KVKK privacy notice

Under Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, we inform you about the following matters regarding the processing of your personal data.

1. Identity of the data controller

Company name: ÖzgürKod Bilgi Teknolojileri
Address: Muğla, Türkiye
VERBİS registration no.: [Registration in progress — to be updated]
Contact: [email protected]

2. Categories of personal data processed

Category	Data types
Identity information	Name, surname, date of birth, gender
Contact information	Email, phone, address
Customer transactions	Orders, invoices, subscriptions, payment history
Transaction security	IP address, session logs, MFA information, password hash
Marketing	Newsletter sign-ups, cookie preferences, campaign interactions
Customer data (as processor)	End-customer PII uploaded by CRM customers — here we act as a data processor

3. Purposes of processing

• Membership and account management, authentication
• Provision of the CRM service, subscription and billing
• Provision of customer support services
• Compliance with legal obligations (TCC, Tax Procedure Law, KVKK)
• Marketing and promotional activities, if you have given explicit consent
• Profiling and automated recommendation systems, if you have given explicit consent
• System security and fraud prevention
• Statistical analysis and improvement of service quality

4. Legal basis for processing (KVKK Art. 5 and Art. 6)

• Establishment or performance of a contract (Art. 5/2-c): Account creation, subscription, payment.
• Expressly provided for by law (Art. 5/2-a): Invoices, tax obligations (10-year retention).
• Compliance with a legal obligation (Art. 5/2-ç): KVKK Art. 12 administrative and technical measures, audits.
• Legitimate interest (Art. 5/2-f): System security, fraud detection, service improvement.
• Explicit consent (Art. 5/1): Marketing communications, cookie-based advertising, profiling, international data transfers.
• Special categories of personal data (Art. 6): Health data (e.g. in health and clinic modules) is processed only with explicit consent.

5. Collection methods

Your personal data is collected electronically, automatically or partly automatically, through our website, mobile app, customer support channels (email, phone, live chat, WhatsApp), API integrations (Shopify, Meta, Telegram, Google), our business partners and our social media accounts.

6. Transfers

Your personal data may be transferred to the following groups to fulfill our legal obligations, provide our services and within the scope of our legitimate interest:

• Authorized public institutions: Upon a court or prosecutor request or where legally required.
• Our service providers (data processors): Cloud infrastructure (servers, backup), email/SMS delivery, payment processor.
• International transfers (KVKK Art. 9): With your explicit consent or under Standard Contractual Clauses / an adequacy decision: Google LLC (USA, Analytics, Ads), Meta Platforms Inc. (USA, Pixel), OpenAI (USA, AI features), Shopify Inc. (Canada/USA), WhatsApp Business Cloud (Meta), Telegram (UAE), Daily.co (USA, video).

7. Retention periods

Data type	Deadline	Legal basis
Membership information	Account closure + 30 days	End of contract
Invoice/payment	10 years	TCC Art. 82, Tax Procedure Law Art. 253
Access/Audit logs	12 months	KVKK Art. 12 measure
Marketing permissions	Until withdrawn + 10 years for proof	Burden of proof
Web chat sessions	2 years (then anonymized)	Legitimate interest

8. Your rights under Article 11 of the KVKK

As the data controller, you have the following rights under KVKK Art. 11:

1. Find out whether your personal data is being processed
2. To request information if your data has been processed
3. To learn the purpose of processing and whether the data is used in line with that purpose
4. To know the third parties to whom your data is transferred at home or abroad
5. To request correction if data is processed incompletely or incorrectly
6. To request deletion or destruction if the conditions are met
7. To request notification of the above actions to the parties to whom your data has been transferred
8. To object to a result that is against you arising from analysis by automated systems
9. To claim compensation if you suffer damage due to unlawful processing

9. Application methods

To exercise your rights:

• Online: Data subject application portal (automatic request number and status tracking)
• Email: [email protected] (with an identity verification document)
• Post: ÖzgürKod Bilgi Teknolojileri – KVKK application unit, [address]
• Notary: By written notary notice

Your applications are answered free of charge within 30 days at the latest from the date they reach us (Communiqué on the Procedures and Principles of Application to the Data Controller, Art. 7).

10. Withdrawal of explicit consent

You can withdraw your consent to our data processing based on explicit consent at any time. This does not affect the legal validity of processing carried out up to the date of withdrawal. To withdraw your consent, you can use the consent management panel.

11. Policy updates

This privacy notice may be updated in line with changes in legal regulations or changes in the scope of our services. Significant changes are announced to you by e-mail and through an in-site notification.