Data transfer policy

The transfer of personal data is carried out on the basis of the provisions of the Law relating to transfer and the current secondary legislation. Domestic transfers are made where the processing conditions exist and on a purpose-limited basis.

Transfer abroad is carried out directly to countries for which an adequacy decision exists; where none exists, it is carried out on condition that appropriate safeguards prescribed by the legislation, such as a standard contract or binding corporate rules, are provided and, where necessary, notification is made to the Board.

Data may be transferred to the Zoho platforms for customer and candidate relationship management, to the hosting and infrastructure service provider, and, within the scope of intra-group delivery coordination, to the relevant Corpshore entities, in the capacity of data processor or joint data controller and under appropriate safeguards.

Transferred data is limited to the transfer purpose and recipients are obliged to process it in accordance with the data controller's instructions and contractual obligations.

In customer engagements involving data subjects located in the European Union, the transfer is assessed under both the Law and the General Data Protection Regulation. In this case, the transfer mechanisms required by both regimes are applied together and the transfer position is documented before the contract.

When a customer or public engagement requires processing to remain within Türkiye, hosting and processing are configured in accordance with this requirement and the configuration is documented. For customers who request it, all processing may be kept within the country.