KVKK Information Notice

1. Identity of the Data Controller

Pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”), the following legal entity discharges its information obligation as data controller with respect to the processing of your personal data:

• Company: Partnerfy Bilgi Teknolojileri ve Pazarlama Sanayi Ticaret Ltd. Şti.
• Address: Orta Mah. Kavaklar Cad. No:15 Ofisada Plaza D:104, Adapazarı, Sakarya, TÜRKİYE
• Phone: +90 850 259 30 04
• E-mail: [email protected]
• MERSIS No.: [MERSIS-NO-PLACEHOLDER]
• Trade Registry No.: [TRADE-REGISTRY-PLACEHOLDER]
• Tax Office / No.: [TAX-OFFICE] / [TAX-NUMBER]

For data subjects domiciled in EU member states, the German group company Partnerfy Informations- und Marketingtechnologien GmbH (Emmy-Noether-Str. 10, 76131 Karlsruhe, Germany) acts as controller under the GDPR. This Information Notice governs the data-processing activities performed in Türkiye.

2. Categories of Personal Data Processed

Under this Information Notice, the following categories of personal data – collected from the data subject or other sources – are processed:

• Identity: first name, surname, date of birth (if required for a contract), identification/passport details (only in cases of legal obligation).
• Contact: e-mail address, phone number, postal address, corporate role, social-media handle.
• Customer transactions: contract number, order data, proposal records, request and complaint records, payment statements.
• Finance: bank account information, invoice records, payment method, collection details.
• Technical / transaction security: IP address, log records, session information, cookie identifiers, MFA records.
• Marketing: newsletter status, marketing consent records, commercial electronic-message preferences, survey responses.
• Audio-visual records: meeting recordings taken upon request (with prior notice).
• Professional experience: for candidate applications, CV, references, education and certification information.

Sensitive (special-category) personal data is, as a rule, not processed; in exceptional cases it may be processed only with explicit consent or where the conditions of Article 6 KVKK are met.

3. Purposes of Processing

Your personal data is processed for the following purposes, within the scope of Partnerfy’s commercial activities, services and legal obligations:

• Managing customer proposal, contract and order processes;
• Delivering, operating and tracking services (software development, performance marketing, cloud infrastructure, etc.);
• Keeping invoicing, collection and accounting records;
• Handling requests, complaints, applications and satisfaction processes;
• Maintaining communications (telephone, e-mail, meeting, online conference);
• Carrying out marketing communications, newsletter dispatch and event invitations where explicit consent is given;
• Operating the website securely and efficiently and improving user experience;
• Preventing information-security breaches and fraud;
• Statutory reporting, tax audits and responses to judicial / administrative requests;
• Candidate assessment and human-resources activities;
• Internal audit, risk management, quality processes;
• Strategic planning, reporting and statistical analysis.

4. Legal Basis

Processing activities rely on the legal grounds set out in Articles 5 and 6 of the KVKK:

• Article 5/2-a: express provision under the law (e.g. Tax Procedure Law, Turkish Commercial Code, E-Commerce Law, KVKK).
• Article 5/2-c: directly related to the conclusion or performance of a contract (proposal preparation, contract signing, invoicing).
• Article 5/2-d: data made public by the data subject (e.g. publicly available contact information on LinkedIn).
• Article 5/2-e: necessary for the establishment, exercise or protection of a right (dispute management).
• Article 5/2-f: necessary for the legitimate interests of the Company (network and information security, fraud prevention, internal audit).
• Article 5/1: explicit consent (marketing communications, profiling, cookie-based targeting).
• Article 6/3: processing of special-category data only on the basis of explicit consent or the exceptions provided by law.

The above grounds may apply individually or jointly, depending on the nature and purpose of each processing activity.

5. Recipients

Your personal data may be transferred to the following categories of recipients, for the stated purposes and subject to appropriate technical and organisational safeguards:

• Cloud infrastructure providers: AWS, Google Cloud, Microsoft Azure, Hetzner – for storage, backup and hosting.
• Business partners and suppliers: vendors providing software, design, advisory or marketing services in your project.
• Accountants and independent auditors: for accounting, reporting and audit obligations.
• Legal counsel: for legal proceedings, contract management and dispute tracking.
• Banks and payment services: for collection, payment and invoicing operations.
• Tax office, Revenue Administration and other public authorities: for legal obligations.
• Competent judicial and administrative authorities: where required in judicial proceedings or administrative investigations.
• E-invoice / e-archive integrators: for statutory document-issuance processes.

Transfers are carried out pursuant to Article 8 of the KVKK and an additional legal basis legitimising the transfer.

6. International Transfers

Some of the cloud infrastructure, analytics, advertising and e-mail services we use operate on servers located outside Türkiye (in particular in the United States, Ireland and Germany). For this reason, your personal data may be transferred internationally to a limited extent under Article 9 of the KVKK.

An international transfer is possible only when at least one of the following conditions is met: (i) the explicit consent of the data subject, (ii) transfer to a country declared adequate by the Personal Data Protection Authority (the “Authority”), or (iii) a written undertaking between the parties approved by the Authority.

Partnerfy safeguards every international transfer through standard contractual clauses or other guarantee documents acceptable to the Authority. For more information about transfer processes, please write to [email protected].

