Standard processing terms, written to be read.

1. Parties and roles

These terms apply between the customer that subscribes to Tyllus and the company that operates Tyllus: Kodex Bilişim Teknolojileri Anonim Şirketi, trading as Tyllus, Altınşehir Mah. 228. Sok. No:44, 16120 Nilüfer / Bursa, Türkiye.

For personal data contained in workspace records, documents and partner details, the customer is the controller and Tyllus is the processor. Tyllus processes that data only on the customer's documented instructions, which are given by using the product, by written support requests, and by these terms read together with the Terms of Use and the Privacy Policy.

For account administration, billing, security and service communications with the customer's own users, Tyllus acts as a controller. That processing is described in the Privacy Policy, not here.

2. Subject matter and duration

The subject matter is the processing needed to provide Tyllus: an import operations workspace covering orders, shipments, partner follow-up, document collection, tracking context, costs, customs coordination, exceptions and reporting.

Processing starts when the customer first uses Tyllus and continues for as long as the subscription is active. After termination, processing is limited to what section 11 and the retention terms of the Privacy Policy allow.

3. Nature and purpose of processing

Tyllus processes personal data only for the following purposes.

• Creating and administering accounts, workspaces, memberships and roles.
• Storing, organising and displaying orders, shipments and their related records.
• Receiving and storing uploaded documents and reading them to suggest field values for the customer's review.
• Sending e-mail on the customer's behalf to its own users and to the partners it names, and collecting what those partners submit.
• Looking up container and booking tracking context from the identifiers the customer enters.
• Calculating costs, producing reports, and writing activity records for audit purposes.
• Providing support, investigating faults, preventing abuse and keeping the service secure.
• Billing the subscription and keeping the records that billing requires.

4. Categories of data and data subjects

The customer decides what goes into its workspace, so the exact content varies. In normal use the following applies.

5. Data that must not be placed in Tyllus

Tyllus does not ask for and is not designed to hold special categories of personal data under Article 9 of the GDPR, criminal-offence data, payment card numbers, government-issued identity document images that are not part of a customs file, or the personal data of children.

If the customer places such data in a workspace anyway, it does so on its own responsibility and must tell Tyllus so the processing can be assessed or the data removed.

6. What the customer is responsible for

As controller, the customer decides why and how the personal data in its workspace is processed.

• Having a lawful basis for the personal data it places in Tyllus, including data about its partners' staff and about individuals named inside uploaded documents.
• Giving its own data subjects the notices they are entitled to.
• Making sure the partner e-mail addresses it enters are correct and that sending to them is appropriate.
• Managing its own members, roles and offboarding, and removing access when someone leaves.
• Keeping its own copies of records it must retain for customs, accounting, tax or legal purposes.
• Responding to its own data subjects; Tyllus assists but does not answer on the customer's behalf.

7. What Tyllus is responsible for

As processor, Tyllus commits to the following duties for the personal data it processes on the customer's behalf.

• Processing personal data only on the customer's documented instructions, and saying so if an instruction appears to breach applicable data protection law.
• Keeping the personal data confidential and binding the people who can access it to confidentiality.
• Applying the security measures described in section 9.
• Engaging subprocessors only on the terms in section 8.
• Assisting the customer with data subject requests, impact assessments and prior consultations, as described in section 10.
• Notifying the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with the information available at that time.
• Deleting or returning personal data on termination as described in section 11.
• Making available the information the customer needs to demonstrate compliance with these duties.

8. Subprocessors

The customer gives general authorisation for Tyllus to engage subprocessors. A current list of subprocessors and relevant processing details is available from Tyllus on request.

Tyllus imposes data protection obligations on each subprocessor that are materially equivalent to these terms, and remains fully liable to the customer for a subprocessor's performance.

The customer may object by writing to team@tyllus.com; Tyllus will explain the processing and whether it can be avoided, and if no reasonable solution is found the customer may terminate the affected part of the subscription.

9. International transfers

Tyllus processes personal data in the United States and in the European Union, and subprocessors may process it in further countries. Ask Tyllus for current processing-location details.

Where personal data protected by EU or UK law is transferred to a country without an adequacy decision, Tyllus offers the European Commission's Standard Contractual Clauses, and the UK Addendum where the UK GDPR applies, as part of the countersigned copy of these terms. For personal data protected by Turkish law, transfers are made on a basis permitted by that law and recorded in the same countersigned copy.

Tyllus has not carried out and does not publish a transfer impact assessment for each subprocessor. If your review requires one, raise it before you buy.

10. Security measures

The technical and organisational measures in place are described in full on the security page and summarised here.

• Encryption of traffic in transit and platform encryption of stored data at rest.
• Access scoped to a workspace and to an assigned role, enforced in the storage rules and not only in the interface.
• Time-limited links for invitations, partner requests and file sharing.
• Credential storage in a managed secret service, never in page code or support messages.
• Activity records for sign-ins, uploads, deletions and partner link use.
• Abuse-prevention checks on requests coming from the web application.
• Managed platform backups so the service can be recovered.

11. Assistance and audit

Taking into account the nature of the processing and the information available to it, Tyllus assists the customer with responding to data subject requests, with data protection impact assessments, and with prior consultation of a supervisory authority.

Tyllus makes available the information needed to demonstrate compliance with these terms and answers written security and privacy questions. A completed standard questionnaire is not kept as a standing document; questions are answered individually.

Tyllus does not hold an audit report that can be supplied instead of an audit. Where applicable law gives the customer an audit right, an audit is arranged on reasonable written notice, no more than once a year unless a breach or a supervisory authority requires otherwise, during business hours, without disrupting the service, under confidentiality, and at the customer's cost.

12. Deletion and return on termination

While the subscription is active the customer can export or download the records and documents it needs. Do this before termination.

After termination, Tyllus deletes or returns the personal data processed on the customer's behalf on written request, except where storage is required by applicable law or is reasonably necessary for legal, accounting, security, dispute or backup purposes. The Privacy Policy describes the retention period that applies in that case.

Backups age out on the cloud platform's own cycle and are not deleted item by item. Personal data still held in a backup remains subject to these terms until it ages out.

13. Order of precedence and changes

These terms supplement the Tyllus Terms of Use. If a countersigned data processing agreement is signed between the customer and Tyllus, the signed document prevails over this page for that customer. Otherwise these terms and the Terms of Use apply together, and the Terms of Use govern liability, warranties and termination.

Tyllus may update this page as the product and the subprocessor list change. The review date is shown at the top of the page, and a material change is recorded in the changelog.

14. Contact

Write to team@tyllus.com for a countersigned copy of these terms, for a data subject request, for a security or privacy question, or to object to a subprocessor. Use the subject line "Data processing agreement" so the request is routed correctly.

Tyllus has not appointed a Data Protection Officer and is not required to at its current scale. Requests are handled by the team at the address above.

Company: Kodex Bilişim Teknolojileri Anonim Şirketi, Altınşehir Mah. 228. Sok. No:44, 16120 Nilüfer / Bursa, Türkiye.