Data Processing Agreement (Data Processor)

This is an English translation. In case of any discrepancy, the Turkish text prevails.

1. Parties and purpose

1.1. This agreement (the "Data Processing Agreement") is an integral annex to the Courino Subscription and Service Agreement (the "Main Agreement") and is entered into between the Company defined in the Main Agreement (data controller) and Albiferro Yazılım ve Sistem Limited Şirketi (Albiferro Software & System Limited Company) (Tax office: Etimesgut, Ankara, Türkiye; Tax No: 0501474977; MERSİS (Central Registry) No: 0050147497700001; Address: Atakent Mah. 1472. Cad. No: 5 D: 3, Elvankent, Etimesgut, Ankara, Türkiye), which provides the Courino service (data processor, "Courino").

1.2. Its purpose is to ensure that personal data entered by the Company into the Courino service is processed in compliance with Turkish Personal Data Protection Law No. 6698 ("KVKK") and secondary legislation, and to set out the Parties' data security obligations, in particular under Article 12 of KVKK.

1.3. Terms not defined here have the meanings given in KVKK and the Main Agreement. In case of conflict between this agreement and the Main Agreement concerning personal data, this agreement prevails.

2. Subject, nature and duration of processing

2.1. Subject: Courino's provision of the courier automation service to the Company (order management, courier assignment, live tracking, proof of delivery, cash desk, courier earnings, invoicing, customer portal, courier app and notifications).

2.2. Duration: for the term of the Main Agreement and until the return and deletion under Article 9 are completed.

2.3. Categories of data subjects: the Company's authorised persons and staff (Users), couriers, customers and customer employees, senders and recipients of shipments, persons receiving deliveries.

2.4. Categories of personal data:

• Identity and contact: name, user name, phone, e-mail, address.
• Shipment and delivery: pickup and delivery addresses, recipient name, name, signature and delivery photos of the person receiving, time data.
• Location: location points sent by the courier app while the courier is on shift.
• Financial: collection, customer account, courier earnings, invoice and online payment records (card numbers are not stored by Courino).
• Transaction security: login records, IP address, device notification token, transaction history.

2.5. The Service is not intended to process special categories of personal data. The Company agrees not to enter special category data (e.g. health data) into the Service and, where unavoidable, to ensure compliance with Article 6 of KVKK.

3. Obligations of the Company (data controller)

3.1. The Company is responsible for the lawful collection of the personal data it enters into the Service, for informing data subjects under Article 10 of KVKK, for obtaining explicit consent where required and, if applicable, for registration with the Data Controllers' Registry (VERBİS).

3.2. The Company gives Courino only lawful instructions. The Company's instructions are deemed given through the configuration of the Service (settings, user permissions, retention periods), the Main Agreement and this agreement.

3.3. The Company is obliged to protect User accounts against unauthorised access, grant permissions only as needed and revoke the access of departing staff.

3.4. The Company responds to data subject requests under Article 11 of KVKK.

4. Obligations of Courino (data processor)

4.1. Courino processes personal data only on the documented instructions of the Company and for the purpose of providing the Service; it does not use it for its own purposes, sell it or disclose it to third parties. Courino informs the Company if it considers an instruction to be unlawful.

4.2. Courino ensures that its employees and contractors with access to data are bound by confidentiality and that access is limited to what their role requires.

4.3. Courino reasonably assists the Company in responding to data subject requests, in data security assessments and in correspondence with the Personal Data Protection Board (the "Board"). Courino forwards data subject requests received directly to the Company without delay.

4.4. If Courino receives a request from a competent authority concerning Company data, it informs the Company unless legally prohibited.

5. Data security (Article 12 of KVKK)

Taking into account the Board's Personal Data Security Guide, Courino applies at least the following technical and organisational measures:

• Company isolation: All companies' data is separated at database level with Row-Level Security; a user of one company cannot access another company's data.
• Encryption: All connections are encrypted with TLS. Passwords are stored irreversibly (hashed). Third-party service credentials are stored encrypted.
• Access control: Role- and permission-based access; two-factor authentication for the platform administration console; key-based administrator access only to servers.
• Logging and monitoring: Critical actions (login, permission changes, settings changes, platform administrator actions) are written to an audit log; errors and anomalies are monitored.
• Network security: Servers are reachable only on required ports and behind a firewall; traffic passes through a network layer with attack protection.
• Backups: Data is backed up regularly; access to backups is restricted.
• Data minimisation: Card details are not stored by Courino; courier location data is deleted automatically after the period set by the Company (default 90 days).
• Updates: Software and infrastructure components are kept up to date with security updates.
• Staff: Staff with access to data are bound by confidentiality and informed about data security.

