Data Processing Addendum

Operator / Controller: Ferhat Canberk Döğer (trading as Kortex Bilişim)
Last updated: 27.09.2026

This Data Processing Addendum applies when incorporated into an agreement or electronically accepted between a TaskTraQ customer and the TaskTraQ operator.

Parties and roles

Customer: the business or professional organisation using TaskTraQ.

Processor: Ferhat Canberk Döğer, trading as Kortex Bilişim (TaskTraQ).

Where the Customer submits personal data concerning its employees, customers, suppliers or other individuals, the Customer generally acts as Controller and TaskTraQ acts as Processor to the extent TaskTraQ processes such information on the Customer's instructions.

TaskTraQ may separately act as Controller for its own account security, contractual administration and legal obligations.

Subject matter and purpose

Processing is performed to provide:

• service-desk and ticketing,
• project and task management,
• customer portals,
• team communication,
• knowledge bases,
• file handling,
• notifications,
• related TaskTraQ functionality.

Duration

Processing continues for the duration of the Customer's use of TaskTraQ and applicable deletion, backup or legal-retention periods.

Categories of data subjects

May include:

• Customer employees,
• Customer users,
• Customer's customers,
• suppliers and business partners,
• individuals referenced in tickets or projects.

Categories of personal data

Depending on Customer use:

• identification and contact information,
• business and organisation information,
• account details,
• tickets,
• projects and tasks,
• messages and comments,
• files and documents,
• technical and security information.

Processing instructions

TaskTraQ processes Customer Personal Data only as necessary to:

• provide the service,
• follow documented Customer instructions,
• maintain security,
• meet applicable legal obligations.

Confidentiality

Persons authorised to access Customer Personal Data are subject to appropriate confidentiality obligations.

Security

Measures may include:

• HTTPS,
• secure password hashing,
• tenant and organisation access controls,
• membership checks,
• rotating refresh tokens,
• hashed API keys,
• HMAC-signed webhooks,
• file authorisation controls,
• system and security logs.

Sub-processors

Current infrastructure providers may include:

Cloudflare — DNS, network and security infrastructure.

Google / Firebase Cloud Messaging — Android notification delivery.

Apple / APNs — iOS notification delivery.

Where a material change to sub-processors affects Customer Personal Data, updated information will be made available through TaskTraQ documentation, privacy information or contractual communication.

International transfers

TaskTraQ's primary application data is hosted in Türkiye.

Certain supporting providers may process limited technical information internationally.

Where GDPR, KVKK or another applicable law requires additional safeguards, the parties will use applicable standard contractual clauses, standard contracts or other recognised transfer mechanisms.

Data-subject requests

TaskTraQ will provide reasonable technical assistance to help the Customer respond to data-subject requests where the Customer cannot reasonably fulfil the request without TaskTraQ's assistance.

Security incidents

If TaskTraQ becomes aware of a confirmed security breach affecting Customer Personal Data, TaskTraQ will notify the Customer without unreasonable delay as appropriate to the circumstances and applicable legal obligations.

Return and deletion

Upon termination, the Customer may request deletion or available export of Customer Personal Data.

Information subject to legal-retention requirements and copies within ordinary backup cycles may be retained until the applicable requirement or backup cycle expires.

Audits

TaskTraQ will provide information reasonably necessary to demonstrate compliance with applicable processor obligations.

Audit activity must not compromise service security, confidentiality of other customers or system integrity.