KVKK notice

DRAFT — not legal advice. Requires review by a qualified lawyer before use.

• Document: short English counterpart of kvkk-aydinlatma.tr.md (notice under Law 6698 art.10 and the Communiqué of 10.03.2018) · Version: 0.1 draft · Date: 2026-10-26
• The Turkish text is the reference text. This version follows the same section structure. It is separate from any explicit-consent text (KVKK Board principle decision 2026/347, secondary source in 06).
• Scope: only data for which the platform is controller (account, billing, usage and security data). For leads and recipients uploaded by customers the customer is the controller and is responsible for that notice. Company country: Türkiye. All fields were filled on 2026-10-27 (F1-64); sentences marked † still await lawyer confirmation.

1. Data controller

1.1 Controller: Faruk Sancak TiklaWeb Bilişim Hizmetleri (sole proprietorship), Türkiye, Atatürk Mahallesi Dilek Sokak No: 12 İç Kapı No: 5, Küçükçekmece / İstanbul, registry no. none (sole proprietorship; tax number 7430527303, Halkalı Tax Office). Contact: privacy@gondero.com.

1.2 We are not registered in VERBİS. Whether registration is required is being confirmed with a lawyer and the accountant: domestic controllers are exempt below 50 employees and an annual balance-sheet total of 100 million TL unless special-category data is their main activity (06 F1.3, F10).†

2. Personal data processed

2.1 Identity and contact data (name, work email, role, organisation), customer transaction and billing data, security data (login records, IP address, device and browser data, audit logs), support request content and connection configuration data (stored encrypted).

2.2 No special-category personal data (KVKK art.6) is intended to be processed.†

3. Purposes of processing

3.1 Providing the Service and managing the account; billing and tax obligations; information security, platform health and abuse prevention; answering support requests; legal obligations and responses to authorities.

4. Legal bases

4.1 Proposed bases (KVKK art.5/2; proposed, lawyer to confirm): legitimate interest (art.5/2-f, the basis discussed in 06) for abuse prevention and platform security. For account and contract data the basis is performance of a contract (art.5/2-c); for billing and tax records, performance of a contract and legal obligation (art.5/2-ç); for responses to authorities, legal obligation (art.5/2-ç).†

4.2 As the Communiqué requires, this notice states the legal basis. If an activity needs explicit consent, a separate consent text is provided for it and is not merged with this notice.

5. Method of collection

5.1 Data is collected directly from you (registration form, account settings, support correspondence), automatically while you use the Service (logs, API usage) and through the billing provider.

5A. Website visitors and people who e-mail us

Added 2026-10-27 (F1-87), in the same place and with the same number in the Turkish text (kvkk-aydinlatma.tr.md). Lawyer review required.

5A.1 Scope. Visitors to the Gondero marketing website and people who write to us by e-mail about early access, a demo or a question. The controller is the same as in section 1.

5A.2 Data and method. The static website has no account, form, analytics or third-party resources. Automatically, the hosting provider Hostinger logs IP address, time, requested page and browser data. If you write to us by e-mail (your own mail app opens with a pre-filled message; the page sends nothing), we receive your e-mail address, the name, company and country you write, and your message. The website sets no cookies.

5A.3 Purposes and legal basis. Delivering and securing the website; replying to your request and keeping a record of it. Proposed basis: legitimate interest (art.5/2-f) and steps taken at your request before a contract (art.5/2-c) (proposed, lawyer to confirm).†

5A.4 Transfer and retention. Data is shared only with the hosting and e-mail providers (https://gondero.com/en/legal/subprocessors/); abroad transfers follow section 6. Hostinger keeps server logs under its own retention schedule, which we have not confirmed (DOĞRULANAMADI). We keep an e-mailed request for 12 months after our last contact with you, then delete or anonymise it (06 T4).†

5A.5 Rights. Section 8 and 9 apply.

