Privacy Policy: Payroll Data, KVKK, GDPR

Company details marked in yellow will be updated once company registration is completed.

1. Scope

This Privacy Policy describes the personal data processing carried out by [ŞİRKET UNVANI] (“Turkuaz Payroll”, “we”) through the turkuazpayroll.com website and our payroll, social security (SGK), HR administration and related outsourcing services. Detailed information under KVKK Art. 10 on website and contact data is provided in our KVKK Privacy Notice.

This is a translation provided for convenience. In case of any discrepancy, the Turkish version prevails.

2. Our roles: controller and processor

Data	Our role	Data controller
Website visitors, quotation/contact requests, client and supplier contacts	Data controller	Turkuaz Payroll ([ŞİRKET UNVANI])
Payroll, social security and HR data of our clients’ employees	Data processor (KVKK) / Processor (GDPR)	The client (employer)

For employee data processed on behalf of our clients, the employer determines the purposes and means of processing; we process this data only under the employer’s written instructions and our contract.

3. Data processed in payroll services

Depending on the scope of services, employee data provided by our clients may include:

Identity data (name, Turkish or foreign ID number, date of birth, nationality),
Contact data (address, phone, e-mail),
Employment data (start and end dates, position, working time, timesheets, leave and overtime records),
Financial data (salary, benefits, deductions, bank account/IBAN, garnishment and alimony deductions),
Social security and tax data (insurance registration, premium days, incentive data, tax bases),
Special categories of data where required by law (e.g. disability status, sick-leave reports, trade-union membership).

Special categories of personal data are processed in accordance with KVKK Art. 6 and the adequate measures set by the Personal Data Protection Board, and only to the extent required by the service.

4. Our commitments as a processor

We sign a data processing agreement with each client meeting the requirements of KVKK Art. 12 and, where applicable, GDPR Art. 28. Under it:

We process personal data only on the client’s documented instructions and for the purposes set out in the contract; we never use it for our own purposes or sell it.
All staff with access are bound by confidentiality, and access is limited on a need-to-know basis.
Use of sub-processors (e.g. hosting, cloud storage) is notified to the client in advance, and the same data protection obligations are imposed on them by contract.
We apply appropriate technical and organisational security measures (see section 5).
We notify the client without undue delay on becoming aware of a personal data breach and provide the information needed for the client’s notifications to authorities and data subjects (72 hours under KVKK practice; GDPR Art. 33).
We assist the client in responding to data subject requests and in data protection impact assessments.
At the end of the contract, we return or securely delete the data at the client’s choice; records subject to statutory retention are kept only for that period with restricted access.
Under KVKK Art. 12(2), we are aware that as a processor we are jointly responsible with the client for taking data security measures.

5. Security measures

Our main measures to prevent unlawful processing of and access to personal data and to ensure its safekeeping:

Encryption in transit (HTTPS/TLS) and encrypted, access-controlled channels only for employee data; we do not accept unencrypted employee lists by e-mail,
Role-based access, least privilege, multi-factor authentication and access logging,
Segregation of payroll data per client, regular backups and protection of backups,
Confidentiality undertakings and regular KVKK/information security awareness training for staff,
Security assessment of service providers and contractual safeguards.

6. Website and contact data

Our website has no accounts or sign-up. When you fill in a form or write to us, we use the information to respond to your request. The site uses no analytics, advertising or social media tracking; only a functional cookie and local storage entry remembering your language choice are used (see our Cookie Policy).

The site is hosted on Cloudflare, Inc. (ABD) infrastructure. This provider briefly processes technical connection data such as IP address, browser information and request time to deliver the site securely. On your first visit to the home page, the country derived from your IP address and your browser language are used momentarily to redirect you to the right language; we do not store this information.

7. International transfers

As some of our service providers are located abroad, personal data may be transferred outside Türkiye. Such transfers are made under KVKK Art. 9; where there is no adequacy decision, with appropriate safeguards such as the standard contracts published by the Board and the required notifications. The sub-processors and countries where employee data processed on behalf of clients is handled are specified in the data processing agreement.

For clients that employ staff in Türkiye and are subject to the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”):

We act as a processor under GDPR Art. 28 and sign a data processing agreement (DPA) containing the minimum elements of Art. 28(3).
As there is no EU Commission adequacy decision for Türkiye, transfers from the EU/EEA to Türkiye rely on the Standard Contractual Clauses (SCCs) adopted by Commission Decision (EU) 2021/914, and we support transfer impact assessments where needed.
We keep records of processing under Art. 30(2), apply appropriate security under Art. 32 and notify the client of personal data breaches without undue delay under Art. 33(2).
We assist our clients in handling data subject rights under GDPR Arts. 15–22 (access, rectification, erasure, restriction, portability, objection).

For visitors from the EU/EEA who contact us, processing of the data for which we are the controller is based on GDPR Art. 6(1)(b) (pre-contractual steps), (c) (legal obligation) and (f) (legitimate interests). They may exercise their rights under GDPR Arts. 15–22 by writing to privacy@turkuazpayroll.com and may lodge a complaint with the supervisory authority in their country.

9. Retention

Data processed on behalf of clients is kept for the term of the contract and according to the client’s instructions. Retention periods for data we process as a controller are explained in our KVKK Privacy Notice.

10. Children

Our website and services are aimed at businesses; we do not knowingly collect personal data from anyone under 18. Data of minor employees (e.g. apprentices, interns) is processed only on the employer’s instructions and as required by law.

11. Your rights and contact

Your rights under KVKK Art. 11 and how to exercise them are explained in our KVKK Privacy Notice. For any privacy question, write to privacy@turkuazpayroll.com. If you are an employee of one of our clients and have a request about your payroll data, please contact your employer first.

12. Changes

We may update this policy to reflect changes in law or in our services. The current version is always published on this page with its “Last updated” date (October 25, 2026).