1. Data controller and scope of this notice
Convenience translation: this English version is provided for information only. The Turkish version is the binding text and prevails in case of any discrepancy.
This notice has been prepared under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform you about the personal data processed by [LEGAL_TRADE_NAME] ("İzin360", "we") as data controller.
- Data controller: [LEGAL_TRADE_NAME]
- MERSIS No: [LEGAL_MERSIS_NO]
- Address: [LEGAL_ADDRESS]
- Registered e-mail (KEP): [LEGAL_KEP_ADDRESS] · E-mail: [LEGAL_PRIVACY_EMAIL]
- VERBİS: [LEGAL_VERBIS]
This notice covers data relating to the representatives and users of customer accounts, billing and payment contacts, visitors to our website, people who request contact or a demo, people who open support requests and people who submit KVKK requests to us. The situation is different for the employee and leave data processed on the platform on behalf of customer companies; this is explained in the next section.
This notice is for information only. The "I have read and understood" statement requested at sign-up and in our contact forms is not an approval or explicit consent; it only records which version of this notice was provided to you.
2. Employee and leave data: your employer is the data controller
İzin360 provides a cloud-based leave management service to companies (employers). For data that customer companies enter into the platform or that their employees create on it — identity and contact details, Turkish ID number, date of birth, salary, organisational details, leave requests, balances and approval records, leave information that may qualify as health data such as sick or maternity leave, and uploaded documents — the customer company concerned is the data controller. İzin360 is a data processor that processes this data only on the customer's instructions and within the framework of the Data Processing Agreement.
The purposes and legal grounds for processing this data, how long it is kept and to whom it is disclosed are determined by your employer and communicated to you in your employer's employee privacy notice, which you can view in the app. Therefore:
- Please direct questions about your leave and personnel data, and requests under Article 11 of the KVKK, to your employer.
- In the app, on the User menu › Privacy & KVKK page, you can send a request to your employer, view your employer's privacy notice and download a copy of your own data (including the documents attached to your leave requests) as a ZIP file.
- If such a request reaches İzin360, we forward it to the employer concerned without delay and let you know; we do not respond to it on the employer's behalf.
The remaining sections of this notice relate only to personal data that İzin360 processes as data controller on its own behalf. As data controller we do not process special categories of personal data (such as health data).
3. Personal data processed and data subject groups
| Data subject group | Data categories and examples |
|---|---|
| Representatives and users of customer accounts (account owner, billing administrator and other users) | Identity: full name. Contact: work e-mail, telephone if provided. Account: company account, role, language and notification preferences. Legal transaction: acceptance of the Terms of Service and the Data Processing Agreement and the statement that this notice was read (document version, time, IP address, browser information). Transaction security: irreversible password hash, two-factor authentication secret (encrypted) and hashes of recovery codes, session records (IP address from which the session was opened, browser/device information, time), failed sign-in counter, authentication and security events (successful and failed sign-ins, two-factor authentication operations, password and e-mail changes, sign-outs — with time, IP address, browser information and request trace ID). Marketing: consent to commercial electronic messages and its withdrawal history. |
| Billing and payment contacts | Buyer type (company or sole proprietorship), trade name or full name, tax identification number or, for sole proprietorships, Turkish ID number (stored encrypted), tax office, billing address and invoice e-mail; plan, amount, date and payment result, the payment institution's transaction number, refund records; acceptance of sales documents (document, version, digest of the accepted text, time, IP address); records of order confirmation and price change notices (recipient e-mail addresses, time sent, content); optional cancellation feedback. We do not collect, see or store your card details. |
| Website visitors | Server access logs: IP address, time, requested address, browser information. Strictly necessary cookies and browser storage; only if you allow it in the cookie panel, visit statistics on the marketing pages via Google Analytics: pages viewed, the page you came from, interactions on the page, device and browser details, approximate location derived from the IP address and a random visitor identifier (see the Cookie Policy); no advertising or retargeting tools are used. |
| People sending contact, demo or sales requests | Request type (contact, demo or sales), full name, e-mail, company, telephone (optional), your message, your preferred demo date, number of employees, language preference, your statement that you read this notice and its version, the IP address and time the form was sent, our note on how the request was handled and our correspondence with you. |
| People opening support requests | Full name, e-mail, content of the request, attachments you share and correspondence. |
| People submitting KVKK requests to us | Identity and contact details required by the Communiqué on applications (including Turkish ID number), content of the request, identity verification information, request and response records. |
4. Purposes of processing and legal grounds
Your personal data is processed for the purposes below on the basis of the legal grounds in Article 5 of the KVKK. We rely on your explicit consent only for optional commercial electronic messages and for analytics cookies on the marketing pages; explicit consent is not requested for any other processing.
