Cosyworker Corporate Service Data Processing Agreement

This Data Processing Agreement ("Agreement") governs the rights and obligations of the parties regarding personal data processed within the scope of the corporate service, between the company that uses the Cosyworker corporate service (the "Company") and Cosyworker. The Agreement has been prepared in accordance with the Personal Data Protection Law No. 6698 ("PDPL/KVKK") and the relevant legislation. The Agreement is an annex to and an integral part of the offer, order form, or subscription agreement that establishes the corporate service relationship between the parties (together, the "Service Agreement"). The Company's starting to use or continuing to use the corporate service means that it accepts this Agreement. In the event of a conflict between the Service Agreement and this Agreement on matters relating to the protection of personal data, this Agreement applies.

Cosyworker: The owner and operator of the Cosyworker mobile application and of the Corporate Panel. Its identity and contact details are stated in the Cosyworker Mobile Application Privacy Policy. Company: The legal entity that uses the Cosyworker corporate service and is a party to this Agreement. Application: The Cosyworker mobile application. Corporate Panel: The web interface through which the administrators authorized by the Company manage the corporate service. Employee: An Application user whose Application account is linked to the Company's company account. Administrator: A person to whom the Company has granted access to the Corporate Panel. Corporate Service: All of the corporate features that Cosyworker offers to the Company and to Employees: staff management, employee invitations, events and event analytics, announcements, surveys, coworking budget, emergency notification and safety check, CosyAI and tasks, transportation discounts and venue discounts, webhooks, and sign-in with the corporate directory. The terms personal data, data controller, data processor, and data subject are used with their meanings in the PDPL.

2.1 Cosyworker is the data controller with respect to the account and platform data of Application users. The principles regarding the processing of this data are explained in the Cosyworker Mobile Application Privacy Policy. 2.2 With respect to the Employee data that it accesses or exports through the Corporate Panel or that is forwarded to it by email or webhook, the Company is a separate data controller within the framework of its own activities. The use, retention, and sharing with third parties of this data by the Company are the Company's responsibility. 2.3 Cosyworker processes the data provided by the Company through the Corporate Panel (employee email lists, emergency contacts, administrator accounts, office information) on behalf of the Company, in the capacity of data processor, and carries out the actions initiated on the Company's instruction (sending of invitations, announcements, surveys, and safety checks) on behalf of the Company. Every action that the Company takes in the Corporate Panel is deemed an instruction given to Cosyworker. 2.4 The Employee's Application account belongs to the Employee. If the Employee leaves the Company or the Service Agreement ends, the Employee's account and the data relating to the Employee's individual use of the Application continue to remain with Cosyworker.

The Employee data processed within the scope of the Corporate Service, and what the Company can see of this data in the Corporate Panel, are shown below by feature:

The Company cannot access, through the Corporate Panel, Employees' profile details such as date of birth and gender, CosyAI chats, the last location stored for emergencies, or their individual activities in the Application (venue reviews, favorites, notes, etc.). Employees of the same Company can see one another's name, the initial of their surname, profile photo, and points in the points ranking in the Application.

The Company: a) Informs its Employees, in accordance with Article 10 of the PDPL, about the data it accesses within the scope of the Corporate Service and the purposes for which it uses this data. Cosyworker provides in the Corporate Panel a sample disclosure notice that can be used for this purpose; adapting the text to the Company's own activities and announcing it to Employees are the Company's responsibility. b) Accepts that it has a valid legal ground for processing the Employee data it accesses and that it will use this data solely within the limits of the purpose of the Corporate Service. The Company does not use the Corporate Service for the purpose of monitoring Employees, performance evaluation, or disciplinary proceedings. c) Authorizes as Administrators only those persons who need to access the Corporate Panel by virtue of their duties, ensures the confidentiality of Administrator accounts and passwords, and removes without delay the access of Administrators whose duties have ended. The Company is responsible for all actions taken with Administrator accounts. d) Ensures the security of the files it exports from the Corporate Panel (Excel, ZIP), of the emails sent to it, and of the data forwarded to its own systems via webhook; it does not retain this data for longer than necessary. e) Enters into the Corporate Panel only data belonging to its own employees, its Administrators, and the emergency contacts it designates; it undertakes that it is authorized to transfer this data to Cosyworker. f) Does not write unnecessary personal data or special category personal data in free-text fields such as announcements, survey questions, and safety check notes; it does not request special category personal data from Employees in surveys. g) Removes from the company account, without delay, through the Corporate Panel, Employees whose relationship with the Company has ended. h) Notifies Cosyworker without delay if it suspects a data breach or learns that one of the Administrator accounts has been compromised.

