1. Parties and roles
1.1. This Data Processing Agreement (the "DPA") is an annex to, and an integral part of, the Sales and Subscription Agreement (the "Sales Agreement") concluded between Sora Yazılım Teknolojileri ((to be confirmed); Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul C1 Blok No: 2B İç Kapı No: 376, Ataşehir/İstanbul) ("Sora Yazılım") and the business that registers a company with Sora İK (the "Customer").
1.2. Under the Kişisel Verilerin Korunması Kanunu No. 6698 (Türkiye's Personal Data Protection Law; the "Law"), for the personal data that the Customer uploads to or creates in Sora İK ("Customer Personal Data"):
- The Customer is the data controller: under subparagraph (ı) of the first paragraph of Article 3 of the Law, the party that determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.
- Sora Yazılım is the data processor: under subparagraph (ğ) of the first paragraph of Article 3 of the Law, the party that processes personal data on behalf of the data controller on the basis of the authority granted by it.
1.3. Data relating to Sora Yazılım's own customer relationship (such as the account, contact and billing information of the Customer's authorized persons) is not within the scope of this DPA; Sora Yazılım is the data controller for such data, and the KVKK Privacy Notice applies.
1.4. Terms not defined in this DPA have the meanings given to them in the Sales Agreement and the Law.
2. Subject matter, nature, purpose and duration of processing
| Element | Description |
|---|---|
| Subject matter | Provision of the Sora İK human resources management software to the Customer under the Sales Agreement |
| Nature | Recording, storing, viewing and organizing Customer Personal Data, using it in calculations and reports, transmitting or exporting it at the Customer's request, backing it up and deleting it |
| Purpose | Solely the Customer's use of the Service, the technical operation of the Service, ensuring its security and providing support to the Customer |
| Duration | The term of the Sales Agreement plus the deletion period in Article 11 |
3. Categories of personal data and data subjects
The data processed varies depending on the modules the Customer uses and the information it enters into the Service. Depending on the Customer's use, the following data may be processed:
| Data subject group | Personal data categories |
|---|---|
| The Customer's employees and former employees (including interns) | Identity, contact, personnel records (position, unit, hire and termination dates, contracts and documents), finance (wage, payroll, bank account information), leave and attendance (attendance ledger, clock-in and clock-out records), performance and training, professional experience, visual records (photograph), transaction security (session and transaction records) |
| The Customer's job candidates | Identity, contact, résumé and professional experience, application and interview evaluations |
| The Customer's Service users (managers, HR staff) | Identity, contact, user role and permissions, transaction security (session and audit records) |
| Relatives of employees (if reported by the Customer) | Identity and contact (for example, an emergency contact person) |
Special categories of personal data: Depending on the Customer's use, health information (for example, leave based on medical reports, disability status), membership of an association, foundation or trade union (for example, payroll deductions) and data relating to criminal convictions and security measures (for example, criminal records) may be processed. It is the Customer's responsibility that such data relies on a processing condition in accordance with Article 6 of the Law. Before uploading special categories of personal data not listed in this table to the Service, the Customer informs Sora Yazılım in writing.
4. Processing on instructions and the Customer's obligations
4.1. Sora Yazılım processes Customer Personal Data only on the Customer's documented instructions. The Sales Agreement, this DPA, the settings the Customer makes in the Service, the actions of Users in the Service and the Customer's written instructions fall within this scope.
4.2. Sora Yazılım does not use Customer Personal Data for its own purposes, does not sell it, does not process it for advertising or profiling and does not transfer it to third parties other than on the Customer's instructions. If a transfer to competent authorities becomes mandatory by law, it informs the Customer in advance to the extent permitted by legislation.
4.3. If Sora Yazılım concludes that an instruction is contrary to the Law or other legislation, it informs the Customer without delay and may suspend the relevant processing until the instruction is clarified.
4.4. The Customer is responsible for uploading Customer Personal Data to the Service lawfully, informing data subjects, obtaining explicit consent where required, the accuracy of the data and determining User permissions.
