Draft only — unsigned and not automatically accepted during registration.
This proposed addendum is for review between ASİSTONE YAZILIM VE TEKNOLOJİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ (MERSİS 0086175105600001, Pamukkale Vergi Dairesi tax ID 0861751056; address: Kınıklı Mah. Hüseyin Yılmaz Cad. Pamukkale Üniversitesi No:67/2, 20160 Pamukkale/Denizli, Türkiye; the “Processor”) and the organization using an Asistone SaaS account (the “Controller”). It creates no contract unless signed and accepted by both parties.
1. Subject matter and instructions
During the service term, Processor processes personal data on Controller's documented instructions to provide the ERP and CRM services in the package Controller selects. The purposes are to provide ERP modules such as orders, products and stock, current accounts, cash and bank, expenses, and reporting; integration with the marketplaces and e-commerce platforms Controller connects; issuing e-Fatura and e-Arşiv invoices; cargo integration; a WhatsApp Business (including WhatsApp Business App Coexistence), Instagram DM, Facebook Pages, and Messenger inbox, leads, and support tickets; optional AI drafts/automatic replies and a knowledge base; and the Shopify card/cash-on-delivery order flow that Controller separately enables and the end customer confirms. Data subjects are Controller's staff and users, its buyers and customers, its suppliers, and end users on its connected channels. Data types include identity and contact details, addresses, tax identification or Turkish national identity numbers, order, invoice, e-document, cargo tracking, and payment details, current-account and bank account details, employee details in cash and expense records (such as name, contact details, and salary amount), uploaded documents, messages, attachments, and voice messages, channel metadata, knowledge-base content, and AI reply context. AI and automatic sending are subject to customer configuration.
2. Party responsibilities
Controller is responsible for purposes and legal grounds, notices, data-subject request handling, lawful instructions, channel permissions, and the content of e-documents and the retention duties arising from tax law. Processor follows only documented instructions and informs Controller if it believes an instruction is unlawful. Processor takes reasonable steps to restrict unauthorized staff access, impose confidentiality obligations, store integration credentials encrypted, and apply appropriate technical and organizational safeguards.
3. Subprocessors, incidents, and requests
Processor may use subprocessors necessary to provide the service and will provide the current provider list on request. The subprocessor groups are: hosting (servers rented in data centers in Europe, currently Germany and Finland), network security, content delivery, and file storage, the e-document provider (a private integrator authorized by the Turkish Revenue Administration), the AI provider (OpenAI), the email delivery service (Resend), and the identity provider (Auth0/Okta). AI providers may process only the data needed to provide the relevant feature on customer instructions. The marketplaces and e-commerce platforms, cargo account, and Meta messaging channels that Controller connects are parties with which data is exchanged on Controller's instructions; Controller's own contracts and rules with those parties apply. International transfers take place only subject to an applicable condition and safeguards under Article 9 of KVKK; this addendum alone does not establish a transfer mechanism.
Processor will notify Controller within a reasonable time after becoming aware of a suspected personal-data breach and provide available relevant information. Processor assists with data-subject requests as applicable and does not answer on Controller's behalf without instruction, without affecting rights relating to processing for which Processor is itself controller.
4. Retention and termination
Service data is held within the organization/subscription account; removing an individual user account does not delete shared conversations or ERP records. E-Fatura and e-Arşiv documents are kept for 10 years under tax law by the e-document provider; Processor does not assume a separate legal retention duty for them and keeps the document records the service needs for as long as the other service data. On termination, Controller may instruct Processor to delete or return data, subject to legally required retention, with copies under legal retention duties kept to a limited extent. The timing and scope of deletion are subject to Controller instructions and applicable legal requirements.
5. Final terms
This addendum takes effect only when the parties sign an agreed final version. Controller and Processor separately determine applicable international-transfer requirements and any required contractual safeguards.