Information notice under the Turkish Personal Data Protection Law (KVKK)

Version [Metin sürümü] · Effective date [Yürürlük tarihi]

This notice is given under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles of the Obligation to Inform. Details are in the privacy policy at https://docdekay.needsolutions.net/legal/privacy.

1. Data controller

[HKSolutions yasal unvan], [HKSolutions tescilli adres]. Tax office and number: [Vergi dairesi ve vergi numarası]. MERSIS: [MERSİS numarası]. KEP: [KEP adresi]. VERBIS: [VERBİS kayıt durumu ve numarası].

2. Personal data processed

• Senders: anonymous account identifiers, language, plan, sign-in times, a keyed hash of the app-scoped Android ID (Free quota), Firebase Installation ID (notifications, if enabled), Google Play subscription information (if purchased), records of created links including the recipient name entered by the sender, and the document image (encrypted, in memory only, at most 24 hours).
• Recipients: IP address, browser user agent, time and type of access, session duration; the recipient name, IP address and time are baked into the watermark of each view.

3. Purposes

Providing the document sharing service; watermarking and keeping access records to deter and prove unauthorised copying; account and subscription management; preventing abuse of the Free plan; information security; fulfilling legal obligations.

4. Legal grounds and method of collection

Data is collected electronically through the mobile app and the web viewer. Legal grounds (KVKK Art. 5(2)): (c) processing is necessary for the establishment or performance of a contract; (f) processing is necessary for the legitimate interests of the controller, provided it does not harm the fundamental rights of the data subject; (ç) compliance with a legal obligation.

5. Transfers

Data may be transferred to: the hosting provider [VDS sağlayıcısının unvanı ve veri merkezi ülkesi]; Google (Google Play for distribution and billing, Firebase Cloud Messaging for notifications, Play Integrity for device integrity if enabled), which may process data abroad; and authorities where legally required. Basis for transfers abroad (KVKK Art. 9): [Yurt dışına aktarım dayanağı (KVKK m.9 / GDPR Bölüm V) — hukukçu belirleyecek].

6. Retention

Document images: until expiry, view limit or deletion, at most 24 hours, in memory only. Access records: 365 days. Account data: until deletion; Free accounts are deleted after 180 days without sign-in. Backups of records: 30 days.

7. Your rights (KVKK Article 11)

You have the right to learn whether your personal data is processed; to request information about it; to learn the purpose and whether it is used accordingly; to know the third parties to whom it is transferred in Türkiye or abroad; to request rectification if it is incomplete or inaccurate; to request erasure or destruction under Article 7; to request that rectification or erasure be notified to third parties; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

8. How to apply

Send your request in writing to [HKSolutions tescilli adres], via KEP to [KEP adresi], or by e-mail to [Kişisel veri başvuruları için e-posta adresi], in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Requests are answered free of charge within 30 days at the latest; if the reply requires additional cost, the fee set by the Personal Data Protection Board may be charged. You may complain to the Personal Data Protection Board.