Courino may update these measures in line with technological developments; updates may not lower the level of security.

6. Sub-processors

6.1. The Company gives general authorisation for Courino to use the following sub-processors to provide the Service:

6.2. Providers whose accounts the Company connects itself (e.g. its own SMS, e-mail, payment or Paraşüt account, Slack, Microsoft Teams) are not Courino's sub-processors; the Company has a direct relationship with those providers and is responsible for the transfer.

6.3. Courino informs the Company by e-mail or panel notice at least 15 (fifteen) days before adding or replacing a sub-processor. The Company may object on reasonable grounds within this period; if the objection cannot be resolved, the Company may terminate the Main Agreement at the end of the paid Period.

6.4. Courino enters into written agreements with sub-processors containing obligations at least as protective as those in this agreement and remains liable to the Company for their performance.

7. Transfers abroad

7.1. Some sub-processors listed in Article 6 are located abroad or process data on servers abroad. These transfers are carried out in compliance with Article 9 of KVKK, primarily by signing the standard contracts published by the Board and notifying the Board within 5 (five) business days.

7.2. The Company authorises the standard contracts required for transfers under Article 9 of KVKK to be concluded on its behalf as well and Courino to represent the Company for this purpose; the Company is responsible for informing data subjects where required.

7.3. If Courino changes the country where the primary database is located, it gives prior notice in accordance with Article 6.3.

8. Personal data breach notification

8.1. Courino notifies the Company of any personal data breach affecting Company data without undue delay and at the latest within 72 (seventy-two) hours of becoming aware of it.

8.2. To the extent known at the time, the notification includes: the nature and time of the breach, categories of data and approximate number of persons affected, likely consequences, measures taken and proposed, and a contact person. The notification is updated as information becomes available.

8.3. Notifying the Board and data subjects of the breach is the Company's obligation as data controller (within 72 hours under Board Decision 2019/10). Courino provides the information and documents needed for those notifications.

8.4. Courino immediately takes the measures necessary to limit the effects of the breach and prevent recurrence.

9. Return and deletion of data on termination

9.1. On termination of the Main Agreement, the Company may request the return of its data in a commonly used format (e.g. CSV/JSON) within 30 days of termination. The Company may also use the Service's export tools.

9.2. Upon the Company's written request for deletion, Courino deletes or anonymises Company data in live systems within 30 days at the latest and in backups at the end of the backup cycle, at the latest within 90 days, and confirms the deletion in writing.

9.3. Data in an account that has become passive under the Main Agreement continues to be retained unless the Company requests deletion. Deletion of trial accounts that became passive without any payment is subject to Article 10.2 of the Main Agreement.

9.4. Courino retains records it is legally obliged to keep (e.g. invoices it has issued and payment records) only for that statutory period and only for that purpose.

10. Audit

10.1. Courino provides information and documents demonstrating compliance with this agreement within a reasonable time upon the Company's written request.

10.2. The Company may carry out an audit at most once a year, with at least 30 (thirty) days' prior notice, itself or through an independent auditor who is not a competitor of Courino and is bound by confidentiality, during business hours and without access to other Courino customers' data. This limitation does not apply in the event of a data breach or a request by the Board.

10.3. The cost of the audit is borne by the Company. If the audit reveals a material non-compliance, Courino remedies it at its own cost.

11. Liability

The Parties' liability under this agreement is subject to the liability provisions of the Main Agreement. Under Article 12(2) of KVKK, the Parties are jointly liable towards data subjects for taking data security measures; internally, each Party is liable in proportion to its fault.

12. Term, amendment and entry into force

12.1. This agreement takes effect together with the Main Agreement and remains in force after termination of the Main Agreement until the actions under Article 9 are completed.

12.2. Amendments are made in accordance with the amendment provisions of the Main Agreement. Mandatory changes resulting from legislation or Board decisions take effect on the required date.

12.3. This agreement is governed by the laws of the Republic of Türkiye; the courts and enforcement offices specified in the Main Agreement have jurisdiction over disputes.

Contact: For personal data requests and breach notifications: destek@courino.com