6. Transfer of personal data

6.1 Domestic: the payment institution PayTR (an independent controller), and our professional advisers and public authorities where the law requires. Hosting and e-mail providers are listed on the sub-processor page.†.

6.2 Abroad (art.9): sub-processors such as hosting, email infrastructure, error monitoring and AI providers may be outside Türkiye; EU regions also count as abroad. Transfers rely only on art.9 conditions: an adequacy decision, appropriate safeguards (the standard contract signed unchanged and notified within 5 business days, binding corporate rules, or a written undertaking approved by the Board), or occasional-transfer exceptions such as explicit consent. We found no KVKK adequacy decision: DOĞRULANAMADI (06 F1.3); we design as if none exists.

6.3 Current sub-processor list: https://gondero.com/en/legal/subprocessors/. Transfer countries and mechanism: The hosting provider and region of the platform are not yet selected (ADR-008), and the first release has no region pinning. For personal data of Turkish origin the KVKK standard contract path applies, used unchanged and notified within 5 business days of signature.†

7. Retention period

7.1 Proposed periods (lawyer to confirm): account data while the account is active and then for the 30-day pending-deletion period, after which it is deleted; commercial-message and consent records 3 years (in line with Reg. art.13/2); data subject request and destruction logs at least 3 years; periodic destruction interval at most 6 months (Deletion Regulation). Details are in section 9 of the Privacy Policy.

8. Your rights (art.11) and how to apply

8.1 Your rights under KVKK art.11 are to: (a) learn whether personal data about you is processed; (b) request information if it has been processed; (c) learn the purpose of processing and whether the data is used in line with that purpose; (ç) know the third parties to whom the data is transferred in Türkiye or abroad; (d) request correction if the data is incomplete or inaccurate; (e) request deletion or destruction under the conditions in art.7; (f) request that the operations under (d) and (e) be notified to the third parties to whom the data was transferred; (g) object to a result against you that arises from analysis of the data exclusively by automated systems; and (ğ) request compensation for damage arising from unlawful processing.†

8.2 Applications are answered free of charge within 30 days at the latest (art.13/2). Deletion requests also have a 30-day deadline (Deletion Regulation art.12).

9. How to apply

9.1 Send your application to privacy@gondero.com or in writing to the address above, or through the other channels that the Communiqué on the Procedures and Principles of Application to the Data Controller allows.† We may ask for information to verify your identity.

9.2 If you are not satisfied with our answer you may complain to the KVKK Board.

10. Notes for the reviewing lawyer

• This notice is for platform users only. The notice to lead recipients is the tenant’s duty as controller, and the first-email notice block is a separate template (06 R4, C-06).
• Section 6: the KVKK standard contract is not in Anthropic’s DPA; whether any vendor would sign it is DOĞRULANAMADI (06 F8). Who notifies the Board (Transfer Regulation art.14/5: the exporter, unless agreed otherwise) must be fixed in the contracts.
• Sections 4 and 8: 06 discusses only art.5/2-f and the data-subject response times; the other art.5/2 bases and the art.11 list were written from the text of the Law on 2026-10-27 and await confirmation (†).
• Penalty amounts are not stated here because 06 has the 2026 KVKK figures only from a secondary source.
• Filled 2026-10-27 (F1-89) from content-input/company.md: name, tax office and number, address and e-mail addresses. It is a sole proprietorship, so there is no MERSIS number; the tradesperson or trader status is for the accountant to confirm. The mailboxes hello@, support@, privacy@, billing@ and security@gondero.com are open. legal@, abuse@, postmaster@, dmarc@ and no-reply@ do not exist yet, so hello@gondero.com is used for legal notices and abuse reports until they do. Statements in the header that the company country is unknown are superseded (Türkiye); the options were decided on 2026-10-27. All placeholders were closed on 2026-10-27 (F1-64); the status table is in README.md.
• † Clauses awaiting lawyer confirmation: 1.2, 2.2, 4.1, 5A.3, 5A.4, 6.1, 6.3, 8.1, 9.1.