Cosyworker: a) Processes the data it processes on behalf of the Company solely for the purpose of providing the Corporate Service and in line with the Company's instructions; it does not use this data for its own marketing purposes and does not sell it to third parties. b) Limits access to personal data to persons who need access by virtue of their duties and who are under a confidentiality obligation. On the administration screens where the Cosyworker team monitors emergency safety checks, only company names and total counts are shown; on these screens, the Cosyworker team cannot access Employees' survey responses, expense documents, CosyAI chats, or safety check responses. The technical access necessary for operating the system, troubleshooting, and handling support requests is outside the scope of this provision. c) Takes the technical and administrative measures aimed at ensuring the appropriate level of security in accordance with Article 12 of the PDPL (see Article 9). d) Uses its sub-processors in the manner specified in Article 6 and concludes agreements with them that contain data protection obligations equivalent to those in this Agreement. e) Provides reasonable support to the Company in responding to data subject applications and in the Company's fulfillment of its obligations arising from the PDPL (see Articles 10 and 11). f) Informs the Company if it considers that an instruction of the Company is contrary to the legislation.

The Company approves Cosyworker's use of the following service providers for the provision of the Corporate Service. Some of these providers are located abroad; transfers are carried out in accordance with Article 9 of the PDPL.

Cosyworker may change the list of sub-processors. If a new sub-processor is added, the list is updated on this page; the Company may object in writing, on justified grounds, within 30 days of the update. The parties assess the objection in good faith; if no solution can be found, the Company may stop using the relevant feature or resort to the termination provisions in the Service Agreement. Cosyworker is liable to the Company for its sub-processors' compliance with the obligations under this Agreement.

7.1 Account Matching and Staff Management A user who registers for the Application with an address on the Company's email domain is automatically linked to the company account if the Company has available seat quota. The Company undertakes that the domain name it has notified is allocated only to its own employees; the domain names of public email providers are not accepted. Removal of an Employee from the company account is only for persons whose relationship with the Company has ended. The removed Employee's access to the corporate features ends, and their account continues as an individual user. Corporate records from before the removal date (survey responses, expense documents, closed safety check records) continue to be retained as the Company's record. 7.2 Employee Invitations The Company enters or uploads only the work email addresses of its own employees. The invitation email is sent only to addresses on the Company's domain, and the email states that it is sent at the Company's request. The uploaded file is not stored; only the addresses to which an invitation was sent are recorded. An invitation is not sent again to the same address within 24 hours. 7.3 Events and Event Analytics The Company can see, on a per-Employee basis, the events for which Employees have registered in the Application, including public events. The Company uses this information only for the purpose of planning corporate events and employee engagement activities, and explicitly informs its Employees on this matter. 7.4 Surveys Whether a survey is anonymous cannot be changed after it is sent. In anonymous surveys, responses are stored without being associated with the respondent's identity, and the response time is rounded to hourly precision; free-text responses are shown to the Company verbatim. Cosyworker does not apply a minimum number of participants for anonymous surveys. The Company undertakes not to send anonymous surveys to groups so small that responses could be associated with individuals, and not to attempt to associate anonymous responses with individuals. 7.5 Coworking Budget The expense document uploaded by the Employee is read by artificial intelligence; the amount read cannot be changed by the Employee, and whether the expense falls within the scope of the budget is assessed automatically. This assessment may be incorrect; the final assessment rests with the Company. The Company uses expense documents only for budget tracking and accounting purposes. 7.6 CosyAI, Tasks, and Points With respect to CosyAI chats, learned preferences, and mood records, the data controller is Cosyworker; the Company cannot access this data and cannot request Cosyworker to share this data. 7.7 Emergency Notification and Safety Check a) This feature is not an early warning system, does not call emergency services, and does not replace the 112 Emergency Call Center. The delivery of notifications to Employees is not guaranteed. The feature does not eliminate the Company's obligations arising from occupational health and safety legislation. b) A safety check may be started by the Company, automatically by the system for detected earthquakes, or by the Cosyworker team for specific provinces. The Company can turn off automatic and regional alerts for its own company from the Corporate Panel. The Employee's last location, stored with the Employee's explicit consent, is not shown to the Company. c) The Company uses safety check data (response, location, help reason and note) only within the scope of emergency response and occupational health and safety obligations; it does not send notifications in the absence of a real incident or a planned drill. d) The emergency contacts are designated by the Company. Cosyworker does not verify these addresses. The Company informs these persons that emails containing personal data belonging to Employees will be sent to them, keeps the list up to date, and adds only authorized persons. An email that has been sent cannot be recalled by Cosyworker. e) The "Harita uygulamasında aç" ("Open in map app") link in the Corporate Panel transmits the relevant Employee's coordinates to a third-party map site; the use of this link is at the Company's discretion. 7.8 Webhooks If the Company sets up a webhook, information regarding Employees' joining or leaving the company account and their confirmed expenses (name, surname, email address, membership status, amount, business name, note) is forwarded to the address designated by the Company, and the content sent is stored in the delivery record. The Company undertakes that the address it designates belongs to it and is secure, and that it will keep the signing key confidential. 7.9 Sign-in with the Corporate Directory Sign-in with the corporate directory (LDAP) is configured at the Company's request. The Employee's corporate password is transmitted to the Company's directory server solely for verification purposes and is not stored by Cosyworker. The security and availability of the directory server are the Company's responsibility.

