for OpenAI, the United States of America), the transfer is made by signing the standard contract announced by the Board and notifying the Authority (KVKK Article 9(4)(c) and Article 9(5)).

9.3 In these transfers, Firmanet is the data processor. The standard contract is signed without any change to the text announced by the Board, using the text set for transfers from a data processor to a data processor; the Turkish text governs. Firmanet notifies the Authority of the contract within 5 business days after the signatures are completed. It also notifies any change to or termination of the contract by the same procedure, and informs the Customer.

9.4 These transfers are made on the Customer’s instructions. Keeping IWB AI turned on, not connecting its own mailbox, or sending a support request by email is part of this instruction. The Customer undertakes to have a condition for processing under KVKK Article 5 or 6 for these transfers and to state these transfers in its own privacy notice. If the Customer does not want these transfers, it can turn off IWB AI and connect its own mailbox.

9.5 Remote access from abroad also counts as a transfer abroad. For this reason, Firmanet staff access customer data only from Turkey. In an on-premises deployment, remote support access is also made only with the Customer’s permission, by a method the Customer provides, and from Turkey.

9.6 Firmanet does not start any transfer abroad other than those in Annex 3. A new transfer is subject to the notice procedure in 8.3 and to the safeguards in this article.

10. IWB AI

10.1 IWB AI consists of the chat, tender document reading, receipt reading, service suggestion, and natural language filtering features. These features use OpenAI’s artificial intelligence model. A summary of the data flow in IWB AI, written for users, is in the Privacy Policy.

10.2 What is sent. When IWB AI is used, the following are sent to the model:

• the user’s question and the latest messages of the conversation;
• records read with the user’s permissions;
• images uploaded by the user (including photos of receipts);
• in tender document reading, the text of the document to be read; in service suggestions, the text of the service record; in natural language filtering, the expression the user types.

10.3 What is not sent. The following are not sent to the model:

• hidden and masked fields: fields hidden by role and field permissions are removed before sending;
• records the user has no permission for: IWB AI works with the user’s permissions;
• in tender analysis, personal documents such as resumes and diplomas;
• audio: with voice input, the audio does not reach IWB.

10.4 Turning off. IWB AI can be turned off completely per workspace. The AI features in Field Service and Tender Tracking are off by default and do not run unless the Customer turns them on. In an on-premises deployment, IWB AI is off unless the Customer configures it.

10.5 Model training. Data sent to IWB AI is not used to train artificial intelligence models. Firmanet does not use this data for training. The provider does not use it either, under its contract and account settings.

10.6 Retention by the provider. The provider retains the data sent to it only for abuse monitoring and for no more than 30 days.

10.7 Conversation records. IWB AI conversations are stored in the Customer’s workspace. Conversations that a user deletes are permanently deleted within 30 days. When a user is anonymized, that user’s conversations are also deleted. When the workspace is permanently deleted, all conversations are deleted.

10.8 Human approval and transparency. IWB AI’s answers are shown as artificial intelligence output. Every action that changes a record asks for the user’s approval; no record changes without the user’s approval. Actions performed by IWB AI are marked with a “written by the assistant” label.

10.9 Review of output. IWB AI’s answers may be wrong or incomplete and may contain personal data. The Customer does not make decisions with consequences for data subjects (such as hiring, pay, or performance evaluation) based solely on IWB AI output; before making a decision, it has the output reviewed by an authorized person. IWB AI output is customer data and is subject to this agreement.

11. Data subject requests

11.1 The Customer, as data controller, responds to requests relating to customer data. Requests relating to processing for which Firmanet is the data controller (3.3) are made to Firmanet through the channels on the Data subject requests page.

11.2 A request that comes directly to Firmanet and relates to customer data is forwarded to the Customer within 5 business days, and the requester is told that it has been forwarded. Only the request and the requester’s contact details are forwarded to the Customer. Firmanet does not respond to the substance of such a request without the Customer’s instruction.

11.3 The Customer can resolve requests with the following tools in IWB: anonymization of users, natural-person contacts, and contact persons; anonymization of HR personnel data through an HR action when its period expires; export by record and by list; and the sensitive flag for custom fields.

11.4 For a request that the tools cannot handle, Firmanet provides technical support without delay upon the Customer’s written request. This support is provided in time for the Customer to meet the 30-day response period under KVKK Article 13.

