Confidentiality Protocol for Personal Data in Commercial Relations

PARTIES:

1- BİS ÇÖZÜM BİLGİSAYAR VE ENTEGRASYON HİZMETLERİ VE TİC. A.Ş.

(hereinafter referred to as “BİS”)

Address: İçerenköy Mah., Üsküdar-İçerenköy Yolu Cad. No:10, Kat:3, VIP Center, Ataşehir, Istanbul

2- ..........................................

(hereinafter referred to as the “Customer”)

Address: ..............................................................

BİS and the Customer are hereinafter referred to together as the “Parties” and individually as a Party.

PROVISIONS:

1. This Confidentiality Protocol for the Processing of Personal Data within the Scope of a Commercial Relationship (“Protocol”) has been concluded in addition to the Distance Sales Agreement (“Agreement”) entered into between BİS and the Customer.

2. Personal data means any data relating to an identified or identifiable natural person. If any personal data is shared between the Parties under the Agreement, each Party accepts, declares and undertakes to take all technical and administrative measures to ensure the data security of the personal data shared with it.

3. Under the Agreement signed between the Parties, both Parties accept, declare and undertake that they will process the personal data they collect themselves, as well as the personal data they obtain from the other Party during performance of the Agreement, in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) and its secondary legislation and the decisions of the Personal Data Protection Authority (“Authority”), and that they will respect the fundamental rights and freedoms of the data subjects and their right to the protection of their personal data.

4. The services and products that are the subject of the Agreement between the Parties require the personal data of the Customer's employees to be recorded in the human resources management system created by BİS. The Customer declares and undertakes that it will be responsible for providing the necessary notices, in accordance with the personal data protection legislation in force (including decisions of the Personal Data Protection Board), to the relevant data subjects regarding the processing, by itself and by BİS, of the Personal Data it transfers to BİS and/or to the information systems BİS has built to provide its services during the processes covered by the Agreement, and for obtaining the necessary permissions and consents from the data subjects in a content and format compliant with that legislation. Otherwise, the Customer shall be responsible for all administrative fines and material and moral damages that arise.

5. BİS may process and store the personal data entered into the system, may share it with its suppliers under a confidentiality undertaking to the extent necessary for the provision of the services, or may share it with third parties after anonymizing it.

6. The Parties, under any circumstances, including their legal obligations, are obliged to inform the other Party immediately if the data the other Party has shared with them is requested by a third party, other than the business partners engaged for the performance of the service, or by the data subject.

7. Each Party is solely responsible for the security of the personal data it collects within its own organization and does not share with the other Party.

8. This Protocol is an integral annex and part of the Agreement; it was concluded together with the signing of the Agreement and has entered into force. The Parties' obligations under this Protocol are not limited in time.

On behalf of BİS; On behalf of the CUSTOMER;

Name-Surname: Name-Surname:

Date: Date:

Stamp-Signature: Stamp-Signature: