Aviso de privacidad KVKK
Este texto aún no se ha publicado en su idioma; se muestra la versión en English.
Versión 3 · publicada el 8 oct 2026
Personal Data Processing Notice
1. Purpose and Scope
1.1. This Personal Data Processing Notice (the "Notice") has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Principles and Procedures to be Followed in Fulfilment of the Obligation to Inform, in order to inform data subjects about the personal data processed by heyAtlas as data controller.
1.2. For each group of data subjects separately, the Notice explains the categories of personal data processed, the purposes of processing, the legal ground on which each purpose relies and the method of collection; it also explains the groups of recipients to whom the data may be transferred and the purposes of transfer, the retention periods and your rights under Article 11 KVKK. Supplementary information on the website, cookies, processing with artificial intelligence and security measures is set out in the Privacy and Cookie Policy (the "Privacy Policy").
1.3. Information is provided separately from the obtaining of explicit consent. The provision of this Notice to you, or your reading of it, does not mean that you approve of or give explicit consent to any processing. The limited processing activities for which explicit consent is sought are listed in Section 4.3; consent for these is requested through separate, subject-specific texts and a separate approval step.
1.4. If the Provider wishes to process personal data for a purpose other than those stated in this Notice, it separately informs the data subjects before that processing begins. Where personal data are not obtained from the data subject (for example, where a User is invited to the Platform by a Customer), information is provided within a reasonable time after the data are obtained, at the latest at the time of the first communication if the data are to be used for communication, and at the latest at the time of the first transfer if the data are to be transferred.
1.5. In this Notice, "Website" means the website at the domain www.heyatlas.net; "Platform" means the heyAtlas platform offered through the user panel on the same domain; "Customer" means a merchant or legal entity subscribing to the Platform; "User" means the natural persons to whom a Customer or a sales partner grants access to the Platform; "Master Agreement" means the heyAtlas Platform Services Agreement and Terms of Use; and "DPA" means the heyAtlas Data Processing Agreement.
2. Data Controller
2.1. The data controller is the following company, which owns the heyAtlas brand and operates the Platform (the "Provider" or "heyAtlas"):
| Item | Details |
|---|---|
| Trade name | «SAĞLAYICI UNVANI» |
| Address | «SAĞLAYICI ADRESİ» |
| MERSIS number | «MERSİS NO» |
| Tax office and number | «VERGİ DAİRESİ VE NO» |
| Registered e-mail (KEP) address | «KEP ADRESİ» |
| hello@heyatlas.net | |
| Website | www.heyatlas.net |
2.2. You may send your questions concerning this Notice to hello@heyatlas.net, to the KEP address in Section 2.1 or to the postal address. Users may also use the support request screen within the Platform. Applications under Article 11 KVKK are subject to the procedure in Section 9.
3. Cases in which the Provider is a Data Processor
3.1. For data that a Customer uploads to the Platform or processes through the Platform ("Customer Data"), the Customer is the data controller and the Provider is the data processor. The relationship concerning these data is governed by the DPA, and the Provider processes these data only on the Customer's instructions.
3.2. The main data subjects of Customer Data are: the Customer's customers, carriers, agents, suppliers and other business contacts and their employees; and persons who send e-mails or messages to the Customer and persons to whom messages are sent on behalf of the Customer through the Platform. Contact cards of these persons (name, e-mail, telephone, title, tax number), e-mails and attachments, Microsoft Teams messages, quotation, booking and shipment records, and contact details automatically extracted from e-mail signatures constitute Customer Data.
3.3. Data subjects whose data form part of Customer Data should direct their rights under Article 11 KVKK primarily to the relevant Customer as data controller. Any such application received by the Provider is forwarded to the relevant Customer without undue delay, and the Provider assists the Customer to the extent of reasonable technical means in accordance with the DPA.
3.4. Informing these persons and, where necessary, obtaining their explicit consent, including in respect of the processing of Customer Data with artificial intelligence and its transfer abroad, is the obligation of the Customer as data controller. User account data are data for which the Provider is the data controller to the extent that they are processed for account management, authentication, security, contract acceptance and invoicing (Section 5.4), and are Customer Data to the extent that they are used in workflows (approvals, task assignment, sender details).
4. General Principles, Legal Grounds and Explicit Consent
4.1. In accordance with Article 4 KVKK, personal data are processed lawfully and fairly; accurately and, where necessary, kept up to date; for specified, explicit and legitimate purposes; in a manner that is relevant, limited and proportionate to those purposes; and for as long as necessary.