12. Data breaches

12.1 Firmanet gives the Customer an initial notification of a data breach affecting customer data without delay and no later than 24 hours from the moment it becomes aware of the breach. Information not known at that time is provided in stages as it becomes known.

12.2 The notification includes:

• the time the breach began and the time it was detected;
• the categories of data affected (with special categories of personal data stated separately) and, if known, the number of persons and records affected;
• the likely consequences of the breach;
• the measures taken and the measures recommended;
• the title and contact details of the Firmanet officer from whom information can be obtained.

12.3 The notification is made by email and by phone to the authorized person whom the Customer specified in the subscription agreement.

12.4 Notification to the Board (no later than 72 hours from becoming aware of the breach) and notification to data subjects are the Customer’s obligations as data controller. Firmanet provides the information and documents needed for these notifications. Unless required by law, it does not notify the Board or data subjects on behalf of the Customer.

12.5 Firmanet records each breach, its effects, and the measures taken in the breach register. It takes the measures needed to eliminate the cause of the breach and notifies the Customer of the outcome in writing.

12.6 If an incident also requires notification under Cybersecurity Law No. 7545, Firmanet makes that notification as a step separate from the notification under the KVKK.

13. Audits

13.1 The Customer may audit Firmanet’s compliance with this agreement or have it audited by an independent auditor who has given a confidentiality undertaking.

13.2 An audit is first carried out through a written questionnaire. Firmanet answers the questionnaire in writing without delay and shares documents that show compliance.

13.3 If the written answers are not sufficient, an on-site audit may be carried out. An on-site audit is carried out no more than once a year, with at least 30 days’ prior written notice, during business hours, and in a manner that does not disrupt Firmanet’s operations. The audit does not give access to other customers’ data or to Firmanet’s trade secrets. A competitor of Firmanet cannot act as auditor.

13.4 After a data breach affecting customer data, or at the request of the Board, the Customer may request an audit without waiting for the frequency and notice period in 13.3.

13.5 Each party bears its own costs of the audit.

13.6 With respect to sub-processors, Firmanet shares with the Customer the information and documents it obtains from the sub-processor.

14. End of the agreement

14.1 When the subscription agreement ends, if the Customer so requests, Firmanet delivers customer data to the Customer in a machine-readable format within 30 days of the request. The Customer makes this request before the workspace is permanently deleted. During the term of the agreement, the Customer can also use the tools for export by record and by list.

14.2 When the agreement ends, the workspace is closed. A closed workspace can be restored within 30 days. When this period expires, the workspace is permanently deleted together with its files.

14.3 If the workspace contains financial documents whose retention period has not expired, the workspace is not deleted automatically. In that case, the parties decide in writing: either the Customer takes delivery of the documents and approves permanent deletion, or the retention period and conditions for the documents are agreed separately.

14.4 Backups are not kept for more than 30 days. Permanently deleted data is removed from backups through the backup cycle within 30 days at the latest.

14.5 Integration passwords and connection keys stored in encrypted form are also deleted together with the workspace.

14.6 Migration exports and support attachments are deleted within the periods in Annex 1, regardless of the end of the agreement.

14.7 When permanent deletion is complete, Firmanet notifies the Customer in writing. The notice states the deleted workspace and the date of deletion.

14.8 Firmanet’s own records that it is legally required to keep (for example, invoices and the subscription agreement) are outside this article. These records are subject to the periods in the Personal Data Retention and Destruction Policy.

15. Liability

15.1 Under KVKK Article 12(2), the Customer and Firmanet are jointly responsible to data subjects and to the Board for taking the security measures.

15.2 In their internal relationship, each party is liable in proportion to its own fault. If one party pays compensation or an administrative fine arising from the other party’s fault, it may claim the amount paid from the other party in that proportion.

15.3 The limit and scope of liability are subject to the subscription agreement. However, liability arising from intent or gross negligence cannot be limited or excluded (Article 115 of the Turkish Code of Obligations No. 6098 (TBK)).

15.4 Liability arising from Firmanet’s processing outside the instructions is subject to 3.5.

16. Term, amendments, and governing law

16.1 This agreement enters into force together with the subscription agreement. It remains in force for as long as Firmanet processes customer data, until the deletion under Article 14 is complete. Article 6 has no time limit.

16.2 The text on the website is for information purposes; the binding text is the version attached to the subscription agreement. A new version is attached to subscription agreements concluded from the date it is published on the website.

