Personal Data Policy
Disclosure under Personal Data Protection Law No. 6698General information on the Personal Data Law
Law No. 6698 on the Protection of Personal Data (hereinafter referred to as KVKK) was adopted on 24 March 2016 and published in Official Gazette No. 29677 dated 7 April 2016. Part of KVKK entered into force on the date of publication and part on 7 October 2016.
Information as Data Controller
In accordance with KVKK No. 6698 and in our capacity as Data Controller, your personal data will, within the framework explained on this page, be recorded, stored, updated, disclosed / transferred to third parties where legislation permits, classified and processed in the ways listed in KVKK.
How your personal data may be processed
In accordance with KVKK No. 6698, the personal data you share with our Company may be processed by us by being obtained, recorded, stored, modified, reorganized, in short by being subjected to any operation performed on the data, wholly or partly automatically, or by non-automatic means provided that it is part of any data recording system. Under KVKK, any operation performed on data is regarded as “processing of personal data”.
Purposes and legal grounds for processing your personal data
The personal data you share,
in order to perform the requirements of the services we provide to our customers in a manner consistent with the requirements of the contract and of technology, and to be able to develop the products and services we offer;
in order to record identity, address and other necessary information to establish the details of the party to a transaction within the scope of Law No. 6563 on the Regulation of Electronic Commerce, Law No. 6502 on Consumer Protection, the Regulation on Electronic Commerce Intermediary Service Providers and Electronic Commerce Service Providers published in Official Gazette No. 32058 dated 29.12.2022, prepared on the basis of these regulations, the Distance Contracts Regulation published in Official Gazette No. 29188 dated 27.11.2014 and other relevant legislation;
in order to arrange the payment systems that are mandatory in the field of banking and electronic payment and all records and documents that will serve as the basis for a transaction in the form of an electronic contract or on paper, and to comply with the information retention, reporting and notification obligations required by legislation and prescribed by other authorities;
in order to be able to provide information to public prosecutors’ offices, courts and relevant public officials, upon request and as required by legislation, in matters relating to public security and in legal disputes;
will be processed in accordance with KVKK No. 6698 and the relevant secondary regulations.
Information on third parties or institutions to which your personal data may be transferred. For the purposes stated above, the persons / institutions to which the personal data you share with our Company may be transferred are, primarily, our solution partners relating to our Website / application infrastructure, suppliers, persons and institutions relating to the services offered such as cargo companies, program partner institutions with which we cooperate and from which services are received in order to carry out our activities and/or in the capacity of Data Processor, domestic / foreign institutions and other third parties.
Manner in which your personal data is collected
Your personal data,
through forms on our Company’s website, mobile and web applications and other digital services, such as name, surname, Turkish identity number, address, telephone, business or personal e-mail address, together with data including preferences on pages accessed with a username and password, IP records of transactions carried out, cookie data collected by the browser and browsing duration and details, and location data;
· from verbal, written or electronic media through our sales and marketing department employees, our branches, our suppliers, other sales channels, paper forms, business cards, and channels such as digital marketing and call center;
· from persons who share their personal data with our Company for purposes such as establishing a commercial relationship, making a job application or submitting an offer, by business card, résumé (CV), offering or other means, in a physical or virtual environment, face to face or at a distance, verbally or in writing or electronically;
· in addition, from data obtained indirectly through different channels, from (micro) websites and social media used for purposes such as websites, blogs, contests, surveys, games and campaigns, e-newsletter reading or click activity, data offered by publicly available databases, and profiles and data open to sharing from social media platforms;
· from data transferred from external systems and data sources that the user connects to the service;
may be processed and collected.
Personal data processed in applications and digital services
When our Company’s website, mobile and web applications and digital services including API services are used, the following personal data may be processed, depending on the feature used:
· Identity and contact information: name, surname, e-mail address, telephone number, profile image; verification of the e-mail address or telephone number with a verification code when the account is created.
· Account and login information: authentication information; if social login (e.g. Google, Apple) is preferred, limited profile information (name, e-mail address) transferred from the relevant provider.
· User-generated content: records, notes, comments, questions, messages, order and reservation information, and added content such as photographs, images, documents, files, voice recordings and handwritten signatures.
· Location information: device location when the relevant feature is used and device permission is granted; where the service requires it, location shared by personnel for service verification purposes, and workplace, equipment and device locations. Location permission can be revoked at any time from the device settings.
· Device contact data: in services that have a contact matching feature, after the user’s explicit in-app consent and device permission, the telephone numbers of the persons in the device contacts may be processed in order to match them with registered users; numbers that do not match may be stored only as irreversible keyed digests, so that the contact owner can be informed when that person later joins the service. Digests are deleted at the end of the period set in the service, counted from the last refresh; the contact link can be removed by the user at any time, and when the account is deleted all contact data is deleted. A person who has a registered number in their contacts may see a user whose number has been verified as a friend suggestion; the user can turn this off within the service. Contact permission can be revoked at any time from the device settings.