4.2. In the tables in Section 5, legal grounds are indicated by the sub-paragraph letters of Article 5(2) KVKK: (a) being expressly provided for by law; (c) the processing of personal data belonging to the parties to a contract being necessary, provided that it is directly related to the establishment or performance of that contract; (ç) being necessary for the data controller to comply with its legal obligation; (d) the data having been made public by the data subject; (e) data processing being necessary for the establishment, exercise or protection of a right; (f) data processing being necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed. References to sub-paragraph (c) are limited to cases in which the data subject is a party to the contract, in particular where the Customer, sales partner or supplier is a sole proprietorship; for authorised representatives and employees acting on behalf of a legal entity, the same processing relies on sub-paragraph (f).
4.3. Explicit consent (Article 5(1) KVKK) is sought only for the following processing: (i) the transfer of demo request data to service providers abroad, as an additional basis alongside the other mechanisms under Article 9 KVKK, through the Explicit Consent Statement for Processing Personal Data in Connection with a Demo Request (the "Demo Consent Statement"); (ii) the sending of commercial electronic messages and the transfer of the contact data used for that purpose to service providers abroad, through the optional Commercial Electronic Message Consent (the "Commercial Message Consent"); and (iii) analytics or advertising cookies, should they be used in future, through a separate consent step. No other processing relies on explicit consent.
4.4. You may withdraw your explicit consent at any time by notifying hello@heyatlas.net and, in the case of commercial messages, also by opting out through the message. Withdrawal has effect for the future. Since evaluating a demo request requires the use of service providers abroad, where no other Article 9 KVKK mechanism exists for that transfer, not giving or withdrawing consent may prevent the request from being processed.
4.5. The Provider does not intend to collect special categories of personal data listed in Article 6 KVKK; such data should not be entered in free-text fields or correspondence. If data marked as mandatory in forms are not provided, the relevant request cannot be processed; all other data are optional.
5. Groups of Data Subjects
This Section sets out, separately for each group of data subjects, the method of collection and, for each purpose of processing, the categories of data and the legal grounds. Data categories are stated on the basis of the category names used in the Data Controllers' Registry, with their contents in brackets. Unless stated otherwise, data are collected electronically by fully or partly automated means.
5.1. Website Visitors
5.1.1. Method of collection: by automated means through your browser when you visit the Website; through the records of the server, security and content delivery infrastructure and through cookies.
5.1.2. Purposes of processing, data categories and legal grounds:
| Purpose | Data categories | Legal ground |
|---|---|---|
| Delivering the Website and remembering the language preference | Transaction Security (IP address, browser and device information, time of request, page requested); language preference | (f) |
| Ensuring information security; detecting and blocking bot, attack and abusive traffic | Transaction Security (IP address, browser characteristics, bot verification results) | (f) |
| Responding to requests of competent public authorities and judicial authorities based on legislation | Transaction Security | (ç) |
5.2. Demo Requesters
5.2.1. Method of collection: directly from you through the demo request form and appointment selection on the Website; the IP address and browser information automatically when the form is submitted; and, for the demo meeting and subsequent correspondence, through e-mail, telephone and online meeting tools. The mandatory fields are name and surname and business e-mail.
5.2.2. Purposes of processing, data categories and legal grounds:
| Purpose | Data categories | Legal ground |
|---|---|---|
| Receiving and evaluating the demo request and contacting you | Identity (name and surname); Contact (business e-mail, telephone); Professional Experience (company name, team size); Customer Transaction (message, language) | (c); (f) |
| Creating the appointment and sending the meeting invitation; assigning the request to an account manager; conducting the demo meeting; preparing a quotation at your request | Identity; Contact; Customer Transaction (selected appointment time, notes on the meeting) | (c); (f) |
| Preventing abuse of the form (hidden honeypot field, daily request limit per IP address) | Transaction Security (IP address, browser information) | (f) |
| Evidencing the consent given under the Demo Consent Statement | Legal Transaction (version of the approved text, time of approval) | (e) |
| Transferring the request data to hosting, database, e-mail and calendar service providers abroad | The data in this table | Mechanisms under Article 9 KVKK (Section 6.3); explicit consent as an additional basis (Section 4.3) |
5.3. Persons Giving Commercial Electronic Message Consent
5.3.1. Method of collection: directly from you, when you tick the consent box offered as optional and unticked in the demo form on the Website; opt-out notices through the opt-out link in an e-mail, the opt-out instruction in an SMS, an oral notice during a voice call, a reply to a message, e-mail or the Message Management System ("İYS").
