IT AND SERVICE CENTRES

The Turkish Company Serving Its Parent: Intra-Group Services Agreements and Personal Data

A large share of the software and service centres set up in Türkiye serve not third parties but the foreign parent company and other group companies. These centres take on support functions such as customer support, software development, accounting and human resources. Services provided within the group often start without a contract; their legal framework, however, is of decisive importance both in tax audits and for data protection.

Putting the intra-group service relationship in writing often becomes an issue only at the first tax audit or the first data breach notification. The following sections address the main points that Turkish companies serving their parent company, and the groups setting up such structures, should consider.

Content of the intra-group services agreement

The intra-group services agreement governs which services the Turkish company will provide, service levels, how fees are determined and invoiced, who owns intellectual property rights and how the agreement ends. The content of the agreement must match actual practice, since differences between what is written in the agreement and the services actually provided are among the first issues examined in tax audits and in any disputes.

Determining the fee is also important with regard to whether transactions between group companies are at arm's length. The tax aspects of this issue and the necessary documentation should be handled in coordination with tax advisers.

Transfer of personal data

By the nature of their services, service centres process personal data of the customers and employees of group companies and share it with group companies abroad. Turkish data protection legislation makes transfers abroad subject to certain conditions. Transfers to countries without an adequacy decision must be based on one of the appropriate safeguards provided for by law, such as standard contractual clauses or binding corporate rules approved by the Board; where standard contractual clauses are used, they must also be notified to the Authority. Limited exceptions are also provided for occasional transfers.

Correctly determining the roles of the parties is also important here. Whether the Turkish company acts as a processor on behalf of the group companies or, as with regard to its own employees' data, as a controller determines which standard contractual clauses are to be used and which obligations fall on whom. The rules on transfers of personal data abroad are discussed in detail in the relevant Expertise article.

Employee data

Storing data on the Turkish company's own employees in the parent company's human resources systems also constitutes a transfer abroad. Informing employees, determining the legal basis for the transfer and providing the necessary safeguards should be addressed at the stage when the group structure is set up.

Liability and termination

Liability provisions are often neglected in intra-group services agreements; how the Turkish company's liability is determined in the event of a data breach, a service interruption or third-party claims is, however, important both for the Turkish company's managers and for the group. On termination of the agreement, the transfer of services, the return or deletion of data and the position of employees should also be regulated separately. Transferring the services to another group company or service provider may, depending on the circumstances, also raise the question of whether the rules on transfers of undertakings apply.

Management and signing authority

The managers of a Turkish company serving its parent are often group executives who are not based in Türkiye. In that case, it is important for the conduct of day-to-day business to appoint persons with powers of representation and signing authority in Türkiye, to define the scope of their powers clearly and to complete the necessary trade registry filings. Where commercial representatives with limited authority (ticari vekil) or other commercial auxiliaries are appointed, the special rules on internal directives must also be taken into account. Unclear signing authority can cause delays in dealings with banks and public authorities.

Conclusion

The legal framework of a Turkish company serving its parent stands on a sound footing when the intra-group services agreement, data transfers and management structure are considered together. Aligning the agreement with actual practice, ensuring appropriate safeguards and correctly determining roles for data transfers, clearly regulating liability and termination and clarifying signing authority in Türkiye strengthen the company's position in both tax audits and data protection inspections. General questions of data protection law are addressed on the page of the relevant practice area.