· Voice input: in services that have a voice input feature, speech may be converted to text by the speech recognition feature of the device or browser.
· Purchase and payment records: records such as the date, amount and status of the transaction, and invoice information (such as legal name or title, tax number, tax office, address). Invoice information is collected for the purpose of issuing invoices; the national identity (T.C. kimlik) number is collected as optional for individual users, and for businesses a tax number (the tax identification number, or the national identity number for a sole proprietorship) is requested for the invoice. Card number and security code are not collected in the applications; card payment is made only on the common payment page described in the Privacy and Security Policy (S/02); in purchases made through mobile application stores the relevant store collects the payment.
· Preference and technical data: notification preferences, device and session information, usage records.
· Device and measurement data: measurement, status, alarm and event records transferred from devices, sensors and equipment connected to the service, and the identifying and technical information of these devices; this data is mostly business data, but it has the nature of personal data to the extent that it can be associated with persons.
· Persons defined in the system by the institution: if the institution or business using the service registers persons such as personnel, notification recipients, contact persons, customers and suppliers in the service, the name, surname, telephone, e-mail, job title and similar information of these persons, and their responses to alarms and notifications and transaction records.
· Sharing and business-to-business process data: where the service offers them, information made accessible through time-limited or revocable sharing links and public cards (QR code or link) (persons who have the link or code can see this information); documents and records uploaded by service providers and businesses, such as offers, authorization and qualification documents and reports, and the contact information relating to them.
· Data in connected external sources: data transferred, for the feature used, from external systems, databases or services that the user chooses to connect to the service; this data may contain personal data belonging to the user’s employees, customers, suppliers or other third parties; in this case our Company’s capacity as data processor is described in the relevant section of this policy.
This data is processed for the purposes of membership creation and authentication, provision of application functions, monitoring of device and measurement data, delivery and reporting of alarms and notifications, conduct of business-to-business request, offer and sharing processes, presentation to other users, in the services where the relevant feature is offered, of aggregate and anonymous statistics derived from user records without identifying anyone, performance of purchase and invoicing transactions, sending notifications subject to user preference, content moderation and evaluation of community reports, ensuring service security and fulfilling legal obligations.
Legal grounds for processing personal data
Your personal data is processed on the basis of the legal grounds listed in articles 5 and 6 of KVKK: the establishment or performance of a contract, fulfillment of a legal obligation, the legitimate interest of the data controller (such as ensuring the security and quality of the service) and, where necessary, explicit consent (such as for commercial electronic messages and non-essential cookies). Special categories of personal data (e.g. health, biometric and genetic data) are processed, only where the relevant service is offered in a way that processes this data, on the basis of explicit consent within the framework of the conditions provided in article 6 of KVKK or another legal ground provided in legislation; persons using the Services must not enter this data into the Services without providing the legal ground required for processing.
Third-party service providers
To the extent necessary for the provision of the Services, personal data may be shared with third parties such as mobile application stores, authentication and notification infrastructure providers, hosting and cloud infrastructure and analytics service providers, payment service providers, map, address and location (geocoding), weather and marine data providers, SMS, e-mail, messaging and voice call transmission services, integration service providers such as e-document, accounting, cargo and marketplace, service providers that provide artificial intelligence-supported features (including services that generate text, images, audio and video), and consultants, dealers and business partners authorized by our Company or the user. In the services where artificial intelligence-supported features are used, the content required for the relevant feature may be transmitted to these service providers for processing.
Your personal data obtained before KVKK entered into force
Your personal data that was lawfully obtained before 7 April 2016, the date KVKK entered into force, through membership, electronic message consent, purchase of products / services and other means, is also processed and retained in accordance with the terms and conditions regulated in this document.
Transfer of your personal data abroad
Your personal data collected by any of the methods listed above, to be processed in Türkiye or processed and retained outside Türkiye, may also be transferred, provided that it remains within the scope of KVKK and in line with the purposes of the contract, to service intermediaries located abroad. The transfer is made, provided that one of the conditions stated in articles 5 and 6 of KVKK exists and pursuant to article 9 of KVKK: where an adequacy decision has been issued by the Personal Data Protection Board regarding the country, the sectors within the country or the international organizations to which the transfer will be made; where there is no adequacy decision, where one of the appropriate safeguards provided in the same article is ensured; and, where this cannot be ensured either, only on an occasional basis where one of the cases listed in the same article exists.
