Data Processing Terms

These terms are the data-processing terms of Sovarenne Holding for https://sovarenne.com/. Version 1.0.0, last updated on October 17, 2026. They apply only when a written engagement says that the client is the controller and Sovarenne Holding processes personal data on the client instructions.

They do not apply to data the Site processes for its own account, such as the language cookie and server logs. That processing is described in the Privacy Policy and, where Turkish law applies, the KVKK Disclosure. They also do not create a processing engagement by themselves. No such engagement is offered through a button on the Site.

The client determines the purposes and the means, and is responsible for having a lawful basis and for informing the data subjects. Sovarenne Holding processes the data only on documented instructions, including instructions about transfers, unless the law requires a different step. If an instruction appears to break the law, Sovarenne Holding will tell the client and may suspend that instruction.

The people who handle the data are limited to those who need it for the engagement, and they are bound by confidentiality. Sovarenne Holding does not use client personal data for its own marketing.

The measures match the nature of a professional coordination engagement and the data the engagement actually involves. They include the following, as relevant to the work.

• Access limited to named people, with authentication and, for the control centre, multi-factor authentication.
• Separation between public pages and administrator functions.
• No placement of client documents on the public Site.
• A notice to the client without undue delay after becoming aware of a personal-data breach that affects the engagement, so the client can meet its own notification duties.

A subprocessor is used only if the engagement allows it or the client authorises it. The Site does not list a standing subprocessor for client data, because no client-data platform is connected. Hosting of this public website is not a standing authorisation to store a client file.

A transfer outside the client country follows the instructions and the transfer tool that the applicable law requires. Sovarenne Holding does not move a client file to a new country in silence. Local lawyers, accountants and authorities that the client chooses to instruct are the client own recipients, not silent subprocessors.

At the end of the engagement, Sovarenne Holding deletes or returns the personal data, at the client choice, unless a law requires a longer retention. Backups, where they exist, expire on their ordinary cycle rather than being treated as an active file.

The client may ask for the information reasonably needed to show that these terms are being met. An on-site audit is agreed in the engagement, with notice, during business hours, and without access to other clients data. These terms do not set a fictitious certification or a fictitious audit report.