Supplier and Third-Party Policy

1. Purpose

To explain how we choose the companies that provide services to hangel, what data we share with them and how we monitor these relationships.

2. Scope

All suppliers of goods and services to the Association; in particular cloud, e-mail, messaging, AI, error monitoring, meeting and affiliate service providers that process personal data on hangel's behalf.

3. Principles

1. Only the data needed. A supplier receives only the data needed for the service.
2. Data protection safeguards. For suppliers that process personal data, the data protection terms (data processing agreement, region, sub-processors) are reviewed.
3. Shared responsibility. A supplier's security certifications do not transfer to hangel; hangel is responsible for its own configuration.
4. Ethical expectations. Suppliers are expected to behave in a way consistent with our position against bribery, forced labour and discrimination.
5. Openness. We name our main service providers and data locations in public texts.

4. Roles and responsibilities

• Board of Directors: approves significant supplier contracts.
• Technical lead: manages the technical and security settings of service providers.
• Super-admins: manage provider keys handled in the panel; keys are never shown in full on screen.

5. How it works at hangel today

Main types of service providers and examples:

• Some secrets are kept in Secret Manager; AI provider keys are kept in records that only the server can read.
• A software component list (SBOM) is generated and published with every release.

6. Not yet in place and our goals

• A single, up-to-date supplier list showing all suppliers, the data types they process, their regions and contract status (ISMS-09) has not yet been prepared.
• The existence of a data processing agreement and the basis for international transfer have not been checked supplier by supplier; the assessment under Article 9 of the KVKK is under review by our lawyer.
• No annual security and ethics assessment of suppliers is carried out.
• Supplier contracts contain no ethics or human rights clause.

7. How to raise a concern

Concerns or security issues about a supplier: info@hangel.org. Misconduct: kvkk@hangel.org (subject "Whistleblowing — Confidential").

8. Review

At least once a year and whenever a service provider is added or removed.

9. Related documents

Information Security Policy · Privacy Policy · Existing "Data Transfer and Hosting Statement", "Procurement Policy" and "Third-Party Oversight and Ethical Performance Statement"