| Purpose | Legal ground |
|---|---|
| Opening the account, authentication, providing the service, managing users and accounts, sending service notifications (verification, password reset, request and approval notifications, invoice and payment reminders), handling support requests | Processing directly related to the conclusion or performance of a contract (Art. 5(2)(c)) |
| Selling subscriptions, collecting payments, handling plan changes and refunds | Conclusion or performance of a contract (Art. 5(2)(c)) |
| Issuing official invoices (e-Archive/e-Invoice), keeping commercial books and records and order and sales records, responding to KVKK requests and to requests from competent authorities | Compliance with a legal obligation of the data controller (Art. 5(2)(ç)) |
| Keeping records of contract acceptance, sales document acceptance and notices as evidence in disputes | Establishment, exercise or protection of a right (Art. 5(2)(e)) |
| Security of the platform and accounts: session management, preventing failed sign-ins and abuse, rate limiting, recording authentication and security events, server access logs, detecting and fixing errors | Our data security obligation (KVKK Art. 12) and our legitimate interests, provided they do not harm your fundamental rights and freedoms (Art. 5(2)(ç), Art. 5(2)(f)) |
| Handling demo, sales and offer requests | Processing directly related to the conclusion of a contract (Art. 5(2)(c)): a pre-contractual step you initiate with your request |
| Responding to general contact messages, confirming receipt of the request by e-mail, communicating with representatives applying on behalf of a company | Our legitimate interest in being able to respond to you (Art. 5(2)(f)); the data processed is limited to what is needed to respond |
| Preventing abuse of the forms (automated submissions, excessive requests): recording the IP address and time | Our legitimate interest (Art. 5(2)(f)) |
| Sending commercial electronic messages about product news, offers and events | Your explicit consent (Art. 5(1)) and your approval under Article 6 of Law No. 6563 — optional and revocable at any time |
| Measuring in aggregate how the marketing pages are found and used, and improving their content (Google Analytics; only with your permission in the cookie panel) | Your explicit consent (Art. 5(1)) — optional and revocable at any time in the cookie preferences |
5. How personal data is collected
Your personal data is collected electronically, partly by automated means, through the following channels:
- Sign-up, invitation, billing details and payment forms and the actions you take in the app,
- Transaction result notifications returned by the payment institution PayTR at the payment step (excluding card details),
- Contact, demo and sales forms, e-mail and support correspondence,
- Server logs of the website and the platform, strictly necessary cookies and, if you allowed them in the cookie panel, Google Analytics cookies on the marketing pages.
If your account was created through an invitation or entry by an authorised user at your company, your name and e-mail address were provided to us by that user. On the invitation acceptance screen this notice is presented to you separately from your employer's employee privacy notice; your statement that you have read it is recorded with the notice version, time, IP address and browser information.
6. Recipient groups
Your personal data is disclosed only to the recipients below, for the stated purposes and in line with the conditions in Articles 8 and 9 of the KVKK. We do not sell your personal data or share it with third parties for advertising.
| Recipient | Purpose of disclosure |
|---|---|
| Hosting provider — Contabo GmbH (Germany) | Providing the servers on which the platform and the website run (data processor) |
| E-mail delivery (SMTP) provider — [LEGAL_SMTP_PROVIDER] ([LEGAL_SMTP_COUNTRY]) | Delivering service notifications, form request notifications and receipt confirmations by e-mail: recipient's name, e-mail address and message content (data processor) |
| Corporate e-mail service — [LEGAL_MAILBOX_PROVIDER] ([LEGAL_MAILBOX_COUNTRY]) | Keeping contact, demo, support and KVKK correspondence in our mailboxes (data processor) |
| Off-site backup provider — [LEGAL_BACKUP_PROVIDER] ([LEGAL_BACKUP_COUNTRY]) | Storing encrypted backups at a separate location for disaster recovery (data processor) |
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (Türkiye) | Collecting payments and refunds: the paying user's name, e-mail address and IP address, the order amount and description. Card data is entered directly with PayTR, which acts under its own controllership for that data |
| e-Invoice/e-Archive service provider — [LEGAL_EINVOICE_PROVIDER] — and the Turkish Revenue Administration | Issuing and transmitting the official invoice as required by tax legislation: buyer's trade name or name, tax/Turkish ID number, tax office, address and e-mail, invoice lines |
| Our legal, financial and tax advisers, auditors | Complying with legal obligations and protecting our rights |
| Competent public authorities and courts | Requests from authorities legally entitled to them and legal obligations |
| Authorised users of the customer company you belong to | Viewing activity records in the company account (for example which user performed which action, purchase acceptances) only within that company account |
| Analytics service provider — Google LLC (United States) | Only if you allowed analytics cookies: visit statistics of the marketing pages (page address, the page you came from, device and browser details, approximate location derived from the IP address, random visitor identifier); not used for advertising or profiling |