8.1 Data within the scope of the Corporate Service is retained for the following periods: • Unconfirmed expense documents are deleted 24 hours after they are uploaded. Confirmed expense documents are retained for the duration of the Service Agreement and until they are deleted in accordance with Article 8.3. • Survey responses, invitation records, webhook delivery records, and Corporate Panel activity logs are retained for the duration of the Service Agreement and until they are deleted in accordance with Article 8.3. • The location shared in emergency safety checks and the help reason and note are deleted 1 year after the safety check is closed; the last location stored for emergencies is deleted after 30 days at the latest if it is not updated; the safety check record itself is retained for the duration of the Service Agreement and until it is deleted in accordance with Article 8.3. 8.2 If the Service Agreement ends, Cosyworker closes the Company's Administrator accounts. The Company is obliged to obtain the data it needs, before the end, using the export tools in the Corporate Panel. 8.3 Within 30 days following the Company's written request and, even in the absence of a request, within 1 year at the latest following the end, Cosyworker deletes or anonymizes the data it processes on behalf of the Company and the corporate records specific to the Company (survey responses, expense documents, safety check records, invitation records, Administrator accounts, emergency contacts). Data that must be retained under the legislation is retained until the end of the relevant periods. 8.4 Employees' Application accounts and the data relating to their individual use of the Application are outside the scope of this Article.

9.1 In order to prevent the unlawful processing of personal data and unlawful access to this data, Cosyworker implements technical and administrative measures, including encryption of data transmission, restriction of access on the basis of authorization, asking for the password again for sensitive actions in the Corporate Panel, serving expense documents from a non-public area and through short-lived links, keeping of activity logs, and regular backups. 9.2 If Cosyworker becomes aware of a data breach affecting personal data belonging to the Company's Employees, it informs the Company without any delay. The notification includes, to the extent known: the nature of the breach, the categories of data and the number of persons affected, the possible consequences, and the measures taken. 9.3 Notifications to be made to the Personal Data Protection Board and to data subjects are, with respect to the data for which each party is the data controller, the responsibility of that party. The parties provide reasonable support to each other in the preparation of these notifications.

Employees may exercise their rights under Article 11 of the PDPL against both parties. An application that reaches one of the parties and relates to data for which the other party is the data controller is forwarded to the other party without delay. Upon the Company's request, Cosyworker provides, to a reasonable extent, the information needed beyond the tools in the Corporate Panel so that applications relating to data for which the Company is the data controller can be answered.

Upon the Company's written request, Cosyworker provides the information reasonably necessary to demonstrate that it complies with its obligations arising from this Agreement. The Company does not make this request more than once a year, except where the legislation or a competent authority requires otherwise. The information provided is confidential and may be used only for the purpose of assessing compliance.

Each party is liable for the damages arising from its breach of its own obligations arising from this Agreement and the PDPL. Claims arising from the Company's use of the data it accesses in a manner contrary to this Agreement or the legislation, from its failure to inform its Employees, or from its entering into the Corporate Panel data that it is not authorized to transfer to Cosyworker are the Company's responsibility. The limitations of liability in the Service Agreement also apply with respect to this Agreement, to the extent permitted by the legislation.

This Agreement remains in force for as long as the Service Agreement is in force and for as long as Cosyworker continues to process personal data on behalf of the Company. Cosyworker may update this Agreement due to changes in the legislation or in the Corporate Service. The current text is published on this page; substantial changes are notified to the Company in advance through the Corporate Panel or by email. This Agreement is subject to Turkish law. In disputes arising from the Agreement, Istanbul (Anatolian) Courts and Execution Offices are authorized, unless otherwise agreed in the Service Agreement.

For questions, notifications, and requests regarding this Agreement: Email: [email protected] The Company's notifications are deemed valid when sent from the Administrator email addresses registered in the Corporate Panel.