5. Confidentiality obligation
5.1. Under the fourth paragraph of Article 12 of the Law, Sora Yazılım does not disclose the Customer Personal Data it learns to others in breach of the Law and does not use it for purposes other than processing. This obligation continues after the agreement ends.
5.2. Sora Yazılım ensures that only those of its employees who need access for their duties can access Customer Personal Data and that these employees are under written confidentiality obligations. Access to the Customer's account for support purposes takes place at the Customer's request or to the extent necessary to ensure the security of the Service.
6. Sub-processors
6.1. The Customer gives Sora Yazılım general authorization to use the following sub-processors. The same list is also published on the Security and data protection page.
| Sub-processor | Service | Location |
|---|---|---|
| (to be confirmed) | Hosting servers, databases and backups | (to be confirmed) |
| (to be confirmed) | Sending notification emails | (to be confirmed) |
| Cloudflare, Inc. | Domain name management (DNS) and delivery of media files (media.sora-ik.com) | Abroad (Cloudflare's global network) |
| Cloudflare R2 (Cloudflare, Inc.) | Storage of employee document files and database backups | Europe (Eastern Europe, EEUR location hint; the EU jurisdiction option is not used) |
| Cloudflare Turnstile (Cloudflare, Inc.) | Bot verification on forms | Abroad |
6.2. Sora Yazılım enters into agreements with sub-processors containing data protection obligations no less protective than the obligations in this DPA and is liable to the Customer for the sub-processors' fulfilment of these obligations.
6.3. Sora Yazılım notifies the Customer by email at least 30 days before adding a new sub-processor or replacing a sub-processor and updates the list. The Customer may object with reasons within 30 days of the notice. If the Parties cannot agree on a reasonable solution, the Customer may terminate the Sales Agreement before the change takes effect; in this case, the fee corresponding to the remaining part of the Subscription Term is refunded.
7. Technical and administrative measures
7.1. Within the framework of the first paragraph of Article 12 of the Law, Sora Yazılım applies at least the following measures within the Service in order to prevent the unlawful processing of personal data and unlawful access to it, and to ensure that the data is safeguarded:
| Measure | Implementation |
|---|---|
| Encryption in transit | Service traffic is encrypted with TLS; connections are established over HTTPS |
| Password security | Passwords are stored irreversibly using the argon2id algorithm |
| Access authorization | Access to the Service is restricted on the basis of roles and permissions; the Customer determines User roles itself |
| Audit log | Administrative operations are written to the audit log |
| Prevention of misuse | Rate limiting is applied to login and account operations; bot verification is used on forms |
| Data minimization in logs | Email addresses are masked in logs, and query strings are not recorded |
| Backup | Backups are taken (to be confirmed) |
| Personnel | Access is limited to what duties require; employees with access are under confidentiality obligations |
7.2. Under the second paragraph of Article 12 of the Law, where personal data is processed by another person on the data controller's behalf, the data controller is jointly responsible with that person for taking these measures. The Customer is also obliged, within its own organization, to ensure the security of User accounts, to grant permissions according to the principle of necessity and to remove the access of departing employees.
7.3. With respect to special categories of personal data, the Parties cooperate to take the adequate measures determined by the Personal Data Protection Board (KVK Kurulu) under the fourth paragraph of Article 6 of the Law.
8. Personal data breach notification
8.1. When Sora Yazılım detects that Customer Personal Data has been obtained by others through unlawful means, it notifies the Customer without delay. This obligation is in line with the principle, set out for data processors in the Personal Data Protection Board's Decision dated 24.01.2019 and numbered 2019/10, of notifying the data controller of a breach without any delay.
8.2. To the extent known at the time, the notification includes the nature of the breach, the affected data categories and the approximate number of data subjects and records, its possible consequences, the measures taken and proposed, and the contact person at Sora Yazılım. If all the information cannot be provided at the same time, it is provided in stages without causing delay.