16.3 For a subscription agreement in force, an amendment is notified to the Customer in writing at least 30 days in advance. The Customer may object in writing within this period. A Customer that objects may terminate the subscription agreement up to the date on which the amendment is to take effect, without paying a contractual penalty or any additional fee on this account; until the termination takes effect, the previous version applies. For a Customer that does not object, the amendment takes effect on the date stated in the notice. Amendments required by a change in the law or by a Board decision are notified to the Customer and apply from the effective date of the relevant regulation.

16.4 This agreement is governed by Turkish law. In disputes between merchants, the courts and enforcement offices of Konya have jurisdiction. Provisions on mediation as a statutory precondition for filing a lawsuit are reserved.

16.5 Notices between the parties are made in writing and sent to the addresses specified in the subscription agreement. Firmanet’s email address is [email protected]. Between merchants, notices of default, termination, and rescission are given by the means set out in Article 18(3) of the Turkish Commercial Code No. 6102 (TTK).

16.6 The original text of this agreement is in Turkish. Translations into other languages are for information purposes; in case of conflict, the Turkish text prevails.

16.7 The invalidity of one provision does not affect the other provisions.

Annex 1 Processing details

Subject matter, duration, nature, and purpose

Item	Details
Subject matter	In the cloud deployment, hosting and operating IWB; in an on-premises deployment, installation, data migration, customization, and support.
Duration	The subscription term and the deletion periods in Article 14.
Nature	Recording, storage, keeping in backup media, editing, viewing, querying, reporting, transmission on the Customer’s instructions, processing with IWB AI, export, anonymization, and deletion.
Purpose	Providing the IWB service to the Customer in accordance with the subscription agreement.

Data subject groups and data categories

The Customer decides which modules are used and which data is entered. The table below shows, by IWB module, the groups of persons and the categories of data that may be processed.

Module or area	Data subject groups	Data categories
User and permission management	The Customer’s employees and users	Identity, contact, transaction security (roles and permissions, session records, security log)
Contacts, customer relationship management, sales, purchasing, contracts, tenders, foreign trade	Representatives of the Customer’s customers and suppliers, natural-person contacts	Identity, contact, customer transaction (quotes, orders, contracts), finance
Accounting, finance, e-invoicing	Natural-person contacts, customer and supplier representatives, employees	Identity, contact, finance (invoices, payments, bank transactions)
Human resources	The Customer’s employees and job candidates	Identity, contact, personnel, professional experience, finance, special categories of personal data (below)
Field service and help desk	Service customers, the Customer’s technicians and employees	Identity, contact, customer transaction (service records, requests), location (location recorded during service visits)
Laboratory	The Customer’s customers; depending on the Customer’s business, persons whose health data is processed	Identity, contact, customer transaction, health data depending on the Customer’s business
Projects and tasks	The Customer’s employees and users	Identity, work records
Document management, email, SMS, and WhatsApp	Parties to correspondence and messages	Contact, correspondence and message content, content of uploaded documents
Customer portal	Portal users	Identity, contact, transaction records
IWB AI	Users and persons named in conversations	Question and answer texts, uploaded images, data in the records read
Data migration	Persons with records in the Customer’s legacy ERP	All categories in the legacy system
Tasks usage counters	The Customer’s users	Daily total count per workspace

Special categories of personal data and additional measures

In IWB, special categories of personal data may be found in the following places:

• health reports and criminal records in HR personnel documents;
• maternity status and overtime restrictions for health reasons in employee records;
• in the laboratory module, health data depending on the Customer’s business.

The Customer may also enter special categories of personal data into other fields or documents; the legal basis and the adequate measures for this are the Customer’s responsibility (5.2). IWB has the following additional measures:

• document types such as health reports and criminal records are flagged as sensitive;
• reading special categories of personal data is recorded in the security log as a read trail;
• downloads of files containing personal data are recorded in the security log;
• sensitive fields such as the national ID number (TCKN) and IBAN are hidden by default and can be seen only by roles that have been granted permission;
• the Customer can flag custom fields as sensitive;
• hidden and masked fields are not sent to IWB AI.

