Data Processing Agreement

Effective date: 29 September 2026

This Data Processing Agreement (the "Agreement") forms an integral part of the Subscription and Service Agreement and sets out the rules under which Noniux processes the personal data that the Customer uploads to, or collects through, its EVOS workspace. Data that Noniux processes on its own behalf as a data controller is covered by the KVKK Privacy Notice and the Privacy and Cookie Policy.

Article 1 – Parties

Data controller: the Customer (the company whose details were collected at subscription), referred to in this Agreement as the "Customer".

Data processor: Noniux ("Noniux")

• E-mail: info@noniux.com

Other business details are provided by e-mail on request.

The Customer and Noniux are together referred to as the "Parties".

Article 2 – Definitions

Terms in this Agreement have the meaning given to them in Law No. 6698 on the Protection of Personal Data ("KVKK") and its secondary legislation. In addition:

• EVOS: the event operating system provided by Noniux at https://evos.noniux.com, in which buyer delegations and trade-fair visitors are managed.
• Workspace: the part of EVOS allocated to the Customer, including its users, records, files and settings.
• Customer data: personal data that the Customer's users enter into or upload to the workspace, or that reaches the workspace through channels connected by the Customer (such as web forms, WhatsApp, lead-ad forms or Excel imports).
• Data processor: under the KVKK, the natural or legal person who processes personal data on behalf of the data controller on the basis of the authority granted by the controller.
• Sub-processor: a third-party service provider that Noniux uses to process Customer data.
• Data breach: Customer data being obtained by others through unlawful means, or being subject to unauthorised access, loss or corruption.
• Board: the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

Article 3 – Subject matter, scope and roles

1. The Customer is the data controller of Customer data. The Customer determines the purposes and means of the processing.
2. Noniux is the data processor and processes Customer data only on behalf of the Customer and only to provide the EVOS service (KVKK Art. 12).
3. Data that Noniux processes on its own behalf for its commercial relationship with the Customer (such as contact details of the Customer's representatives, billing and payment data, and EVOS login and security records) falls outside this Agreement; Noniux is the data controller for that data.
4. The subject matter, nature and purpose of the processing, the categories of data and the categories of data subjects are set out in Annex 1.

Article 4 – Purpose and limits of processing

1. Noniux processes Customer data only to: host and operate EVOS; provide the features the Customer uses (registration, submission to fairs, booking, attendance, messaging, reporting, accounting, human resources and similar); take backups; keep the service secure; fix errors; and perform support work requested by the Customer.
2. Noniux does not use Customer data for its own purposes, for marketing, for profiling or for training artificial-intelligence models, and does not sell or rent it.
3. To measure how the service operates, Noniux may use only aggregate figures that do not identify anyone (for example, the number of records or users).
4. Panel assistant improvement records. By this Agreement the Customer instructs Noniux to record conversations with, and use of, the EVOS panel assistant in order to improve the assistant's accuracy, safety and coverage. These records: (a) contain the query the user wrote to the assistant, the assistant's answer, the tools used, errors, durations and the rating the user gave; (b) are stored with phone, e-mail, passport, ID, IBAN and card numbers and long numbers masked before storage, and with the company and the user replaced by irreversible pseudonyms; (c) are kept in Noniux's control-plane database for at most 1 (one) year and deleted automatically afterwards; (d) are viewed only by Noniux's authorised platform administrators, solely to find the assistant's errors and gaps, understand frequent requests and improve the assistant's instructions and tools, and are not shown to the Customer's employees or to other customers. These records are not used to train artificial-intelligence models, are not sold and are not shared with third parties (Article 4(2) remains in force).

