KVKK Privacy Notice

1. Data controller

[ŞİRKET UNVANI] (the “Company”, “we”), operating under the Turkuaz Payroll brand, acts as the data controller for the personal data described below, in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for the Fulfilment of the Obligation to Inform.

This is a translation provided for convenience. In case of any discrepancy, the Turkish version prevails.

2. Scope of this notice and our role

This notice covers the personal data of visitors to our website (turkuazpayroll.com), people who request quotes or information, people who write to us by e-mail or other channels, and authorised persons/employees of our clients and suppliers. We are the data controller for this data.

When providing payroll, social security (SGK) and related services, we process personal data of our clients’ (employers’) employees on behalf of and under the instructions of the client. The employer is the data controller for that data, and we act as a data processor within the meaning of KVKK Art. 3. The employer is responsible for informing its employees, and employees should address their KVKK Art. 11 requests to their employer first. We forward any such request we receive to the employer without delay and assist in responding. See our Privacy Policy for details.

3. Categories of personal data

• Identity: first name, last name.
• Contact: e-mail address, phone number, company name, title/position.
• Client transaction: content of requests and messages, employee headcount range, services of interest, correspondence history, information on quotation and contract processes.
• Transaction security: technical logs such as IP address, browser and device information, date and time of access (kept by our hosting and security infrastructure).
• Preferences: the language you manually select on the site (see our Cookie Policy).

Please do not share special categories of personal data (such as health or trade-union membership) or personal data of your employees through our contact channels. Once a service relationship is established, employee data is received only through the secure channels defined in the contract.

4. Purposes of processing

• Receiving, assessing and responding to your quotation, information and meeting requests,
• Conducting pre-contract discussions, concluding and performing contracts, managing client relationships,
• Carrying out communication activities and following up your requests,
• Operating the website, remembering your language preference, ensuring information and system security and preventing misuse,
• Fulfilling legal obligations and responding to requests from competent authorities,
• Establishing, exercising and defending legal claims.

5. Legal grounds

Your personal data is processed on the following legal grounds listed in KVKK Art. 5(2):

• (c) processing is directly related to the conclusion or performance of a contract (quotation requests, contracting, client relationship),
• (ç) processing is necessary for compliance with a legal obligation of the controller (e.g. retention duties under tax and commercial law, requests from authorities),
• (e) processing is necessary for the establishment, exercise or protection of a right,
• (f) processing is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms (e.g. website and information security, following up requests, remembering your language preference).

We currently do not send commercial electronic messages (marketing e-mails/SMS). Should we do so in the future, this will be based solely on your explicit consent under KVKK Art. 5(1) and your approval under Law No. 6563.

6. Method of collection

Your personal data is collected electronically, by partly or fully automated means, when you provide it through forms on our website, e-mail, phone or messaging apps, and during your use of our website through our hosting/security infrastructure and cookie and local storage technologies.

7. Transfers of personal data

Your personal data may be transferred, limited to the purposes above and in compliance with KVKK Arts. 8 and 9, to the following recipients:

• Competent public authorities and courts: where required by law or upon request,
• Professional advisers: legal, accounting and audit advisers (bound by confidentiality),
• Business partners: our contracted certified public accountant (SMMM) partner for submitting tax returns, once a client relationship is established,
• Service providers (processors): our website hosting, content delivery and security provider Cloudflare, Inc. (ABD) and e-mail infrastructure providers.

As some of these providers operate servers outside Türkiye, your data may be transferred abroad. Such transfers are made under KVKK Art. 9; where there is no adequacy decision, on the basis of appropriate safeguards such as the standard contracts published by the Personal Data Protection Board, with the required notifications.

8. Retention

Your personal data is kept for as long as necessary for the purpose of processing and for the retention periods required by applicable law. Quotation and contact requests that do not result in a contract are kept for at most 2 years after the request is closed; records related to a contractual relationship are kept for the periods required by law (e.g. the Turkish Commercial Code and the Tax Procedure Law).

At the end of the retention period, data is erased, destroyed or anonymised in the first periodic destruction run under the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

9. Your rights under KVKK Art. 11

You have the right to:

• (a) learn whether your personal data is processed,
• (b) request information if it has been processed,
• (c) learn the purpose of processing and whether data is used in line with that purpose,
• (ç) know the third parties in Türkiye or abroad to whom data is transferred,
• (d) request rectification if data is incomplete or inaccurate,
• (e) request erasure or destruction under the conditions of KVKK Art. 7,
• (f) request that operations under (d) and (e) be notified to third parties to whom data was transferred,
• (g) object to a result to your detriment arising from analysis exclusively by automated systems,
• (ğ) claim compensation for damage arising from unlawful processing.

10. How to submit a request

In line with the Communiqué on the Procedures and Principles of Applications to the Data Controller, you can submit your request in writing to [ŞİRKET MERKEZ ADRESİ], by registered electronic mail (KEP) to [KEP ADRESİ], with a secure electronic or mobile signature, or from an e-mail address you have previously provided to us and that is registered in our systems to privacy@turkuazpayroll.com.

Your request must include your name, surname and signature (if in writing); Turkish ID number for Turkish citizens or nationality and passport number (or ID number, if any) for foreigners; your residential or business address for notifications; your e-mail address and phone number, if any; and the subject of your request.

Requests are concluded free of charge as soon as possible and within 30 days at the latest. If the action requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your request is rejected, the answer is insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board under KVKK Art. 14.