Data processing agreement
How we process data that customers enter into the service as a data processor: security, sub-processors, deletion.
This text was translated from the Turkish original using artificial intelligence; the Turkish text is binding.
This Data Processing Agreement ("Agreement") is made between the customer using norvo IT ("Data Controller") and N2mobil Takip Sistemleri A.Ş. ("Data Processor"), as an annex and integral part of the Service Agreement, pursuant to Article 12(2) of the Turkish Personal Data Protection Law No. 6698 ("KVKK"). By accepting the Service Agreement, this Agreement is also accepted. Corporate customers may request a signed copy at bilgi@n2mobil.com.tr.
1. Subject matter and roles
1.1. The Data Controller operates, through the service, the work data collected by the agent installed on its staff's work computers. For this data, the customer is the data controller and N2mobil Takip Sistemleri A.Ş. is the data processor.
1.2. The Data Processor processes personal data only on behalf of the Data Controller, in accordance with its documented instructions and only to provide the service. Settings made in the service panel (working hours, window title retention, retention period, rules) are considered instructions from the Data Controller.
1.3. The Data Processor does not use these data for its own purposes, does not sell them, does not use them for marketing, and does not combine them with another customer's data. For service improvement purposes, only non-personal aggregated figures (for example, the total number of active devices) may be used.
2. Processed data
| Category | Content |
|---|---|
| Data subjects | Employees of the Data Controller who use computers with the agent installed |
| Identity | Full name (entered in the panel or taken from the directory), operating system username, department; if the Data Controller has connected a staff directory (Microsoft Entra ID, Google Workspace, LDAP / Active Directory), the identifier, username, full name, department and account enabled/disabled status from the directory (email and other directory information are not stored; directory connection details are stored encrypted and are read-only) |
| Device | Computer name, operating system, agent version, last connection time; if enabled by the company, hardware inventory (model, serial number, processor, memory, disks, battery, security status, last update), usage measurements (processor/memory/disk utilisation, network and disk I/O speed, names of the five programs using the most resources; at 1–10 minute intervals selected by the company, during working hours or, if the company enabled it, outside working hours too; 30 days) and, if enabled, network information (IP, MAC) |
| Installed software | If enabled by the company (IT Asset Management): names, versions, publishers and installation dates of programs installed on the computer; first seen and removal times (removed items are deleted at the end of the retention period) |
| Assets and assignments | Fixed asset records entered by the Data Controller in the IT Asset Management module, and assignment and return records for employees (full name, dates, delivery/return status notes); licence records (licence keys are stored encrypted) |
| Work activity data | Name of the foreground application, start/end time, active/idle status; window title if the setting is enabled. In the IT Asset Management module, this data is also used to determine whether a licensed program was opened in the last 90 days (detection of unused licences) |
| Not collected | Screenshots, keystrokes, screen recordings, camera/microphone, file or message content, location |
The agent collects data only during the working days and hours set by the Data Controller in the panel.
3. Obligations of the Data Processor
3.1. Confidentiality. Only personnel bound by a confidentiality obligation who need access to operate the service may access the data. Employee work data of customers is not displayed on the platform's management screens.
3.2. Security (KVKK Art. 12). The Data Processor implements at least the following measures:
- TLS encryption on all connections; only a hash of agent identity keys is stored.
- Logical separation between customers (each query is limited to the customer's own data) and automated tests verifying this.
- Mandatory two-step verification for administrator accounts; 2FA optional or mandatory for customer accounts.
- Account lockout after failed logins, request rate limiting, application firewall; web access to the server permitted only via the network security provider.
- Records of who accessed staff data and when (visible to the Data Controller in its panel).
- Daily backups; encryption of off-server backups and weekly restore tests.
- Regular application of security updates and continuous monitoring of server and application events.
3.3. Breach notification. When the Data Processor becomes aware of a personal data breach affecting the Data Controller's data, it notifies the Data Controller without undue delay and within 24 hours at the latest. To the extent known, the notification includes the nature of the breach, the number of affected data subjects and records, and the measures taken and recommended. The Data Processor provides the information and support necessary for the Data Controller to notify the Board within 72 hours under KVKK Art. 12(5).
3.4. Data subject requests. The Data Processor provides the technical support needed for the Data Controller to respond to requests under KVKK Art. 11 (extraction, correction and deletion of data per person). It forwards requests received directly by the Data Processor to the Data Controller.
3.5. Audit. The Data Controller may request information and documents demonstrating compliance with this Agreement once a year, with reasonable prior notice.
4. Sub-processors
4.1. Service data and encrypted off-server backups are stored in N2mobil data centres in Türkiye. The Data Controller gives general authorisation for the use of the following sub-processors:
| Sub-processor | Service | Location | Data processed |
|---|---|---|---|
| Cloudflare, Inc. | Network security, reverse proxy | USA and worldwide | Transit traffic (not stored permanently) |
| Twilio Inc. (SendGrid) | Email delivery | USA | Email addresses and names of panel users; staff names and summary working times if the Data Controller opened report emails |
4.2. The Data Processor notifies the Data Controller by email at least 30 days in advance before adding a new sub-processor or replacing one. If the Data Controller objects on reasonable grounds and no agreement is reached, it may terminate the service without penalty and receive a refund of fees for the unused period.
4.3. The Data Processor imposes on sub-processors obligations no less protective than those in this Agreement and is liable to the Data Controller for their actions.
5. International transfers
5.1. Service data is stored in Türkiye. However, data sent to sub-processors located outside Türkiye as listed in the table in 4.1 (transit traffic, email delivery) is transferred abroad.
5.2. This transfer is based on the standard contract announced by the Personal Data Protection Board under KVKK Art. 9 (notification to the Board has been made). Where required by the standard contract announced by the Board, the parties will separately sign the relevant standard contract and notify the Board within the period set by KVKK.
5.3. The Data Controller is obliged to state the international transfer in the privacy notice given to its employees (template includes this).
6. Obligations of the Data Controller
6.1. To inform its employees under KVKK Art. 10 before the agent is installed, and to determine and document the legal basis for processing.
6.2. To use the service only on devices owned by the company and for lawful purposes (management of business processes, productivity and information security); not to use it for covert monitoring, interference with employees' private lives or discrimination.
6.3. To determine settings such as window title retention and retention period in line with the principle of proportionality.
7. Retention, return and deletion
7.1. Work activity data is retained for the period set by the Data Controller in the panel and permitted by its package; expired records are deleted automatically every day.
7.2. When the service ends, the Data Controller may export its data from the panel (CSV) or the API for as long as its access continues. 90 days after access ends, all work activity, staff and device records are permanently deleted. Deleted data may remain in encrypted backups for up to 6 more months and will be deleted together with the backups at the end of that period.
7.3. Invoice and contract records continue to be retained by the Data Processor as data controller for the period required by applicable legislation (10 years); these records contain no employee work data.
8. Term and other provisions
8.1. This Agreement enters into force together with the Service Agreement and remains in force until the Data Processor completes its deletion obligations under Article 7.
8.2. If there is a conflict between this Agreement and the Service Agreement regarding the protection of personal data, this Agreement applies.
8.3. Turkish law governs this Agreement; the courts and enforcement offices of Ankara have jurisdiction over disputes.
Effective: 5 November 2026