Article 5 – Obligations of the Customer

The Customer:

1. Confirms that it has a legal basis under the KVKK for collecting Customer data and processing it in EVOS, that it has informed data subjects, and that it has obtained explicit consent where required.
2. Obtains the permissions required by applicable law before sending marketing messages, and keeps the consent, consent-withdrawal and WhatsApp opt-out records in EVOS up to date.
3. Acknowledges that EVOS has no dedicated field for special categories of personal data such as health, religion, biometric data or criminal convictions. The Customer takes care not to enter such data into free-text fields, notes, messages or documents; if it does, meeting the conditions of KVKK Art. 6 and the measures set by the Board is the Customer's responsibility.
4. Manages user accounts, roles, module access, country restrictions and field-visibility settings in line with its own authorisation policy, closes the accounts of departing staff, and recommends two-factor authentication to its users.
5. Before enabling optional integrations (WhatsApp, Meta lead-ad forms, e-mail sending, AI-assisted features), assesses that data will be transferred to the sub-processors listed in Annex 3 and abroad. Enabling such an integration constitutes the Customer's instruction to that effect.
6. Is responsible for the accuracy and currency of the data it uploads to EVOS.

Article 6 – Obligations of Noniux

Noniux:

1. Processes Customer data only in accordance with this Agreement, the Subscription and Service Agreement and the Customer's documented instructions.
2. Takes the technical and organisational measures set out in Annex 2 to prevent unlawful processing of personal data, to prevent unlawful access to personal data and to ensure the safekeeping of personal data (KVKK Art. 12(1)). The Parties acknowledge that under KVKK Art. 12(2) the Customer is jointly responsible with Noniux for taking these measures.
3. Does not disclose or transfer Customer data to third parties outside the Customer's instructions, except for the sub-processors provided for in this Agreement and disclosures required by law.
4. When it receives a request from a public authority concerning Customer data, notifies the Customer without delay unless prohibited by law, and complies with the request only to the extent required by law.
5. Informs the Customer if it considers that an instruction infringes the KVKK, and may suspend the relevant processing until the instruction is clarified.
6. Assists the Customer in meeting its obligations under the KVKK, taking into account the nature of the processing and the information available to Noniux.

Article 7 – Instructions

1. The Customer's instructions consist of this Agreement, the Subscription and Service Agreement, the settings and choices the Customer makes in EVOS (enabling or disabling modules, retention policy, integrations and similar), and written notices sent by e-mail by the Customer's authorised representative to info@noniux.com.
2. Instructions that go beyond the scope of the service are agreed separately between the Parties.

Article 8 – Confidentiality of personnel

1. Noniux grants access to Customer data only to personnel who need it to provide, maintain and secure the service or to handle support requested by the Customer, and only to that extent.
2. Noniux places the persons it authorises to access Customer data under written confidentiality obligations that continue after their duties end.
3. The Noniux platform administration console does not show the content of the Customer's business records; it shows only the workspace status and plan, user names and e-mail addresses, and record counts. Access beyond this takes place only for a support request, a security incident or a legal obligation.

Article 9 – Technical and organisational measures

1. Noniux applies the measures listed in Annex 2 and updates them in line with technological developments. An update may not lower the level of security.
2. Annex 2 describes the measures actually in place in EVOS as of the date of this Agreement. Noniux does not claim to hold ISO 27001, SOC 2 or any similar certification, or to have commissioned an independent penetration test.

Article 10 – Sub-processors

1. By this Agreement the Customer gives general written authorisation for the sub-processors listed in Annex 3.
2. Before adding or replacing a sub-processor, Noniux notifies the Customer by e-mail or within EVOS at least 30 days in advance. The Customer may object within that period on justified grounds relating to data protection. If the Parties cannot reach agreement, the Customer may terminate the agreement; the provisions of the Subscription and Service Agreement apply to termination and refunds.
3. If the notice period cannot be observed for urgent security or continuity reasons, Noniux notifies the change as soon as possible and the Customer's right to object remains.
4. Noniux imposes on sub-processors data protection obligations no less protective than those in this Agreement and is liable to the Customer for the acts of its sub-processors as for its own.
5. Sub-processors used only for optional integrations the Customer enables (identified in Annex 3) receive no Customer data unless the Customer enables that integration.