7. Transfers abroad
Because the following providers are located outside Türkiye, personal data sent to them or made accessible to them is transferred abroad:
- Contabo GmbH (Germany)
- Google LLC (United States)
Safeguard: The Board has not issued an adequacy decision for these countries. The transfer is based on one of the legal grounds in Article 5 of the KVKK and, for each provider, [LEGAL_CROSS_BORDER_SAFEGUARD]
8. Retention periods
We keep personal data for as long as the purpose of processing requires and legislation prescribes; when the period ends, we delete, destroy or anonymise it through periodic destruction. The main periods are:
- Invoice, payment, refund and sales records and the buyer details on invoices: 10 years from the end of the calendar year in which they were created (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253); the billing profile is deleted together with the account,
- Records of acceptance of the Terms of Service and the Data Processing Agreement: 10 years from the end of the calendar year in which the contract ended (general limitation period),
- Account and user details: while the account is open; deleted 90 days after the account is closed (an account suspended at the end of the trial or for an unpaid renewal is closed automatically 60 days after the suspension),
- Session records (IP address, device information): 180 days after the session ends or is revoked,
- Authentication and security events (time, IP address, browser information): in the tamper-evident audit log of your company account for as long as the account exists; when your company anonymises your record at the end of its retention period the IP address and browser information are erased, and the events are deleted together with the audit log 90 days after the account is closed,
- Contact, demo and sales requests: 1 year after being handled; if never handled, 2 years after creation,
- Records of consent to and refusal of commercial electronic messages: 3 years from the end of the consent (withdrawal or deletion of the account),
- Google Analytics visit data: event-level data 2 months in Google Analytics; analytics cookies in your browser at most 24 months and deleted when you withdraw consent; your cookie choice 180 days.
All periods, including backups and the periods for employee data processed on behalf of customers, are set out in the Privacy Policy.
9. Your rights under Article 11 of the KVKK
Under Article 11 of the KVKK, by applying to the data controller you have the right to:
- learn whether your personal data is processed,
- request information if your personal data has been processed,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom your personal data is disclosed,
- request rectification if your personal data is incomplete or inaccurate,
- request erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
- request that rectification, erasure or destruction be notified to third parties to whom your personal data has been disclosed,
- object to a result to your detriment arising from the analysis of processed data exclusively by automated systems,
- claim compensation if you suffer damage because your personal data was processed unlawfully.
10. Submitting a data subject request
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit requests concerning your rights in Turkish through one of the following channels:
- By a wet-signed letter delivered by hand or through a notary public to [LEGAL_ADDRESS],
- Signed with a secure electronic signature or mobile signature, to our registered e-mail (KEP) address: [LEGAL_KEP_ADDRESS],
- From the e-mail address you previously provided to us and that is registered in our systems, to: [LEGAL_PRIVACY_EMAIL].
Information your request must include
- Full name and, for written requests, signature,
- For Turkish citizens, Turkish ID number; for foreign nationals, nationality and passport number or ID number if any,
- Residential or business address for notifications,
- E-mail address, telephone and fax number for notifications, if any,
- Subject of the request and any relevant information and documents.
Response time and fees
We conclude your request as soon as possible according to its nature and at the latest within thirty days, free of charge, and send our response in writing or electronically; if we reject the request, we state the reasons. No fee is charged for written responses of up to ten pages; for each page above ten, a fee of 1 Turkish lira may be charged, and if the response is provided on a recording medium such as a CD or portable memory, a fee not exceeding the cost of the medium may be charged. We may ask for additional information to verify your identity, to make sure the request comes from you.
If your request is rejected, you find the response insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the date of your request.
For your employee data, your employer is the data controller: you can send your request to your employer in the app on the User menu › Privacy & KVKK page and download a copy of your own data from the same page.
11. Changes
We may update this notice to reflect changes in legislation or in our processing activities. The current version is published on this page with its version and last-updated date. When the notice is updated, a one-time notification is shown the next time you use the app and the fact that it was shown to you (version and time) is recorded; this record is not a consent. If our purposes of processing change, we will inform you separately before the change.