Legal

Data Processing Agreement

Last updated: 1 September 2026

Nature of this agreement

Data processor:
Notussoft Bilgi Teknolojileri Limited Şirketi (Bursa / Türkiye)
Data controller: the Customer using the hosted edition of NotusShip
Basis: Article 12 of Turkish Law No. 6698 (KVKK) and Article 28 GDPR

This Data Processing Agreement (“DPA”) is an integral annex to the NotusShip Terms of Service. It applies only to installations hosted on Notussoft’s servers (cloud / SaaS).

It does not apply to installations the Customer hosts on its own server (self-hosted), because Notussoft has no access to the customer database there.

Purpose and the parties’ roles

The purpose of this DPA is to set out how personal data belonging to the Customer is processed while the hosted NotusShip service is provided, under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and, to the extent applicable, the European General Data Protection Regulation (“GDPR”).

The parties acknowledge that the Customer is the data controller and that Notussoft is the data processor, processing data on the Customer’s behalf and on its instructions.

Scope of processing, data categories and data subjects

• Subject and purpose of processing: hosting the NotusShip platform, project / issue tracking, team management, recording working time and performing the licence.
• Categories of data subject: the Customer’s employees, contractors and administrators, and third parties invited to the platform as users by the Customer.

Categories of personal data.

• Identity and contact: first name, surname, corporate email address, profile image / avatar.
• Activity and task data: issues raised, comments made, tasks assigned, wiki documents, working time entries.
• System and transaction security: IP address, sign-in attempts, user activity logs and account status.

Special categories of data. NotusShip is not intended for processing special categories of personal data; the Customer undertakes not to enter such data into free-text fields.

Notussoft’s obligations as data processor

• Acting on instructions: processes personal data only on the Customer’s documented instructions, under the Terms of Service and for the performance of the service.
• Confidentiality: places a confidentiality obligation on personnel with access to personal data, and ensures that obligation continues after they leave.
• Security measures (KVKK Art. 12 / GDPR Art. 32): takes appropriate technical and organisational measures — encryption in transit and at rest, access logging, a password security policy, brute-force protection and system isolation — to prevent unlawful processing of and access to the data.
• Breach notification: where a data security breach affecting Customer data in the hosted system is detected, notifies the Customer without undue delay and as soon as reasonably possible (within 48 hours at the latest).
• Sub-processors: may work with trusted infrastructure and data centre providers required to perform the service (server hosting, email delivery infrastructure), and ensures those providers meet comparable confidentiality and security standards.

Data subject rights and the anonymisation process

Supporting the controller. Notussoft enables the Customer, within its technical infrastructure, to respond to data subject requests (access, rectification, erasure, portability) under KVKK Article 11 and the GDPR.

Anonymisation and preservation of the audit trail. Where an employee leaves the Customer organisation and erasure / anonymisation is requested:

1. An organisation administrator (Owner / Admin) removes the user from the organisation.
2. The user’s name, email address and personal identifiers are anonymised in the system.
3. To preserve the project’s technical integrity and historical audit trails, the issues, comments and time entries the user created in the past continue to be stored under the label “Deleted user”.

Return, export and deletion of data

Export during the agreement. During the term, on a request from the Customer’s administrator to destek@notussoft.com, a PostgreSQL dump of the database is delivered free of charge within 5 business days.

End of the agreement and destruction. Data is kept in the system for one (1) year after the service relationship ends. The Customer may request an export during that period. At the end of the year, the Customer’s database records are deleted permanently and irrecoverably.

Entry into force

This DPA takes effect together with the NotusShip Terms of Service on 1 September 2026 and remains in force for as long as the Customer’s hosted NotusShip account is active.