5.3.2. Purposes of processing, data categories and legal grounds:
| Purpose | Data categories | Legal ground |
|---|---|---|
| Sending commercial electronic messages containing product, service, campaign, event, newsletter and survey content by e-mail, SMS and voice call | Identity (name and surname); Contact (e-mail address and telephone number for which consent was given) | Explicit consent (Article 5(1) KVKK), together with the consent given under Article 6 of Law No. 6563 |
| Keeping consent and opt-out records, registering them in the İYS where required by legislation and processing opt-out notices within 3 business days | Contact; Marketing (version of the consent text, time of consent and opt-out, channel) | (ç) |
| Transferring contact data to e-mail, hosting and database service providers abroad used for sending messages | Contact | Mechanisms under Article 9 KVKK (Section 6.3); explicit consent as an additional basis (Section 4.3) |
| Evidencing the existence of consent and protecting rights in disputes | Marketing; Legal Transaction | (e) |
5.3.3. The consent is optional and the demo request does not depend on it. You may withdraw the consent at any time, without giving reasons and free of charge; message sending is then stopped, while the opt-out record is retained for evidentiary purposes.
5.4. Platform Users (Authorised Representatives and Employees of Customers)
5.4.1. Method of collection: from the Customer, when the Customer's company administrator invites you to the Platform, or from the Provider or the sales partner, when the account is opened by them; directly from you, when you activate your account and use the Platform; automatically through system records and cookies; and, where a Microsoft 365 or Google account is connected to the Platform, from those services (account identifier, e-mail address and access authorisation information).
5.4.2. Purposes of processing, data categories and legal grounds:
| Purpose | Data categories | Legal ground |
|---|---|---|
| Opening the User account, sending the invitation, authentication, multi-factor authentication and session management | Identity (name and surname); Contact (e-mail); Professional Experience (Customer, role and permissions); Transaction Security (username, password hash, multi-factor authentication records, session records, IP address, device and browser information) | (c); (f) |
| Providing the Platform to the Customer under the Master Agreement and the Supplemental Terms; organising access according to roles and permissions; applying language and notification preferences | Identity; Contact; Professional Experience; Customer Transaction (transaction records on the Platform, preferences) | (c); (f) |
| Recording and evidencing acceptance of the Master Agreement and the Supplemental Terms on behalf of the Customer | Legal Transaction (accepted text and its version, timestamp); Identity; Transaction Security (IP address, device and browser information) | (c); (e) |
| Information security; keeping access and event records; detecting unauthorised access and abuse; monitoring through an audit trail the access of Provider personnel for support and security purposes | Transaction Security (login and security events, activity records, access audit records) | (ç) (Article 12 KVKK); (f) |
| Recording credit consumption, the spending cap and transactions forming the basis for invoicing | Customer Transaction (User initiating the transaction, transaction type, time and credit amount) | (c); (ç); (f) |
| Sending service notices concerning security, maintenance, releases and changes to contracts, prices and balances | Identity; Contact | (c); (f) |
| Generating anonymous or aggregated statistics on the use of Platform functions and developing the Platform on the basis of those statistics | Customer Transaction; Transaction Security | (f) |
| Protecting rights in disputes; responding to requests of competent authorities | The data in this table | (ç); (e) |
5.4.3. The messages you write to the artificial intelligence assistant on the Platform and the content processed in workflows constitute Customer Data as regards their business content; this content is processed on behalf of the Customer under Section 3 and is transmitted to the artificial intelligence service provider (OpenAI, USA) to generate replies. Details are set out in Section 6 of the Privacy Policy.
5.5. Authorised Representatives and Employees of Sales Partners (Resellers)
5.5.1. Method of collection: from the reseller or directly from you when the reseller account is opened by the Provider; automatically through system records and cookies during use of the reseller panel; and through contracts, orders, payments and correspondence.
