Data processing agreement

Version 1.0 · Updated: October 22, 2026

This is the data processing agreement (version 1.0, 22 October 2026) that the manager who creates a building in Bina accepts on behalf of the building’s management. The manager accepts it when creating the building; the version, the time and the account are recorded.

Parties. Data controller: the building’s management (the manager or board under the Condominium Law) represented by the accepting manager. Data processor: Bina (bina.sayfa.app, [email protected]). For account data Bina is itself the controller; this agreement does not cover it (privacy policy).

1. Subject and purpose

Bina keeps the building’s dues, payment, expense, announcement and document records on the management’s behalf and only on its written instructions. The purpose is to run dues management, record payments and expenses, show residents their balance and statement and provide the year-end account. No processing is done for any other purpose. This agreement and the use of the app are the management’s instructions.

2. Data and data subjects

• Data subjects: the building’s managers, board members, auditors, owners and tenants; people who use a unit’s statement link.
• Types of data: name, e-mail, optional phone number, unit link, dues, payments and receipts, expenses and their receipts, announcements and messages, uploaded documents, audit records.
• A national ID number, a date of birth and the special categories of personal data in KVKK Art. 6 are not asked for; the management undertakes not to upload them to Bina.

3. Duration

The agreement lasts as long as the building exists in Bina and ends when the building leaves Bina.

4. The processor’s duties

Under KVKK Art. 12, Bina:

1. processes data only on the management’s instructions and for the purpose in clause 1, and tells the management if an instruction is unlawful;
2. takes appropriate technical and organisational measures to prevent unlawful access to the data and to keep it secure: each building’s data is separated from other buildings by row-level security; membership and permission are checked on the server for every request; traffic is encrypted with HTTPS; an audit log is kept; sessions can be ended; backups are kept 30 days;
3. keeps staff who can reach the data under a duty of confidentiality; Bina staff cannot see a building by default and can read it only with the 7-day read access the manager grants, and every read is written to the building’s Activity log;
4. does not use the data for any other purpose, sell it, or process it for advertising or profiling;
5. helps the management answer data subjects’ Art. 11 applications, and forwards any application it receives to the management;
6. tells the management without undue delay after it learns of a data breach, so that the management can meet the 72-hour notification duty in KVKK Art. 12/5;
7. on the management’s request, provides the information that shows it meets its duties;
8. lets the management export the building’s data at any time, on every plan.

5. The management’s duties

The management is responsible for informing residents under KVKK Art. 10, for processing lawfully and for decisions that are its own (for example publishing the list of debtors). The list of debtors is published only if the building’s decision to do so has been recorded in the app.

6. Sub-processors

The management authorises Bina to use these sub-processors:

Some of them are outside Turkey, so the transfer falls under KVKK Art. 9. Bina binds sub-processors to terms that give protection equal to this agreement. If the list changes Bina announces it in advance on this page and in the app; if the management objects it can export the building and close its account.

7. Deletion and return when it ends

When the building leaves Bina the management can export its records. After it leaves, the building’s data, including the audit log and ledger as legal records, is deleted after 10 years; copies in database backups are deleted automatically within 30 days at most. This period serves the management’s own legal retention duties. If the management wants earlier deletion it writes to [email protected] and data not subject to a legal retention duty is deleted.

8. Audit

The management can check that Bina complies with this agreement by asking for written information, with reasonable notice, at its own cost and without disrupting Bina’s operations.

9. Governing law

This agreement is governed by the laws of the Republic of Türkiye. It is part of the terms of use.