8.3. Under the fifth paragraph of Article 12 of the Law, the obligation to notify the breach to the data subjects and to the Personal Data Protection Board lies with the Customer as data controller. Sora Yazılım provides the information necessary for the Customer to make these notifications and cooperates with the Customer to mitigate the effects of the breach. Unless required by law, Sora Yazılım does not, on its own initiative, make notifications to data subjects or the Board on the Customer's behalf.
9. Assistance with data subject requests
9.1. Requests by data subjects concerning their rights under Article 11 of the Law are concluded by the Customer, as data controller, in accordance with Article 13 of the Law.
9.2. Sora Yazılım forwards requests concerning Customer Personal Data that reach it directly to the Customer without delay and does not itself respond to the request without the Customer's instructions.
9.3. The Service enables data to be viewed, corrected, exported and deleted so that the Customer can respond to requests. Where the tools offered by the Service are not sufficient, Sora Yazılım provides technical support to a reasonable extent.
10. Audit
10.1. Under the third paragraph of Article 12 of the Law, to enable the data controller to fulfil its obligation to carry out or have carried out audits, Sora Yazılım provides, upon the Customer's written request and within a reasonable time, information and documents showing its adherence to this DPA.
10.2. If the information and documents are insufficient, the Customer may carry out an audit itself or through an independent auditor bound by confidentiality obligations. The audit is notified in writing at least 30 days in advance, is carried out during working hours and in a way that does not disrupt the operation of the Service, is limited to once a year unless there is a breach or a request from a competent authority, and its cost is borne by the Customer. The audit does not give access to other customers' data or to Sora Yazılım's trade secrets.
11. Deletion and return at the end of the agreement
11.1. The Customer may export Customer Personal Data in CSV format, or request an export, within 30 days of the end of the Sales Agreement.
11.2. At the end of this period, Customer Personal Data is deleted from live systems. Copies in backups are deleted through the backup cycle at the end of (to be confirmed); during this period, backups are kept solely for disaster recovery and are not processed for any other purpose.
11.3. If the Customer requests, the deletion is confirmed in writing. Data that must be retained by law is kept only for the period and purpose required by that obligation.
11.4. It is the Customer's responsibility to export, in time, data subject to its own statutory retention obligations, such as employee personnel files.
12. Transfer abroad
12.1. Customer Personal Data is stored on servers located in (to be confirmed).
12.2. Because employee document files and database backups are stored in Cloudflare R2 on servers outside Türkiye (in Europe), Customer Personal Data is processed abroad. This transfer, and transfers to the other sub-processors abroad listed in Article 6, qualify as transfers abroad within the scope of Article 9 of the Law.
12.3. Transfers abroad are made in accordance with the conditions set out in Article 9 of the Law. Where a standard contract is used as an appropriate safeguard, the contract is notified to the Personal Data Protection Authority (KVK Kurumu) within five business days of its signature, under the fifth paragraph of Article 9 of the Law. Basis per sub-processor:.
12.4. By approving this DPA, the Customer instructs Sora Yazılım to make the transfers to the sub-processors in Article 6. It is the Customer's responsibility to ensure that the processing condition on which the transfer is based exists and to inform data subjects about it.
13. Liability and precedence
13.1. The Parties' liability arising from this DPA is subject to the liability provisions of the Sales Agreement; mandatory liabilities arising from the Law are reserved.
13.2. In matters relating to the protection of personal data, this DPA prevails over the Sales Agreement.
14. Entry into force and amendments
14.1. This DPA is approved electronically in the registration form together with the Sales Agreement and enters into force on the date on which the Sales Agreement enters into force. The DPA remains in force until the deletion operations in Article 11 are completed.
14.2. Amendments to the DPA are subject to Article 16 of the Sales Agreement on amendments. Mandatory changes resulting from changes in legislation are reserved.
14.3. DPA version: 1.2.
This text is a translation of the Turkish original; in case of any discrepancy, the Turkish version prevails.