7. Collection Methods

Your personal data is collected by automated or partially automated means or, where part of a data filing system, by non-automated means, through the following methods:

• Contact, proposal, demo and career-application forms on partnerfy.co and its sub-domains;
• E-mails sent to [email protected], [email protected], [email protected] and [email protected];
• Phone calls and voice messages to our contact centre (with a notice given where recording occurs);
• Physically/electronically signed contracts, KVKK application forms, order and delivery records;
• Cookies, pixels, logs and tag-management tools used on the website;
• Referrals received from business partners or suppliers, and client-introduction channels;
• Publicly available sources (LinkedIn, trade-registry gazette, corporate websites).

8. Retention Period

Your personal data is retained for as long as necessary to fulfil the purpose of processing and within the minimum and maximum periods prescribed by applicable legislation. The retention periods for principal categories are summarised below:

Once the retention period has expired, your personal data will be deleted, destroyed or irreversibly anonymised in accordance with the Company’s Personal Data Retention and Destruction Policy.

9. Data Security Measures

Under Article 12 of the KVKK, Partnerfy implements technical and organisational security measures proportionate to risk in order to prevent unlawful processing and access to personal data and to ensure their preservation. Key measures include:

Technical measures:

• Encryption in transit using TLS 1.2+;
• Encryption at rest for databases and file systems;
• Multi-factor authentication (MFA) and role-based access control (RBAC);
• Firewall, WAF, IDS/IPS and DDoS protection;
• Regular backups and disaster-recovery tests;
• Vulnerability scans and periodic penetration testing;
• Centralised log collection, SIEM-based monitoring and anomaly alerts;
• Patch management, version control and code-review processes.

Organisational measures:

• Employee confidentiality undertakings and KVKK training;
• Vendor due-diligence and data-processor agreements;
• Maintaining an up-to-date Personal Data Inventory;
• Data-breach response procedure and 72-hour notification workflow;
• Matrix of roles, responsibilities and segregation of duties;
• Annual review of policies and procedures.

10. Rights of the Data Subject

Under Article 11 of the KVKK, by applying to our Company you may exercise the following rights as a data subject:

1. Learn whether your personal data is being processed;
2. Request information if your personal data has been processed;
3. Learn the purpose of processing and whether the data is used in accordance with that purpose;
4. Know the third parties to whom your personal data is transferred domestically or internationally;
5. Request rectification of incompletely or inaccurately processed data;
6. Request deletion or destruction of personal data in accordance with the KVKK and related legislation;
7. Request notification of the actions taken under (5) and (6) to the third parties to whom data has been transferred;
8. Object to a result against you arising from the analysis of processed data exclusively through automated systems;
9. Request compensation for damages suffered as a result of unlawful processing of your personal data.

11. How to Apply

To exercise the above rights as a data subject, you may use one of the following channels, in accordance with the Communiqué on the Procedures and Principles for the Application to the Data Controller:

• Written application: deliver a signed petition in person or via notary to “Orta Mah. Kavaklar Cad. No:15 Ofisada Plaza D:104, Adapazarı/Sakarya”.
• Registered Electronic Mail (KEP): send a petition bearing a secure electronic signature to the Company’s KEP address (provided upon request).
• E-mail: apply from an e-mail address you have previously notified to the Company and which is registered in our system, to [email protected].
• Mobile / e-signature: send an electronic petition signed with a secure electronic signature to the above e-mail address.

Your application must clearly include your full name, Turkish ID number (for foreigners, passport / nationality), your address for notification, your e-mail address and phone/fax for communication if any, and a clear statement of your request. Under Article 13 of the KVKK, applications will be finalised free of charge within at most thirty (30) days depending on the nature of the request; where additional cost arises, the tariff determined by the Authority will apply.

12. Right to Complain

If your application is rejected, the response is deemed unsatisfactory or no response is given within the legal timeframe, you have the right to lodge a complaint with the Personal Data Protection Authority within thirty (30) days of becoming aware of the response and in any case within sixty (60) days of the application date.

The Authority’s contact details:

• Address: Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No:4, 06520 Balgat-Çankaya/Ankara
• Phone: +90 (312) 216 50 00
• Web: www.kvkk.gov.tr

Before exercising your right to complain, we encourage you to first contact us directly at [email protected] so that we may resolve your issue.

13. Effective Date

This KVKK Information Notice has been effective as of 30 May 2026. The Company reserves the right to update the Information Notice due to legislative changes, internal process updates or the launch of new services. The updated text becomes effective from the moment of publication, and the “Last updated” date is shown at the top of the page.

In case of material changes, the Company will make reasonable efforts to inform data subjects through appropriate channels (e-mail, on-site banner).

Earlier versions of the Information Notice may be requested at [email protected].

14. Contact

For any question or request relating to this Information Notice, please use the following channels:

• Data Controller: Partnerfy Bilgi Teknolojileri ve Pazarlama Sanayi Ticaret Ltd. Şti.
• Address: Orta Mah. Kavaklar Cad. No:15 Ofisada Plaza D:104, Adapazarı, Sakarya, TÜRKİYE
• Phone: +90 850 259 30 04
• E-mail: [email protected]
• General: [email protected]
• Support: [email protected]
• Operations: [email protected]