Article 11 – Transfers abroad

1. Some of the sub-processors listed in Annex 3 are established outside Türkiye or process data outside Türkiye. These transfers are made in accordance with KVKK Art. 9 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad.
2. Under that Regulation, where data is transferred by a data processor, the data controller's instructions must also be followed, and the transfer does not remove the data controller's responsibility. By enabling optional integrations the Customer instructs the relevant transfer.
3. Transfers to the sub-processors shown in Annex 3 as abroad are made under KVKK Art. 9 by concluding the standard contract announced by the Board. Noniux notifies the standard contract to the Authority within five business days of completion of the signatures.
4. Where no appropriate safeguard can be put in place for a transfer, Noniux keeps the relevant integration unavailable to the Customer or informs the Customer in advance.

Article 12 – Assistance with data-subject requests

1. Requests by data subjects to exercise their rights under KVKK Art. 11 are made to the Customer and resolved by the Customer. Noniux forwards any such request it receives directly to the Customer without undue delay, without responding to it itself.
2. EVOS offers the Customer the following tools to handle such requests: export of all data of a visitor record as a single (JSON) file; anonymisation of personal fields, within the scope and under the conditions described in Annex 2 (including deletion of documents attached to the record from storage); permanent deletion of the record; recording of explicit consent and its withdrawal; recording of WhatsApp opt-outs; correction of records.
3. Where these tools are not sufficient, Noniux provides technical assistance within a reasonable time of the Customer's written request, so that the Customer can conclude the request within the period set in KVKK Art. 13.

Article 13 – Data breach notification

1. When Noniux becomes aware of a data breach affecting Customer data, it notifies the Customer without undue delay and at the latest within 72 hours, to the Customer's registered administrator e-mail address and, if any, its KEP address.
2. The notification contains, to the extent then known: the nature and time of the breach; the categories of data affected and the approximate number of persons and records; the likely consequences; the measures taken and proposed; and a contact person at Noniux. Information not yet known is supplied as it becomes available.
3. Noniux immediately takes the measures necessary to limit the effect of the breach, keeps records of the breach, and assists the Customer with its notifications to the Board and to data subjects.
4. Under KVKK Art. 12(5), where processed personal data is obtained by others through unlawful means, the data controller notifies the data subject and the Board of this as soon as possible. The Board's decision on data breach notification provides a period of 72 hours from becoming aware of the breach for notification to the Board. The duty to notify the Board and data subjects lies with the Customer; Noniux does not notify the Board on the Customer's behalf.
5. Noniux's notification does not constitute an admission of fault for the breach.

Article 14 – Audit and information

1. On the Customer's written request, Noniux provides within a reasonable time the information needed to demonstrate compliance with this Agreement, including a description of the measures in Annex 2, the current list of sub-processors and the audit records relating to the Customer.
2. Where the information provided is not sufficient, the Customer may carry out an audit itself or through an independent auditor bound by confidentiality. Audits take place no more than once a year, with at least 30 days' written notice, during business hours and at the Customer's expense; these limits do not apply in the case of a data breach or a request by the Board.
3. An audit does not give access to other customers' data or to Noniux's trade secrets, and may not endanger the security or continuity of the service.
4. The Parties assist each other in any examination by the Board at either Party.

Article 15 – Retention, return and deletion

1. During the subscription, Customer data is kept until the Customer deletes it or it is anonymised under the retention policy the Customer defines in EVOS.
2. When the subscription ends, the Customer may, within 30 days of the end date, retrieve its data using the export tools in EVOS or request an export of its data by written request to Noniux by e-mail. Noniux delivers the data in a commonly used format (Excel/CSV or a database dump).
3. After that period expires, Noniux deletes or anonymises, within 30 days, the database allocated to the Customer and the Customer's files in file storage. Copies in the daily backups are deleted automatically within the backup cycle of at most 14 days; during that period backups are kept for recovery purposes only and are not otherwise processed.
4. Data that must be retained by law is kept only for the period and to the extent required by that obligation.
5. On request, Noniux confirms the deletion in writing.

