Software Services Data Processing and Privacy Policy
This is an English translation provided for convenience. In case of any discrepancy, the Turkish text prevails.
İmacyu Teknoloji San. ve Tic. Ltd. Şti.
Last updated: 14 October 2026
1. Purpose and Scope
This policy sets out the data processing and privacy principles within the scope of the ERP, CRM, workflow management, cloud software, e-transformation (e-documents), software integration, licensing, implementation, maintenance and technical support services provided by İmacyu.
This text is a publicly available informational policy. It does not replace the licence, implementation, hosting, maintenance, support and data processing agreements signed with customers.
2. Legal Nature of Customer Data
The commercial records, accounting and finance information, customer and supplier records, employee information, production data and other business information that customers record in İmacyu software are data created by the customers within the scope of their own activities.
İmacyu does not acquire a right of independent commercial use over such data by reason of having developed the relevant software or having provided the hosting service.
The processing of customer data is assessed within the scope of the applicable service agreements, the data processing instructions and the relevant legislation.
3. Data Controller and Data Processor Roles
The customer may be the data controller to the extent that it determines the purposes and essential means of the personal data processed within the scope of its own activities.
İmacyu may act in the capacity of data processor in activities in which it processes data on behalf of the customer and in line with the customer's instructions.
İmacyu's responsibility as data controller in its own sales, licensing, invoicing and corporate administrative processes is assessed separately.
The capacities and obligations of the parties are determined not solely according to how they are designated in the contract, but according to the actual data processing activities and the legislation.
4. Limits on the Use of Customer Data
Where İmacyu processes data on behalf of the customer, the operations are carried out limited to:
- Provision of the software service,
- Application installation and configuration,
- Authorised technical support,
- Troubleshooting and maintenance,
- Authorised integration operations,
- Hosting within the scope of the contract,
- Backup and restoration,
- Carrying out the customer's instructions
as set out above.
Statutory requirements and lawful operations separately agreed between the parties are reserved.
5. Software Licence and Intellectual Property
Unless otherwise agreed in writing, the source codes, algorithms, architecture, designs, technical documentation and other intellectual property elements of the software developed by İmacyu belong to İmacyu.
The rights of use granted to customers are determined in the relevant licence and service agreements.
The rights relating to customer data and the intellectual property rights in the software are separate from one another.
6. Cloud Services
In the software services that İmacyu provides on its cloud infrastructure, the hosting, application operation, maintenance, support and backup processes are determined by the relevant service agreements.
Access to customer data is limited to the authorisations necessary for the performance of the service.
Where sub-service providers are used in hosting and infrastructure services, the personal data processing activities and the conditions of transfer are assessed separately.
7. Systems Running on Customer Servers
In software running on servers belonging to the customer, the responsibilities relating to infrastructure and data security are determined within the scope of the relevant service model.
The obligations relating to the server, operating system, network, firewall, data storage, backup and access controls are assessed taking into account the parties' actual areas of control and the services they have undertaken.
Where İmacyu additionally provides an infrastructure maintenance or management service, its obligations arising from that service are reserved.
8. Technical Support and Remote Access
Access to customer systems may be required during technical support operations.
The following principles apply to such access:
- Determination of the service need and the authorisation.
- Limitation of access to the necessary scope.
- Protection of the confidentiality of customer information.
- Prevention of the use of data for purposes outside the service.
- Carrying out the necessary information and approval processes within the scope of the relevant contract.
Customer information obtained for the purpose of technical support is not disclosed to third parties other than on valid legal grounds.
9. e-Transformation (e-Documents) Services
In its software solutions, İmacyu may provide integration services for e-Invoice, e-Archive, e-Waybill and other electronic document operations.
In this context, technical operations such as the creation of electronic documents, their transmission to the relevant providers, their receipt, the querying of their status and their display may be carried out.
The responsibilities of the parties in respect of the statutory content, transmission and retention of electronic documents and the related technical obligations are determined within the scope of the legislation in force and the relevant service agreements.
The fact that İmacyu provides an integration service does not mean that it automatically assumes the independent legal obligations of private integrators.
10. Third-Party Integrations
İmacyu software may be integrated with the accounting programs, electronic document systems, e-commerce platforms and other enterprise software used by the customer.
In integration processes, data sharing is carried out within the scope of the authorisations granted, the customer's instructions, the service agreements and the relevant legislation.
The obligations of third-party providers relating to their independent data processing activities are determined according to the legal roles of the parties.
11. Business Partners
İmacyu may work with authorised business partners for the purpose of the promotion, sale, installation, training and support of its products.
The confidentiality of the commercial, technical, financial and customer information accessed by business partners must be protected.
Access to customer data or the transfer of personal data is made subject to valid legal bases and the relevant contractual provisions.
12. Confidentiality and Information Security
İmacyu makes it a principle to protect the confidentiality of the information it accesses in customer systems.
The use of customer data outside the scope of the service, its sale or its disclosure to unauthorised third parties is not acceptable.
Security measures are determined in line with the nature of the data, the scope of the service and the existing risks.
13. Backup and Data Recovery
Backup, data recovery and service continuity processes are carried out according to the operating model of the relevant product and the arrangements in the service agreement.
Backup frequency, retention period, restoration conditions and data recovery responsibilities may not be the same in all service models.
14. Termination of the Service
In the event of termination of the service agreement, the operations relating to the delivery, export, temporary retention, erasure or destruction of customer data are carried out in accordance with the relevant contractual provisions.
Different data return and retention procedures may apply to different products and services.
Statutory obligations are reserved in respect of records whose retention is mandatory under the relevant legislation.
15. Personal Data Breaches
In personal data security breaches, the obligations of the parties relating to the assessment of the incident, the making of the necessary notifications, the carrying out of corrective actions and cooperation with one another are determined within the scope of the relevant legislation and contracts.
16. Survival of the Confidentiality Obligation
The obligations relating to the protection of confidential information learned within the scope of the contract continue after the termination of the contract, in line with the applicable legal and contractual provisions.
17. Legal Nature of the Policy
This policy sets out İmacyu's general approach to data processing and privacy in relation to its software services.
Customer-specific data processing instructions, the use of sub-processors, specific security measures, service level, data return and the other obligations of the parties are determined by separately concluded contracts.
Mandatory provisions of legislation are reserved.
18. Contact
İmacyu Teknoloji San. ve Tic. Ltd. Şti.
Web: www.imacyu.com
E-mail: [email protected]