Data processing agreement

01Roles

• Controller: the business that enters personal data in Coudy, that is, you.
• Processor: Codian Limited (England and Wales, company number 16333262; registered office: Suite 8791, 5 Brayford Square, London E1 0SG, United Kingdom).
• This agreement always applies to the server in the package and to server care; on your own server it applies only while we access it for support with your permission.

02Subject matter and duration

• Subject matter: installing, running, updating, backing up and monitoring Coudy, and the support you ask for.
• Duration: for as long as the Service Agreement runs, and afterwards until the data is handed over and deleted.
• Nature: storage, backup, restore, technical maintenance, and viewing only as far as a support request needs.

03Data subjects and types of data

• Data subjects: your customers and suppliers (parties), your staff and your Coudy users.
• Identity and contact: name, title, Turkish ID or tax number, phone, e-mail, address.
• Vehicle and service: plate, chassis number, mileage, check-in and work order records, damage photos, customer signature.
• Finance: invoices, receipts, payments, cheques, cash and bank movements, IBAN.
• Staff: role, branch, salary and advance records.
• Users: user name, role, session and activity records.
• Coudy is not designed for special categories of personal data (such as health or biometrics); we ask you not to enter them.

04Your instructions

• We process personal data only on your documented instructions. The Service Agreement, the quote and what you do in Coudy are those instructions.
• If we believe an instruction breaks KVKK or the GDPR, we tell you straight away.
• If the law requires us to process data otherwise, we tell you beforehand unless the law forbids it.
• We do not use the data for our own purposes, for advertising or for training AI models.

05Confidentiality

Our staff and contractors who access your data are bound by written confidentiality duties. Access is given only to the people who need it for the task, and only for as long as the task needs.

06Security measures

• Every connection is encrypted with HTTPS; the server accepts only secure connections, enforced with HSTS.
• Session and encryption keys are made afresh at each installation and never leave it.
• Each user sees only the screens their role allows; you can restrict Coudy to your own networks.
• Each customer has its own database, shared with no other customer.
• Backups of the server in the package are encrypted and kept at a separate location in Turkey.
• Sign-ins by Codian's system administrator are logged and visible to you.
• With the server in the package and with server care, server security updates, monitoring and alerts are Codian's.

07Sub-processors

• We rent the server in the package from a Tier III data centre in Turkey; that data centre is our sub-processor. We give you the current list of sub-processors on written request.
• We bind our sub-processors with written contracts as protective as this agreement, and remain responsible to you for their work.
• We tell you at least 30 days before adding or replacing a sub-processor; if you object on reasonable grounds we look for a solution together, and if none is found you may terminate the agreement.
• Coudy's telemetry contains no personal data, so the telemetry servers are not sub-processors.
• The GİB-approved private integrator you choose for e-Invoice and e-Archive is your own contracting party, not our sub-processor.

08Data subject requests

When a data subject contacts you about their data (access, correction, deletion, objection and so on), you can answer with Coudy's screens and exports. Where that is not enough, we give reasonable help. If a request reaches us directly, we pass it to you without answering it.

09Personal data breaches

• When we become aware of a breach affecting your data, we tell you within 48 hours at the latest.
• The notice states, as far as we know, the nature of the breach, the kinds of people and records affected, its likely consequences, and the measures taken or proposed; we add to it as more becomes known.
• If you need to notify the Turkish Personal Data Protection Board, the ICO or another authority, or the people affected, we help you do so.

10Helping you

We give reasonable help with data protection impact assessments, consultations with authorities and security questionnaires, limited to the nature of the processing and the information we hold.

11Return and deletion at the end

• When the service ends we hand your data over within 30 days: a full database backup, readable exports of the lists, and the PDF and UBL files of your invoices.
• Within 30 days of the handover we permanently delete the data from the server and the backups and confirm it to you in writing.
• If the law requires us to keep any data, we keep only that data, only for that period, and do not process it.

12Audits

• We give you the information needed to show that we keep to this agreement.
• Once a year you may send written questions; we answer within 30 days with supporting documents.
• An on-site audit takes place only after a personal data breach or when a data protection authority requires it; it is announced at least 30 days ahead, held within working hours without access to other customers' data, and paid for by you.

13Where the data is and transfers

• The personal data in Coudy stays in Turkey, on your own server or on the server rented from the Tier III data centre in Turkey, and its backups are kept in Turkey too.
• Only telemetry, which contains no personal data, goes abroad; the Data Policy has the details.
• If you are established in the United Kingdom or the EU and a transfer to Turkey arises under the GDPR, the European Commission's standard contractual clauses (controller to processor) and the UK International Data Transfer Addendum form part of this agreement; we give you a signed copy on request.

14Liability and precedence

• Liability under this agreement is subject to the liability terms of the Service Agreement, except where liability cannot be limited by law.
• Where this agreement and the Service Agreement differ on the protection of personal data, this agreement prevails.

15Governing law and contact

This agreement is governed by Turkish law, and the courts and enforcement offices of Istanbul (Çağlayan) have jurisdiction over disputes. Where the standard contractual clauses are added, they follow their own governing law and jurisdiction clauses.

For anything about personal data, write to [email protected].