This policy explains how the ClickToID Solutions East website (the “site”) processes your personal data. It is a translation of the Turkish text (Gizlilik Politikası ve Aydınlatma Metni).
Information notice under KVKK
This section is prepared to fulfill our duty to inform as data controller under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
Data controller
Data controller: ClickToID Solutions East Yazılım Limited Şirketi (the “Company”, “we” or “us”).
The Company’s MERSİS number, trade registry office and trade registry number, and registered electronic mail (KEP) address, if any, are shown at the bottom of every page.
Our address and phone number are on the Contact page and at the bottom of every page. For questions about your personal data, write to the email address on the same page.
Personal data we process
Contact form. When you submit the form, we process:
- your name;
- your email address or phone number (at least one);
- your message;
- the form language and the page you sent it from;
- the service or package, if you came to the page from a service or package link;
- campaign tags (UTM parameters), if the page address contains them;
- the time the request was received.
We do not store form data in a database. We do not send you an automatic email after you submit the form; your request is only emailed to the company address. The form server does not write form content or your contact details to its error logs.
Direct contact. If you contact us directly by email, phone or WhatsApp, we process your name, your contact details and the content of the conversation. When you write via WhatsApp, your messages are also processed under WhatsApp’s own terms. WhatsApp conversations are processed on WhatsApp’s (Meta) servers outside Türkiye.
Spam protection. Cloudflare Turnstile runs on the contact page. Turnstile processes browser and connection data, including your IP address, to check for bots. When the form is submitted, our server sends the Turnstile result and your IP address to Cloudflare for verification.
Delivering the site. The site is hosted on Cloudflare. Cloudflare processes your IP address, browser data and request data (for example, the requested page and its time) to deliver the pages to you and protect the site from attacks.
Cookies. The site uses only necessary cookies (your language choice, Turnstile); it does not use analytics or advertising cookies. Details are in the Cookie Policy.
Purposes
- to receive and assess your request and reply to you;
- to hold discussions with you before a possible service contract;
- to protect the form and the site from spam, abuse and attacks;
- to deliver the site and remember the language you chose;
- to meet our legal obligations and protect our rights in possible disputes.
Collection method and legal basis
Form data is collected directly from you, by automated means, when you fill in the form. Direct contact data is collected from you when you write to us or call us. Connection data and cookies are collected automatically from your browser while you use the site.
Legal basis:
- form data and direct contact: KVKK Article 5(2)(c), that is, processing is necessary provided that it is directly related to the conclusion or performance of a contract and concerns the parties to that contract. We process your request in order to discuss it with you before a service contract is concluded. If your request does not lead to a contract, we rely on our legitimate interest under (f) to continue the conversation;
- spam protection, site security and connection data: KVKK Article 5(2)(f), that is, processing is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms;
- keeping correspondence after the discussions end: KVKK Article 5(2)(e) (establishing, exercising or protecting a right) and, if a contract is concluded, Article 5(2)(ç) (compliance with a legal obligation);
- necessary cookies (your language choice, Turnstile): KVKK Article 5(2)(f).
Because processing of form data does not rely on your explicit consent, the form has no separate consent checkbox.
Recipients and purposes of transfer
| Recipient | Purpose | Data |
|---|---|---|
| Cloudflare | Hosting and protecting the site, form server, spam protection (Turnstile) | IP address, browser and request data, form data in transit |
| Resend (email delivery service; Postmark as a backup) | Emailing form data to the company | Form data |
| INWX (the company’s email provider) | Hosting the company’s mailboxes; storing request emails and correspondence | Form data, emails you send us |
These providers process the data on our behalf and on our instructions as data processors. Postmark is used only instead of Resend; the two services are never used at the same time. We do not sell your personal data or share it for advertising. Where required by law, we may share it with authorized public authorities in line with Article 8 of KVKK.
Transfers outside Türkiye
The providers above also process data on servers outside Türkiye: Cloudflare operates from data centers around the world, including in Türkiye; Resend and Postmark process data on servers in the USA; the company’s mailboxes are hosted on INWX servers in Germany.
Transfers abroad are made in line with Article 9 of KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. Each transfer relies on one of the legal bases in Article 5 of KVKK. As there is no adequacy decision of the Personal Data Protection Board (the “Board”) for the destination countries, appropriate safeguards are provided by signing the standard contract published by the Board with each provider. Standard contracts are notified to the Personal Data Protection Authority (the “Authority”) within five business days after signing.
Retention
- The form server does not store requests; it only turns them into an email and forwards it.
- The email delivery service keeps a record of sent emails for its own retention period: 30 days at Resend, 45 days by default at Postmark.
- The request email and later correspondence are kept in the company’s mailbox at INWX.
- Cookie lifetimes are listed in the Cookie Policy.
We keep request emails and correspondence while the discussions continue and for 2 years after the last message. If a request leads to a contract, the correspondence is kept for the period required by law (for example, under Article 82 of the Turkish Commercial Code). When the retention period ends, the data is erased, destroyed or anonymized in line with the Regulation on the Erasure, Destruction or Anonymization of Personal Data.
Your rights
Under Article 11 of KVKK, you may apply to the data controller to:
- learn whether your personal data is processed;
- request information about the processing if it has been processed;
- learn the purpose of the processing and whether the data is used for that purpose;
- know the third parties in Türkiye or abroad to whom your personal data is transferred;
- request correction of incomplete or inaccurate data;
- request erasure or destruction of your personal data under the conditions of Article 7 of KVKK;
- request that the correction, erasure or destruction is notified to third parties to whom the data was transferred;
- object to a result against you that arises from analysis of the data exclusively by automated systems;
- claim compensation for damage caused by unlawful processing of your personal data.
You can send your application in Turkish, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, in one of these ways:
- by a petition with a wet signature, delivered by hand or by mail to our company address;
- to our registered electronic mail (KEP) address, if we have one, with a secure electronic signature or mobile signature;
- from an email address you have previously given us and that is registered in our records, to the email address on the Contact page.
Your application must include your name and surname, your signature if it is in writing, your Turkish ID number if you are a citizen of Türkiye, or your nationality and passport number or ID number (if any) if you are not, your residential or business address for notifications, your email address for notifications (if any), your phone number and your request.
We conclude your application as soon as possible according to its nature and, under Article 13 of KVKK, within thirty days at the latest. Applications are handled at no cost; if the action involves an additional cost, a fee may be charged according to the tariff set by the Board. If your application is rejected, you find our reply insufficient or we do not reply in time, you may file a complaint with the Board under Article 14 of KVKK within thirty days of learning of our reply and in any case within sixty days of your application.
VERBİS
The Company is exempt from registration with the Data Controllers’ Registry (VERBİS), because it is below the annual employee number and annual balance sheet thresholds set by Board decisions and its main activity is not processing special categories of personal data. If this changes, we will register with VERBİS and update this policy. The exemption does not remove our other obligations under KVKK (informing, data security and handling applications).
GDPR
The site is operated from Türkiye, and processing of personal data is primarily subject to KVKK. If the General Data Protection Regulation (GDPR, Regulation 2016/679) also applies to the processing of your personal data, the processing described above relies on GDPR Article 6(1)(b) (steps before entering into a contract) and Article 6(1)(f) (legitimate interests). In that case you also have the rights to access, rectify and erase your data, to restrict processing, to data portability and to object; you can lodge a complaint with the data protection supervisory authority in your country. You can send your requests in the ways described above.
Changes
When this policy is updated, the revision date on this page changes.