Article 16 – Liability

1. The Parties' liability under this Agreement is subject to the liability provisions of the Subscription and Service Agreement.
2. Each Party is liable for administrative fines and damages arising from its own breach of its obligations, without prejudice to the joint responsibility under KVKK Art. 12(2).

Article 17 – Term, precedence and amendment

1. This Agreement remains in force for as long as the Subscription and Service Agreement is in force and until the obligations in Article 15 have been completed.
2. In the event of a conflict between this Agreement and the Subscription and Service Agreement regarding the protection of personal data, this Agreement prevails.
3. Noniux may update this Agreement because of changes in legislation or in the service; the update is notified to the Customer before it takes effect and the current version is published in EVOS. For material changes to the Customer's detriment, the amendment procedure of the Subscription and Service Agreement applies.
4. The governing law and competent courts are as set out in the Subscription and Service Agreement.

Article 18 – Entry into force

This Agreement enters into force on the date the Customer accepts the Subscription and Service Agreement electronically, with effect for this version from 29 September 2026. EVOS records who gave the acceptance, for which version and when.

Annex 1 – Processing Details

Subject matter and duration

Provision of the EVOS service; for the term of the subscription and the return and deletion period in Article 15.

Nature of the processing

Recording, storage, organisation, classification, querying, reporting, matching and merging, export, transmission on the Customer's instruction (WhatsApp, e-mail), backup, anonymisation and deletion.

Purposes of the processing

• Keeping records of buyer delegations and visitors and managing the fair life cycle (registration, submission to and acceptance by the fair, booking, confirmation, attendance)
• Planning events, hotels, transport and reception
• Communication, messaging and campaigns with visitors and organisations
• Running tasks, calendars and internal notes
• Reporting, performance and commission calculations
• Event-based accounting and finance
• Keeping the Customer's employee and payroll records (if the human resources module is used)
• Security of the service, backups and audit records
• Keeping masked and pseudonymised assistant records to improve the panel assistant (Article 4(4))

Categories of data subjects

• Visitors, traders and buyer-delegation members invited or hosted by the Customer; prospective visitors
• Companions of visitors
• Contact persons at visitors' companies
• Representatives and contact persons of organisations, agents and key clients
• Contact persons of fair and event organisers, hotels, transport and other suppliers
• Account holders in accounting records (including sole-trader suppliers and customers)
• The Customer's employees, freelancers and EVOS users
• Other persons appearing in WhatsApp groups or correspondence

Categories of personal data

• Identity: name and surname (in Arabic and Latin script), four-part name, date of birth, gender, passport number; for employees, national ID number; the customer number and barcode assigned by the system
• Contact: mobile phone, alternative numbers, e-mail, company phone numbers, website, social media accounts, country and city
• Professional and commercial: company name, job title, type of business, sectors and categories, trade registry number, company description, annual import volume, interests
• Travel and accommodation: flight numbers, arrival and return dates and times, airport codes, hotel name and location, check-in and check-out dates, room type, companions' names, bus assignment
• Attendance: actual entry times at the hotel and the fair (barcode scans), reason for non-attendance, badge link
• Documents and images: passport, business card, trade registry extract, contract and memorandum of understanding, flight ticket, payment receipt, commission document, reception-note photos; invitation letters and booking confirmations generated by EVOS
• Correspondence: incoming and outgoing WhatsApp messages (text, images, documents, voice recordings, group messages), template parameters, e-mail content
• Marketing and source: where the person came from, campaign and bulk-send records, Meta lead-ad form answers, explicit consent, consent withdrawal and WhatsApp opt-out records
• Assessments and notes: internal notes, post-fair survey answers (satisfaction, purchase status and amount), key-client flag, blacklist flag and reasoned negative notes
• Finance: commission and invoice records, partner accounts, bank statement lines, cash and custody movements, payment documents
• Employee data: start date, specialty, type of employment, salary, raise, bonus, advance, deductions, payslips, monthly performance score, a relative's phone number, employee documents
• User and security data: the user's name, e-mail address, role, user code, WhatsApp number, preferences, login records (IP address, browser information, result) and audit records

Special categories of personal data

EVOS has no field reserved for special categories of personal data and Noniux does not process such data intentionally. Documents, photos, free-text fields and correspondence may contain special-category data entered by the Customer; in that case Article 5(3) applies.