Retention periods within IWB

Record	Period
Session records	90 days from the end of the session
Unmasked phone numbers and message text in SMS messages	30 days
Outgoing email records	90 days for delivered emails, 365 days for failed ones
Read notifications	365 days
File trash	30 days by default; can be changed by the Customer’s setting
Closed workspace	30-day restore period, then permanent deletion
Financial documents	10 years; if there are financial documents whose retention period has not expired, the workspace is not deleted automatically (14.3)
Tasks usage counters	400 days
IWB AI conversations	A conversation the user deletes, within 30 days; when the user is anonymized; in other cases, until the workspace is permanently deleted
Migration export	90 days after the migration is completed
Support attachments and screenshots	6 months after the request is closed
Backups	30 days
Other records	Until the Customer deletes them or the workspace is permanently deleted

Annex 2 Technical and administrative measures

Technical measures

• Separation of workspaces: Each customer’s data is protected separately in the application and in the database.
• Permissions: Permissions apply at role and field level. Hidden and masked fields are hidden on screen, in exports, in reports, and in data sent to IWB AI.
• Authentication: Passwords are at least 8 characters long and contain uppercase and lowercase letters and digits. After 5 failed attempts, the account is locked for 5 minutes. Two-step verification is available; users can turn it on, and it can be made mandatory across the installation.
• Sessions and cookies: In session records, the last part of the IP address is masked and no browser fingerprint is kept; the records are deleted after 90 days. The application’s cookies are used only for sessions and security and are first-party; no third-party cookies or measurement tools run. Details are in the Cookie Policy.
• Encryption: The application is accessed over an encrypted connection. Integration passwords and connection keys are stored encrypted, and user passwords are stored hashed.
• Security log: Permission changes, access denials, read trails of special categories of personal data, downloads of files containing personal data, and changes made through the admin panel (with a “Panel” entry) are recorded in the Customer’s security log.
• KVKK tools: Users, natural-person contacts, and contact persons can be anonymized. HR personnel data is anonymized through an HR action when its period expires. Custom fields can be flagged as sensitive.
• IWB AI: IWB AI works with the user’s permissions; hidden and masked fields are removed before sending; every action that changes a record asks for the user’s approval; IWB AI can be turned off per workspace (Article 10).
• On-premises deployment: Data is on the Customer’s server; no inbound connection is opened for administration; the license is verified without an internet connection; the update agent is optional.
• Hosting and backups: Cloud deployment servers are located with a hosting provider in Turkey. Backups are not kept for more than 30 days.

Administrative measures

• Staff who can access customer data give a confidentiality undertaking and receive training on personal data protection.
• Access rights to customer data are limited to what staff duties require. A list of staff with access rights is kept and updated when duties change. Access to servers is logged.
• Firmanet staff access customer data only from Turkey.
• A data breach response plan and a breach register are maintained; notifying the Customer within 24 hours is part of this plan.
• A personal data processing inventory is kept, and the Personal Data Retention and Destruction Policy is applied.
• A written contract is concluded with each sub-processor. For transfers abroad, the standard contract has been signed and notified to the Authority.

Actions performed by Firmanet staff through the admin panel

Firmanet staff operate the cloud deployment through the admin panel. Actions such as creating users, lifting account locks, resetting passwords, and anonymization are performed through the panel on behalf of the Customer. These actions are performed at the Customer’s request or to provide the service. Every change made through the admin panel is recorded in the Customer’s security log with a “Panel” entry.

Annex 3 Sub-processors

Sub-processor	Service	Data processed	Country	Transfer basis
Server hosting provider in Turkey (its trade name is notified in writing in the subscription agreement)	Hosting of the cloud deployment servers	All customer data in the workspace	Turkey	Not required (the servers are in Turkey)
OpenAI	Artificial intelligence model for IWB AI	Data sent to IWB AI (10.2)	United States of America	Standard contract (data processor to data processor) and notification to the Authority; KVKK Article 9(4)(c) and Article 9(5)
Resend	Sending document emails if the Customer has not connected its own mailbox	Recipient’s name and email address, message content and attachments	Abroad; the country is stated in the standard contract	Standard contract (data processor to data processor) and notification to the Authority; KVKK Article 9(4)(c) and Article 9(5)
Microsoft	Corporate email service	Customer data contained in support requests sent by email and in their attachments	Abroad; the country is stated in the standard contract	Standard contract (data processor to data processor) and notification to the Authority; KVKK Article 9(4)(c) and Article 9(5)

Account emails such as invitations, password resets, and verification codes are also sent through Resend. For these emails, Firmanet is the data controller (3.3). Support requests received through “Report a bug” in the application are kept in Firmanet’s own support ticket system in Turkey. Annex 3 is updated by the procedure in Article 8.

The version and the date of the last update are shown at the top of the page. When we change the text, we publish the new version at this address; the change applies from the date it is published.