Data Processing Agreement

1 Parties and Roles

2 Data Processing within SaaS Scope

Maliyo performs the following activities through the SaaS infrastructure:

3 Maliyo's Obligations

As a Data Processor, Maliyo commits to the following:

• Process personal data only within the scope of the contract and Customer instructions
• Not use data for its own purposes or any purposes outside the agreed scope
• Implement technical and administrative measures to prevent unauthorized access
• Ensure confidentiality obligations are binding on all personnel with access to data
• Assist the Customer in responding to data subject requests
• Make available all information necessary to demonstrate compliance

4 Sub-Processors

Within the scope of SaaS infrastructure, Maliyo may use the following sub-processors:

• Cloud service providers (hosting and infrastructure)
• Server and data center services
• Backup and disaster recovery services

5 Data Security

Maliyo implements comprehensive security measures to protect personal data:

6 Data Breach Notification

In the event of any personal data breach, Maliyo will:

• Notify the Customer without undue delay and, where feasible, within 24 hours of becoming aware of the breach
• Provide detailed information about the nature of the breach, affected data categories, and approximate number of records
• Take immediate measures to mitigate the effects of the breach and prevent further incidents
• Cooperate with the Customer in investigating and resolving the breach
• Document all data breaches and remedial actions taken

7 Data Retention and Deletion

Upon termination of the SaaS subscription:

• Customer data will be returned in a commonly used, machine-readable format upon request
• All personal data will be securely deleted within 30 days of termination, unless otherwise agreed
• No data will be retained except as required by legal obligations or regulatory requirements
• Maliyo will provide written confirmation of data deletion upon request

8 Right to Audit

The Customer has the right to audit Maliyo's compliance with data protection obligations under the following terms:

• Reasonable advance notice (minimum 30 days) must be provided
• Audits may be conducted directly or through an independent third-party auditor
• Audits will be conducted during normal business hours
• Frequency limited to once per year unless required by regulatory authority or following a data breach
• Confidentiality obligations apply to all audit findings

9 Governing Law

This Data Processing Agreement is subject to the laws of the Republic of Türkiye.