Storage and protection of personal data
Your personal data will be kept confidential in the database and systems located at our Company pursuant to article 12 of KVKK; it will not be shared with third parties in any way except for legal requirements and the arrangements stated in this document. Our Company is obliged, pursuant to article 12 of KVKK, to prevent the unlawful processing of personal data in the systems and databases containing your personal data, to prevent access by unauthorized persons, and to take software measures such as access management and physical security measures. If it is learned that personal data has been obtained by others through unlawful means, the situation will be notified immediately, in writing and in accordance with the legal regulation, to the Personal Data Protection Board.
Retention periods
Your personal data is kept for the period required by the processing purpose and for the retention and limitation periods provided in the relevant legislation. Invoices, payment records and commercial books and documents are kept for the period provided in tax and commercial legislation, and access records for the period provided in the legislation on the regulation of broadcasts made on the internet. At the end of the period, personal data is deleted, destroyed or anonymized.
Deletion of the account
When a user account is deleted, the personal data belonging to the account is deleted or anonymized. Records shared with other users (such as comments, messages, orders and reservations) may be kept in anonymous form with the author’s identity removed; structural personal fields in these records, such as address, telephone and note fields, are cleared. Data subject to a legal retention obligation is kept for the relevant period and, at the end of the period, is deleted, destroyed or anonymized. If there is an automatically renewing subscription purchased through a mobile application store, billing continues at the store; the subscription is canceled from the store’s subscription management screen. You can also submit your deletion requests to info@abibasoft.com.
Personal data of children
Personal data of persons under 18 years of age is not knowingly collected without the approval of the legal representative; if it is determined that such data has been collected without approval, it is deleted.
Keeping personal data up to date and accurate
Under article 4 of KVKK, our Company is obliged to keep your personal data accurate and up to date. In this context, in order for our Company to fulfill its obligations arising from the legislation in force, our Customers need to share their accurate and up-to-date data or update it through the website / applications.
Rights of the data subject under KVKK No. 6698
Pursuant to article 11 of KVKK No. 6698, the rights of the Data Subject are as follows:
The Data Subject has the right, by applying to our Company (the data controller), regarding themselves, to:
1. Learn whether personal data is processed,
2. Request information about it if personal data has been processed,
3. Learn the purpose of processing personal data and whether it is used in accordance with that purpose,
4. Know the third parties to whom personal data is transferred domestically or abroad,
5. Request correction of personal data if it has been processed incompletely or incorrectly,
6. Request deletion or destruction of personal data within the framework of the conditions provided in article 7 of KVKK,
7. Request that, where personal data is corrected, deleted or destroyed, these operations also be notified to the third parties to whom the personal data has been transferred,
8. Object to the occurrence of a result against themselves by the analysis of the processed data exclusively through automated systems,
9. Request compensation for the loss if they suffer a loss due to the unlawful processing of personal data.
These are the rights of the Data Subject.
Application procedure
You can submit your requests regarding your rights above in writing or via registered electronic mail (KEP), secure electronic signature, mobile signature or the e-mail address you previously notified to our Company, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Applications are concluded free of charge as soon as possible according to the nature of the request and within thirty days at the latest; if the transaction requires a separate cost, a fee in the tariff determined by the Personal Data Protection Board may be charged.
Information as Data Processor
With regard to personal data of employees, customers, suppliers, notification recipients and similar persons that institutions and businesses using the Services enter into, upload to or transfer to the service from connected external sources, and personal data in device and measurement records, the data controller is the relevant institution or business; our Company holds the capacity of data processor, processing this data for the purpose of providing the service and in line with the instructions of the relevant institution.
In this context, our Company processes data only within the framework of the provision, maintenance and security of the service and the institution’s instructions, takes the necessary technical and administrative measures pursuant to article 12 of KVKK, imposes a confidentiality obligation on persons who can access the data, may use service providers such as hosting, cloud, notification and artificial intelligence as sub-processors, deletes, destroys, anonymizes or returns the data upon termination of the service in line with the institution’s instructions and legislation, shares data subjects’ applications with the institution so that the institution can fulfill its data controller obligations, and assists to a reasonable extent.
The institution is responsible for obtaining the data lawfully, informing the data subjects and, where necessary, obtaining their explicit consent. Where deemed necessary, a separate data processing agreement supplementing this section may be concluded between the parties.
Registered with the Ankara Chamber of Commerce under registration number 439792 and located at Ankara Teknopark, İvedik OSB Mh. 2224. Cd. No: 1/115 Yenimahalle/ANKARA, ABİBASOFT YAZILIM DANIŞMANLIK LTD. ŞTİ. is the Data Controller under KVKK with respect to the processing activities described above.
Data Subjects may direct their questions, opinions or requests to any one of the contact channels below:
E-mail: info@abibasoft.com
Telephone: +90 850 840 76 91