Annex 2 – Technical and Organisational Measures

Data separation and hosting

• A separate PostgreSQL database is created for each new Customer. Company records, subscription and login routing information are kept in a control database separate from business data.
• Every query within the application is additionally filtered by the Customer's organisation ID.
• Files are stored in a MinIO object store running on the Noniux server, under keys prefixed with the Customer's organisation ID, and are served only through application requests that pass authorisation checks.
• The application, databases and file storage run as Docker containers on a server located in Hetzner Online GmbH's data centres in the European Union. The database and file storage are not exposed to the internet; the application reaches them over the server's internal network.

Access control

• Role-based authorisation; module access per role and per person; pages and actions of modules disabled by the Customer are blocked on the server side.
• Row-level visibility: a communication and marketing officer sees only their own visitors and records in the countries assigned to them; key-client records are visible only to authorised roles.
• Field-level visibility: management-only fields and the field-visibility rules configured by the Customer.
• Changes to protected client fields (phone, e-mail, name, country) go through an approval flow.
• Authorisation checks are made on the server, not in the user interface.

Authentication

• Passwords are stored as one-way bcrypt hashes.
• After 8 failed attempts on the same account within 15 minutes the account, and after 20 failed attempts from the same IP address the IP address, is temporarily locked.
• Optional two-factor authentication (TOTP) for users; re-use of a code already used is blocked.
• Two-factor authentication is mandatory for Noniux platform administrators; platform administration runs with a session and cookie separate from Customer login.
• Session cookies are set as httpOnly, secure and SameSite=Lax.

Encryption

• All access to EVOS is over HTTPS (Let's Encrypt certificate; HTTP requests are redirected to HTTPS).
• The following secrets are stored in the database encrypted with AES-256-GCM: the WhatsApp Cloud API access token, app secret and webhook verify token; the two-factor authentication secrets of users and platform administrators; the ID or tax number in the Customer's billing details.
• API keys are stored only as hashes. The phone number of anonymised persons is kept as an irreversible hash (HMAC).
• Customer data other than the above is not encrypted at field level in the database.

Logging and traceability

• Sensitive operations on Customer data (creating, changing, merging, deleting, exporting and importing records, role and permission changes, integration settings, bulk sends, finance operations, enabling or disabling two-factor authentication and similar) are written to an audit log with who and when.
• Successful and failed login attempts are recorded.
• Actions of Noniux platform administrators (creating a company, changing status or plan, module settings) are written to a separate audit log.
• Audit and login records are kept for as long as required for security and possible disputes.

Backup and continuity

• All databases are backed up separately every night; each backup is automatically checked for restorability and kept for 14 days.
• An additional backup is taken before schema changes.
• New versions are released with zero-downtime switchover; a version that fails the health check is not put into service.
• Backups are currently kept on the same server as the application. Files in file storage are not separately backed up.

Retention, anonymisation and deletion

• The anonymisation features can be used when Noniux enables them. In that case, the Customer can define a retention period in months for visitor records; records whose period has expired and that have no active fair registration are anonymised automatically. Before the policy is enabled, the number of records it will affect can be previewed.
• A single record can be anonymised or permanently deleted manually; on anonymisation and deletion, documents attached to the visitor card are also deleted from file storage. Anonymisation covers the personal fields on the visitor card; it does not cover message history, travel details in fair registrations or notes.
• Panel assistant improvement records (Article 4(4)) are deleted automatically after 1 year.
• No marketing message is sent to a person who has withdrawn consent or is blacklisted; WhatsApp opt-out requests are recorded and applied.
• The Customer's workspace can be set to "read-only" or "suspended"; while suspended, logins and open sessions are closed and incoming webhook traffic is not processed.

