Data Processing Agreement (DPA)

1. Parties

This Data Processing Agreement (“DPA”) forms part of the agreement between the data controller (“Customer”) and Monovi Bilgi Teknolojileri Yayıncılık San. Tic. A.Ş. (“Monovi”, “Processor”). It applies where Customer uses Projectman to process personal data and Monovi processes such data on Customer’s documented instructions.

2. Subject matter and duration

This DPA covers the processing of personal data performed by Monovi as Processor in connection with Projectman. It remains in effect for the duration of the underlying service agreement and any additional retention periods required by law.

3. Processor obligations

1. Process personal data only on documented instructions from Customer, including with regard to transfers.
2. Ensure that persons authorized to process personal data are subject to confidentiality obligations.
3. Implement appropriate technical and organizational security measures.
4. Do not engage sub-processors without Customer's prior general or specific written authorization, and flow down equivalent obligations.
5. Assist Customer, at Customer's cost, with security assessments, audits, and regulatory requests where required by the agreement.
6. Delete or return personal data after termination, unless law requires longer retention.

4. Security measures

Monovi implements measures including: encryption in transit (TLS); organization-scoped data isolation; role-based access controls; audit logging; secure development and vulnerability management; and staff confidentiality obligations. No transmission or storage method is 100% secure; we continuously improve controls.

5. Sub-processors

Monovi may use sub-processors to provide Projectman. Current categories include cloud hosting/database (including Supabase infrastructure), email delivery, and optional security services (reCAPTCHA). We will inform Customer of any intended changes and provide an opportunity to object where required by the agreement.

6. International transfers

Personal data may be processed in jurisdictions outside Turkey or the European Economic Area. Where required, Monovi relies on appropriate safeguards such as standard contractual clauses or other mechanisms recognized under applicable law.

7. Customer rights and audit

1. Customer may request information about processing activities, categories, and recipients.
2. Customer may request deletion or return of personal data after termination, subject to legal retention.
3. Upon reasonable notice, Monovi will provide evidence of compliance and allow audits limited to Projectman-related systems.

8. Contact

Data protection and DPA requests: [email protected] · +90 232 502 5645. Monovi Bilgi Teknolojileri Yayıncılık San. Tic. A.Ş., Gulbahce Mahallesi Teknopark Izmir Building A10 No:1/40 Office: 19, Urla 35430, İzmir, Turkey.