5.5.2. Purposes of processing, data categories and legal grounds:
| Purpose | Data categories | Legal ground |
|---|---|---|
| Establishing the reseller relationship; establishing and performing the heyAtlas Sales Partner Agreement and the Partner Order Terms | Identity; Contact; Professional Experience (role at the reseller); Legal Transaction (contract and acceptance records) | (c); (e); (f) |
| Opening reseller panel accounts, authentication and security | Transaction Security (username, password hash, multi-factor authentication and session records, IP address, device information) | (ç); (f) |
| Conducting orders, quotations, the current account, invoicing and collection | Finance (current account, payment and bank transactions, invoice information; for sole proprietorships, tax identification number); Customer Transaction (orders and quotations) | (a); (c); (ç) |
| Protecting rights in disputes; responding to requests of competent authorities | The data in this table | (ç); (e) |
5.6. Suppliers and Business Contacts
5.6.1. This group covers the authorised representatives and employees of suppliers from which the Provider procures goods and services, of organisations with which it cooperates and of companies with which it holds business discussions. Method of collection: directly from you or from the organisation you work for; through contracts, quotations, invoices, e-mail, telephone and meetings; and from corporate websites and professional networking platforms made public by you or your organisation.
5.6.2. Purposes of processing, data categories and legal grounds:
| Purpose | Data categories | Legal ground |
|---|---|---|
| Conducting procurement processes; establishing and performing contracts | Identity; Contact; Professional Experience (organisation, title); Legal Transaction (contracts and correspondence) | (c); (f) |
| Making payments; keeping accounting and tax records | Finance (invoice, bank account information; for sole proprietorships, tax identification number) | (a); (c); (ç) |
| Communication for the purpose of establishing and maintaining a business relationship | Identity; Contact; Professional Experience | (f); with respect to data obtained from public sources, and limited to the purpose of publication, (d) |
| Protecting rights in disputes; responding to requests of competent authorities | The data in this table | (ç); (e) |
5.7. Persons Submitting Support Requests
5.7.1. Method of collection: directly from you through the support request screen within the Platform, e-mail and support correspondence; the technical records necessary to resolve the request automatically from the Platform.
5.7.2. Purposes of processing, data categories and legal grounds:
| Purpose | Data categories | Legal ground |
|---|---|---|
| Recording, responding to and resolving the support request; communicating with you | Identity; Contact; Customer Transaction (content of the request, attachments, correspondence, request number and status) | (c); (f) |
| Identifying and remedying the error; where necessary, limited and audit-logged access by authorised personnel to the Customer account | Transaction Security (relevant system and error records, access audit records) | (f) |
| Measuring request resolution times and outcomes; improving support processes | Customer Transaction | (f) |
| Evidencing requests and protecting rights | Customer Transaction; Legal Transaction | (e) |
5.7.3. If Customer Data are shared in a support request, those data are processed on behalf of the Customer under Section 3.
5.8. Users of the Website Chat Assistant
5.8.1. The chat assistant on the Website is available only where the Provider makes it available, and its use is optional. Method of collection: the messages you write to the assistant directly from you; the anonymous session identifier, page path, language and time information and the bot verification result automatically. Your IP address may be used momentarily for access control but is not written to the conversation records.
5.8.2. Purposes of processing, data categories and legal grounds:
| Purpose | Data categories | Legal ground |
|---|---|---|
| Answering your questions with the help of artificial intelligence | Customer Transaction (your messages and the assistant's replies, page path, language); Transaction Security (anonymous session identifier) | (f) |
| Preventing abuse, bot traffic and excessive use; applying message and cost limits | Transaction Security (anonymous session identifier, bot verification result, IP address used momentarily) | (f) |
| Reviewing the accuracy and adequacy of replies; improving the assistant's knowledge sources and instructions | Customer Transaction | (f) |
| Transferring messages to the artificial intelligence service provider (OpenAI, USA) to generate replies | Customer Transaction | Mechanisms under Article 9 KVKK (Section 6.3) |
5.8.3. Please do not enter your name, contact details, special categories of personal data or personal data of third parties in the assistant.