Integration security

• Webhook requests from WhatsApp and Meta pass signature verification; the same event is prevented from being processed twice.
• In demo mode and for integrations that are not configured, no calls are made to external services.
• Text recognition (OCR) on flight-ticket and invoice images is performed in the user's browser; the image is not sent to the server or to the AI provider for this purpose.
• AI-assisted features work only when Noniux configures a provider. Sending accounting documents to an external AI is off by default and is enabled in the Customer's settings; each use is recorded in the audit log.

Organisational measures

• Access to Customer data is limited to what is needed for the task (Article 8).
• Secrets are not kept in the source code but in an environment file on the server readable only by the administrator. The key used for automatic deployment can only run the deployment script on the server.

Annex 3 – Sub-processors

Hetzner Online GmbH

• Purpose: server hosting (application, databases, file storage, backups) and domain name (DNS) service.
• Data: all Customer data in Annex 1 (as hosted data).
• Scope: for every Customer; not optional.
• Location: Hetzner Online GmbH's data centres in the European Union.
• Transfer abroad: yes. The transfer is made under the standard contract announced by the Board (Article 11).

Meta Platforms (WhatsApp Business and Meta lead-ad forms)

• Purpose: sending and receiving messages through the WhatsApp Business (Cloud API) line connected by the Customer; receiving leads from Meta lead-ad forms connected by the Customer; correspondence through the WhatsApp numbers of Customer users where they connect their own numbers.
• Data: phone numbers, message content, files and voice recordings sent and received, template parameters, message status information; lead-form answers.
• Scope: only if the Customer enables these integrations.
• Transfer abroad: yes. The transfer is made under the standard contract announced by the Board (Article 11).

Artificial-intelligence provider

• Purpose: optional AI-assisted features: drafting WhatsApp and e-mail messages, extracting fair details from a fair-calendar file, extracting invoice fields and account suggestions from accounting documents.
• Data: for message drafts, the visitor's name, the fair name, the sending user's name and WhatsApp number and the note written by the user; the text of the fair-calendar file; the text of the accounting document (including personal and tax details in it) and chart-of-accounts names. Passports and other images are not sent.
• Provider: an AI service provider (chosen by Noniux; e.g. Ollama).
• Scope: only when the features above are used and only when Noniux configures a provider; for accounting documents, additionally only when the Customer's setting is enabled.
• Transfer abroad: yes if a cloud service is used; in that case the transfer is made under the standard contract announced by the Board (Article 11). No for an installation running on the Noniux server.

E-mail delivery service (Resend)

• Purpose: delivering e-mails the Customer sends from EVOS (invitation letters, booking confirmations, e-mails to organisations).
• Data: recipient e-mail addresses, e-mail content and attachments (including invitation-letter and booking-confirmation PDFs).
• Scope: only if e-mail sending is live.
• Transfer abroad: yes (USA). The transfer is made under the standard contract announced by the Board (Article 11).

Vercel Inc. (transition-period redirect)

• Purpose: redirecting from the old address (aseel-expo.vercel.app) to EVOS. Page requests are only redirected; webhook requests from Meta are forwarded to EVOS through this address.
• Data: the content of forwarded webhook requests (including WhatsApp messages and lead-form answers) and request information.
• Scope: temporary; ends when the webhook addresses are moved directly to EVOS.
• Transfer abroad: yes (USA). The transfer is made under the standard contract announced by the Board (Article 11).

Out of scope: payment service (iyzico)

iyzico is used only for the Customer's subscription payments and receives the Customer's billing and payment details. Customer data in the workspace is not sent to iyzico. Noniux is the data controller for that data; details are in the KVKK Privacy Notice.

In case of conflict, the Turkish version prevails.