Who else touches your data. And what we promise before they do.
Running a Türkiye operation means licensed professionals, software and physical handlers all seeing part of your information. Under the Personal Data Protection Law No. 6698 you are the controller and we are the processor — so who we bring in is your business as much as ours.
No client data is being processed today. There are no clients and the portal is not live, so a named list published here would be a list of intentions rather than of sub-processors.
The commitment we are making now, before there is anything to disclose: every client receives the named list in the data processing agreement before any data moves, we give notice before adding to it, and you may object.
You are the controller. We are not.
The distinction decides whose obligation it is — and the answer is usually not the one people expect.
- 01
The obligation stays with you
Under Law No. 6698 the controller decides why and how personal data is processed. That is you. We process it on your instruction, which makes us the processor and makes anyone we bring in a sub-processor — still inside your chain of responsibility.
- 02
Employee data is the heavy part
Payroll carries identity numbers, salaries, dependants, bank details and sometimes health information. It is the most sensitive data in the engagement and it belongs to people who are not party to the contract.
- 03
Licensed work cannot be done without seeing the data
A sworn-in fiscal adviser certifying your return has to see the accounts. A customs broker filing in their own name has to see the shipment. The sub-processor list is not an administrative formality; it is the actual delivery chain.
- 04
Leaving is part of it
Where data goes at the end matters as much as where it sits during. It is settled in the agreement at the start, because at the end nobody is in a mood to negotiate it.
What kind of firm, and what they see.
Named firms come in the agreement. The categories do not change, so they are published here.
| Category | Why they are involved | What they see | Where |
|---|---|---|---|
| Sworn-in fiscal adviser and audit | Statutory certification and tax filings reserved to the licence holder | Accounts, payroll totals, filings | Türkiye |
| Payroll and HR software | Employee self-service, statutory submissions, leave and attendance | Employee personal data — the most sensitive in the engagementHeaviest category | Türkiye |
| Customs brokers | Declarations filed in their own name under Customs Law No. 4458 | Shipment, product and company data | Türkiye |
| Warehousing and transport | Physical handling, storage and distribution | Shipment data and operational contacts | Türkiye |
| Legal counsel | Reserved acts under Advocacy Law No. 1136 | Whatever the matter requires | Türkiye |
| Translation and notarisation | Documents for registry, bank and authority filings | Corporate documents, sometimes identity documents | Türkiye |
| Hosting and infrastructure | The client portal and document storage | Everything held in the portal | Being settledSee below |
Controller and processor roles, and the restrictions on transferring personal data outside Türkiye: Personal Data Protection Law No. 6698. Reserved professional acts: Law No. 3568 (sworn-in fiscal advisers), Law No. 4458 (customs brokers), Law No. 1136 (advocates). Cross-border transfer is restricted and the rules are specific — we are taking formal advice rather than relying on a vendor's standard terms. Legislation named on this page: Personal Data Protection Law No. 6698, Customs Law No. 4458, Advocacy Law No. 1136 and Law No. 3568 on sworn-in fiscal advisership. The Official Gazette date and issue for each is on the key figures page, read at source rather than restated here — a citation does not change, but a copy of the law goes stale.
Five things, written down before we have clients.
Made now because a commitment given before it costs anything is worth more than one given under pressure.
- 01
The named list comes before the data
Every client receives it in the data processing agreement before anything moves, and it is kept current for the life of the engagement.
- 02
Notice before we add one
You hear about a new sub-processor before it starts, not in a quarterly summary afterwards.
- 03
You may object
If you do, we either find another route or tell you plainly that the work cannot be delivered without it. What we will not do is proceed and mention it later.
- 04
Same obligations down the chain
A sub-processor is bound to the same terms we are bound to by you. A chain that weakens at each link is not a chain.
- 05
Export and deletion on exit
You take your data in usable formats, and what we hold is deleted or returned on the timetable in the agreement. This is the same commitment made on the portal page, and it is deliberate that both say it.
It is empty,
and that is the honest answer.
No client data is being processed. There are no clients, the portal is not live, and the site you are reading is the only thing running. Publishing names today would describe arrangements we intend to make rather than ones that exist.
Two things are unresolved and we would rather say so. Which payroll platform we license is still in discussion, and it is the sub-processor that will see the most sensitive data. Where the portal is hosted, and whether that involves a transfer outside Türkiye, is a question with counsel rather than an assumption.
Naming a firm publicly is a separate question from disclosing it to you. We publish a partner's brand name only where that firm has agreed in writing to how it is described — a rule set out on the governance page. Disclosure to a client is not optional and does not wait for that agreement.
About data and who holds it.
Including the one a careful buyer asks about certification.
Why is there no list of named firms on this page?
Because no client data is being processed yet. There are no clients, the portal is not live, and the site you are reading is the only thing running. A list published today would be a list of intentions, not of sub-processors.
The named list is a contractual document, not a marketing one. Every client receives it in the data processing agreement before any data moves, and it is kept current for as long as the engagement runs.
Is that not a way of avoiding disclosure?
It would be if the names were withheld from clients, and they are not. Under the Personal Data Protection Law No. 6698 you are the controller and we are the processor; knowing who else handles your data is your right, not our choice.
What is not automatic is publishing a partner's brand name on a public web page. That is governed by what each firm has agreed in writing about how it is described, which is a separate question from disclosure to you.
Can we object to a sub-processor?
Yes. We give notice before adding one, and if you object we either find another route or tell you plainly that we cannot deliver that part without it. What we will not do is add one quietly and mention it afterwards.
In practice the objection that matters most is on the payroll and accounting side, because that is where employee personal data sits.
Where is the data held?
Most of it in Türkiye, because most of the work is Turkish filings performed by Turkish licence holders. Software and hosting are the exception and are the part we are still settling.
Transferring personal data outside Türkiye is restricted under Law No. 6698 and the rules are specific. We are taking formal advice on it rather than assuming that a provider's standard terms are sufficient here.
What happens to the data when we leave?
You take it. Documents, records and history are exported in usable formats as part of any handover, and what we hold is deleted or returned on the timetable set out in the agreement.
A provider that makes leaving difficult is applying a retention tactic, not delivering a service — and it tends to be discovered at the worst moment.
Do you have ISO 27001 or a similar certification?
No. We are a new organisation and we are not going to display a badge we have not earned. Where a certification is required by your procurement process, say so early and we will tell you honestly whether we meet it today.
What we can describe is how access is controlled, who holds what, and what happens when someone leaves — which is the substance the certificate is meant to evidence.
Governance
Which acts are reserved to licensed professions, what we answer for, and the work we decline.
Client portal
What it shows, what we do not build, and what happens to your data if you leave.
What we do not have yet
No case studies, no published prices, no certification badges. All written down with the reason.