6. Transfer of Personal Data
6.1. The Provider may transfer personal data, limited to the purposes stated in Section 5 and in accordance with Articles 8 and 9 KVKK, to the following groups of recipients:
| Recipient group | Purpose of transfer | Legal ground |
|---|---|---|
| Competent public authorities and institutions, judicial authorities and enforcement offices | Responding to requests for information and documents arising from legislation; resolving disputes | (ç); (e) |
| Advisers providing legal, financial advisory and independent audit services; e-invoice and e-archive service providers | Legal advice; fulfilling accounting, tax and audit obligations; issuing invoices | (a); (ç); (e); (f) |
| Banks and payment institutions | Conducting payment and collection transactions | (c); (ç) |
| Sales partners (resellers) | For Customers acquired through a sales partner or assigned to a sales partner by the Provider, sharing order, invoicing, subscription management and usage summary information and, for these purposes, the Customer's company contact and invoicing contact details (the company e-mail address and telephone number; the name and surname of the contact person; the name and surname, e-mail address and telephone number of the invoicing contact person; the invoicing e-mail address); the Customer's business content is not shared | (c); (f) |
| The transferee, in the event of a transfer of the business or of the contract | Continuing the service and contractual relationships | (e); (f) |
| Service providers (sub-processors, Section 6.2) | Obtaining hosting, database, backup, e-mail, messaging, artificial intelligence and security services | The legal ground of the relevant processing purpose; for transfers abroad, Section 6.3 |
6.2. As at the publication date of this Notice, the service providers (sub-processors) used by the Provider are:
| Service provider | Service | Place of processing |
|---|---|---|
| Neon (PostgreSQL) | Primary database | EU (Frankfurt, Germany) |
| Vercel | Web application hosting, file storage | Application functions EU (Frankfurt, Germany); company headquarters USA |
| Hetzner Online | Application server; storage of encrypted backups | Germany (Nuremberg); backups Finland (Helsinki) |
| OpenAI | Artificial intelligence inference | USA |
| Microsoft (Teams, Outlook, Graph) | Messaging channel and e-mail | EU |
| Amazon Web Services (SES) | Outbound e-mail delivery | EU (Frankfurt, Germany) |
| Google (Workspace API) | E-mail and document (Drive, Sheets) connection, if connected by the Customer | Global |
| Cloudflare | Secure tunnel, content delivery, bot protection | Global |
6.3. From the perspective of Türkiye, all of these service providers are located abroad. Data are hosted primarily in data centres in the European Union (Germany and Finland). In the following flows, data may also be transferred outside the EU: in artificial intelligence processing, to the USA (OpenAI); in Cloudflare and Google services, to countries in which those providers' global infrastructure is located. In addition, some of the service providers are headquartered in the USA; owing to their support, maintenance and security processes or the legislation to which they are subject, data hosted in the EU may be accessed from outside the EU. Transfers abroad are carried out in accordance with Article 9 KVKK: on the basis of an adequacy decision where one exists; where none exists, on the basis of one of the appropriate safeguards listed in Article 9(4) KVKK, in particular the standard contracts announced by the Personal Data Protection Board (the "Board"); where neither exists, only for transfers of an incidental nature, on the basis of one of the cases listed in Article 9(6) KVKK; and in every case subject to one of the processing conditions in Article 5 or Article 6 KVKK being met. Explicit consent applies to the transfers listed in Section 4.3 and to the extent that the transfer cannot rely on another Article 9 KVKK mechanism. Information on the transfer mechanism applied may be requested through the channels in Section 2.2.
6.4. Service providers process personal data on behalf of the Provider and in accordance with the Provider's instructions. The Provider does not sell or rent personal data and does not make them available to third parties for their own marketing purposes. Customers can access the current list on the Settings › Data page of the Platform; other data subjects may request the list from hello@heyatlas.net.
7. Retention Periods and Destruction
7.1. Personal data are retained for the period provided for in the relevant legislation or for as long as necessary for the purpose for which they are processed. When the period expires, the data are deleted, destroyed or anonymised in accordance with Article 7 KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
7.2. The main retention periods are set out below. For records constituting Customer Data, different periods announced according to the Customer's plan and the Customer's settings on the Platform are reserved.
