Data processing agreement

• Data controller: the business that opens an account on and uses PergePOS (the "Business").
• Data processor: Ahmet Aksungur (Aksungur Yazılım), which provides the PergePOS service ("PergePOS").

This agreement is an annex to the terms of use; the Business accepts it by opening an account or starting a subscription. On personal data matters, this agreement prevails over the terms of use.

• Subject and purpose: providing the PergePOS service (POS, kitchen screen, QR menu, delivery, payment records, inventory, reporting, reservations, loyalty, kiosk, menu screen and other enabled modules).
• Duration: the term of the service and the period in clause 10 after it ends.
• Data subjects: the Business's staff, guests, loyalty members, customers and supplier contacts.
• Data categories: identity and contact (name, phone, e-mail, address), staff records (role, PIN hash, shift and action records), order, check, payment result and booking records, loyalty activity and consent records, account balances and delivery addresses.
• Special categories: the service isn't designed to process special categories of data. If the Business enters such data in free-text fields (notes, descriptions), the Business is responsible for that processing.

PergePOS processes personal data only on the Business's instructions. Instructions are given through the terms of use, this agreement and the Business's settings in the panel (modules, integrations, retention and messaging settings). If PergePOS considers an instruction unlawful, it informs the Business. Where a transfer is required by law, PergePOS informs the Business in advance unless prohibited.

PergePOS ensures that employees and assistants with access to personal data are bound by confidentiality and limits access to what the task requires. Access to the Business's records for support happens at the Business's request or when needed for the security of the service, and is logged.

PergePOS takes appropriate technical and organisational measures under KVKK Art. 12, including:

• Encrypted connections; passwords and staff PINs stored as irreversible hashes; integration keys stored encrypted.
• Every record scoped to a business and branch; one business cannot access another business's records.
• Role- and permission-based access; an audit log of actions such as voids, refunds, discounts, opening the cash drawer and permission changes.
• Card data never enters PergePOS; card data, PINs and unnecessary personal data are not written to logs or error reports.
• Regular backups and access logs.

The Business is responsible for managing team permissions, device pairings and staff PINs securely on its side.

The Business authorises PergePOS to use these groups of sub-processors to provide the service: hosting, database, file storage and backup; e-mail delivery; mobile notifications (Firebase, Apple); language model providers for AI features (with aggregated data that doesn't identify individuals); live support infrastructure.

PergePOS imposes obligations on sub-processors at the same level as this agreement. Before adding a new sub-processor it notifies the Business reasonably in advance; the Business may object on justified grounds.

Services the Business connects itself (SMS provider, payment institution, e-document integrator, online ordering platform, accounting software) are not PergePOS sub-processors but the Business's own recipients; the Business is the controller for those transfers.

Some sub-processors may have servers abroad. Transfers abroad follow the conditions of KVKK Art. 9: an adequacy decision, appropriate safeguards such as the standard contract published by the Board, or the occasional transfer cases listed in the Law. Where needed, the parties sign the standard contract and notify the Board within the required period.

When PergePOS becomes aware of a data breach affecting the Business's data, it notifies the Business without delay. The notice includes, as far as known, the nature of the breach, the affected data subject groups and records, likely consequences and measures taken or proposed, and is updated to support the notifications the Business makes to the Board and data subjects.

PergePOS helps the Business answer data subject requests: the panel offers tools such as exporting and anonymising a customer record and viewing consent history. Requests sent directly to PergePOS are forwarded to the Business without delay and are not answered without the Business's instruction.

When the subscription ends, the Business's records stay read-only for 90 days so they can be exported. After that period personal data is deleted or anonymised; copies in backups are deleted within the backup cycle. Retention obligations required by tax and commercial law or by a dispute are reserved.

PergePOS provides information demonstrating compliance with this agreement on the Business's reasonable request. On-site audits are announced reasonably in advance, held during business hours and conducted without compromising the confidentiality of other customers' data; costs are borne by the requesting party.

Each party is liable for failing to meet its obligations under this agreement to the extent of its fault; liability limits are as in the terms of use. This agreement is governed by Turkish law; the jurisdiction clause of the terms of use applies to disputes. PergePOS may update this agreement and notifies the Business of material changes before they take effect.