| Data | Retention period |
|---|---|
| Conversation records and attachments on the Platform | 365 days |
| Inbound message inbox records on the Platform | 180 days |
| Artificial intelligence call and tool run records | 180 days |
| Authentication events (login and multi-factor authentication) | 180 days |
| Platform activity records | 730 days; anonymised thereafter |
| Credit, order and invoice records | 10 years from the end of the calendar year in which the record was created |
| Contract acceptance records | 10 years from the end of the contractual relationship |
| Support requests | 3 years; anonymised thereafter |
| Website chat assistant conversations | 180 days |
| Demo request data | Up to 2 years from the date of the request |
| Commercial message consent and opt-out records | For as long as the consent is valid; after the consent ends, for the evidentiary period provided for in legislation |
| User account data | For as long as the account is active and the contractual relationship with the Customer continues; on termination of the contractual relationship, in accordance with Section 7.3; authentication, activity and acceptance records are subject to their own periods in this table |
| Contracts and correspondence relating to supplier and sales partner relationships | 10 years from the end of the relationship |
| Cookies | The periods in Section 9.2 of the Privacy Policy |
7.3. When the contractual relationship ends, the Customer may export its data within 30 days from termination. Customer Data and User account data are deleted or anonymised within 90 days from termination, subject to statutory retention obligations. Company records are not deleted but are set to inactive status; personal data contained in these records, in particular the identity and contact details of sole proprietorships, are deleted or anonymised when the statutory retention periods expire.
7.4. Backups are taken every night in encrypted form and retained in 3-day and 4-week cycles. Deleted data leave the backups in the ordinary cycle and in any event within 60 days. Backups are used only for restoration in the event of data loss or disaster.
8. Rights of the Data Subject
8.1. Under Article 11 KVKK, you have the following rights concerning yourself by applying to the Provider:
- (a) to learn whether your personal data are processed;
- (b) to request information if your personal data have been processed;
- (c) to learn the purpose of processing of your personal data and whether they are used in accordance with that purpose;
- (ç) to know the third parties to whom your personal data are transferred in Türkiye or abroad;
- (d) to request rectification of your personal data if they are incomplete or inaccurately processed;
- (e) to request deletion or destruction of your personal data within the framework of the conditions set out in Article 7 KVKK;
- (f) to request that the actions taken under sub-paragraphs (d) and (e) be notified to the third parties to whom your personal data have been transferred;
- (g) to object to a result against you arising from the analysis of the processed data exclusively by automated systems;
- (ğ) to claim compensation for damage if you suffer damage due to unlawful processing of your personal data.
8.2. In the cases listed in Article 28(2) KVKK, the rights other than the right to claim compensation for damage cannot be asserted.
8.3. Rights concerning Customer Data are exercised primarily against the Customer as data controller in accordance with Section 3.3.
9. Application Procedure
9.1. In accordance with the Communiqué on the Principles and Procedures for the Request to Data Controller, you may submit your application by one of the following means:
- in writing and bearing a wet signature, by hand delivery, by post or through a notary public to the address in Section 2.1;
- from your registered e-mail (KEP) address to the KEP address in Section 2.1;
- signed with a secure electronic signature or mobile signature, to hello@heyatlas.net;
- from the e-mail address that you have previously notified to the Provider and that is registered in the Provider's system (including the address notified in a User account, a demo request or a commercial message consent), to hello@heyatlas.net.
9.2. The application must contain the following information: name, surname and, if the application is in writing, signature; for citizens of the Republic of Türkiye, the Turkish identity number, and for foreign nationals, nationality, passport number or, if any, identity number; residential or business address for notifications; if any, e-mail address, telephone and fax number for notifications; and the subject of the request. Information and documents relating to the request are attached to the application.
9.3. If the application is made by another person on behalf of the data subject, a document evidencing that person's authority of representation must be attached to the application. To prevent the disclosure of personal data to unauthorised persons, the Provider may request additional information to verify the identity of the applicant.
9.4. Your application is concluded free of charge as soon as possible according to the nature of the request and within 30 days at the latest; the response is given in writing or electronically. Where the action entails an additional cost, the fee in the tariff determined by the Board may be charged: no fee is charged for written responses of up to ten pages, and a processing fee of 1 Turkish lira may be charged for each page above ten pages; if the response is provided on a recording medium such as a CD or flash drive, the fee may not exceed the cost of the recording medium. If the application results from an error of the Provider, any fee charged is refunded.
9.5. If your application is rejected, you find the response insufficient or no response is given in time, you may lodge a complaint with the Board under Article 14 KVKK within 30 days from the date on which you learn of the response and in any event within 60 days from the date of application. With respect to the rights under Article 11 KVKK, a complaint cannot be filed before the remedy of applying to the Provider has been exhausted.
10. Changes and Effectiveness
10.1. The Provider may update this Notice to reflect changes in its processing activities, service providers or legislation. A new version is published on the Website with its version number and publication date. Where the purpose of processing changes, Section 1.4 applies.
10.2. This version takes effect on the publication date stated below: 8 Oct 2026
Version: 3 · Published: 8 Oct 2026