Privacy Notice (KVKK)

The Turkish text is the binding version; this English text is a courtesy translation.

This translation is provided for convenience; the Turkish text prevails.

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to the people who use iyibir Cloud (Accounts, the iyibir Cloud panel and the cloud products). It is not a consent form; confirming that you have read it is enough.

1. Data controller

İyibir Yazılım ve Teknoloji San. Tic. Ltd. Şti. ("iyibir")

• Address: 23 Nisan Mahallesi Atabulvarı Guzell Tower İş Merkezi No:2, 16230 Nilüfer / Bursa, Türkiye
• MERSIS: 0211110454100001
• KEP/UETS address: 25888-88785-45978
• E-mail: destek@iyibiryazilim.com.tr
• Phone: +90 850 808 28 81

2. What this notice covers

This notice covers data for which iyibir is the data controller: your account, the commercial relationship between your company and iyibir, support and security.

The business data your company processes in the cloud products (Logo ERP and payroll data, documents uploaded to the products, chat and board content, WMS and Workforce records) is outside this notice. Your company is the data controller of that data; iyibir processes it on your company's instructions, as a data processor, under the Data Processing Agreement. For information and requests about that data, contact your company.

3. Data we process, purposes and legal bases

3.1 Registration and account

• Data: full name, work e-mail address, phone (if you give it), the company's legal name and tax number, a one-way hash of your password, your user role and authority in the company, your language and theme preference.
• Purpose: to open the account, verify your e-mail address, let you sign in, manage your company's users and their permissions, and give single sign-on access to the products.
• Legal basis: necessary to conclude and perform the contract (KVKK Art. 5/2-c).

3.2 Buying credits, invoicing and payment

• Data: name and e-mail of the person acting for the company and the action taken (buying a credit pack, starting or ending a monthly credit subscription), contract and invoice details, the company's tax number, billing address, telephone and billing e-mail, payment records (amount, exchange rate, status, the payment provider's transaction number, the IP address at the time of payment) and reminder records. Your card details are not part of this data: you enter them directly on iyzico's payment page, and iyibir neither sees nor stores them.
• Purpose: to sell credits and load them into the wallet, run the monthly credit subscription, take payment through iyzico and reconcile it, invoice, follow up collection, send payment and credit reminders, and keep commercial books and records.
• Legal basis: performance of the contract (Art. 5/2-c) and legal obligation (Art. 5/2-ç; Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253).

3.3 Records of agreement acceptance

• Data: the name and version of the document you accepted, the content fingerprint of the text, the person and company accepting, the time of acceptance, your IP address and browser information.
• Purpose: to be able to prove which text was accepted, by whom and when.
• Legal basis: conclusion of the contract (Art. 5/2-c) and necessity for establishing, exercising or protecting a right (Art. 5/2-e).

3.4 Support requests and communication

• Data: the content of requests, files you attach, correspondence, the work done and time spent by the support team, your satisfaction rating, your conversations with iyibir Assistant.
• Purpose: to resolve your request, deliver the service under your company's contract and record billable work, and measure service quality.
• Legal basis: performance of the contract (Art. 5/2-c) and iyibir's legitimate interest in improving service quality (Art. 5/2-f).

3.5 Security and technical records

• Data: sign-in and sign-out times, failed sign-in attempts, IP address, browser information, request logs, error and performance logs, PaaS Agent connection status.
• Purpose: to protect your account and the Service against unauthorised access, find and fix faults, prevent misuse, and meet obligations under Law No. 5651.
• Legal basis: legal obligation (Art. 5/2-ç) and iyibir's legitimate interest in keeping the Service secure (Art. 5/2-f).

3.6 Service notices

• Data: full name, e-mail address, notification preferences.
• Purpose: to send the necessary notices about the account, credit balance and expiring credits, payments, invoices, security, agreement changes and support requests.
• Legal basis: performance of the contract (Art. 5/2-c).

3.7 Promotional and campaign messages

• Data: full name, e-mail address, phone, consent and opt-out records.
• Purpose: to send messages about iyibir products, news, events and campaigns.
• Legal basis: only the separate and optional commercial communication consent you give (KVKK Art. 5/1, Law No. 6563 Art. 6). Not giving it does not affect your use of the Service; you can withdraw it at any time.

3.8 Credit use

• Data: which user or digital employee spent how many credits, in which cloud product, when and for which job; for language model use, the company, a pseudonymous (hashed) identifier of the person, the type of job, the amount used and the cost. The content of your questions and answers is not written to these records.
• Purpose: to deduct credits spent from your company's wallet correctly; to show you your own spending and your company's authorised person all spending in the company; to control cost; to prevent misuse and limit the rate of use.
• Legal basis: performance of the contract (Art. 5/2-c) and iyibir's legitimate interest in controlling the cost and security of the Service (Art. 5/2-f).

4. How we collect data

We collect your data, partly or wholly by automated means, from the sign-up and sign-in screens, the panel and the products, requests you make by e-mail and phone, the invitation sent by your company's authorised person, and the records our servers keep while you use the Service.

5. Who we share it with

We share your data with the following recipients only as far as the purposes above require:

• RNG Bilişim Teknolojileri San. ve Tic. Ltd. Şti. (Türkiye): the servers and databases of the Service are hosted on RNG Bilişim's infrastructure in Türkiye; your data is stored in Türkiye.
• OpenAI, L.L.C. (USA): questions you type into iyibir Assistant and the cloud products, and the information needed to build the answer, are sent to the language model through iyibir's model gateway, which runs on iyibir's server in Türkiye and records no content. Requests are sent with storage switched off; OpenAI does not store requests or answers (except OpenAI's abuse-monitoring logs, kept for at most 30 days), processes them only at the time of the request and does not use them to train its models. As the processing takes place in the USA, this is a transfer abroad.
• Vercel Inc. (USA): the files of the panel and websites are served through Vercel; when you open a page your IP address and request details enter Vercel's logs.
• Google (Google Workspace): iyibir's e-mails (iyibiryazilim.com.tr domain) are sent and received through the Gmail infrastructure of Google Workspace; your e-mail address and message content are processed on Google's servers outside Türkiye.
• İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico, Türkiye): credit and invoice payments are taken on iyzico's payment page. The paying person's name, e-mail and IP address and the company's legal name, tax number, billing address and telephone are passed to iyzico; you enter your card details directly with iyzico. iyzico also processes this data itself for its obligations under payment services law.
• Your company's authorised persons: your company's authorised person sees the company's users, their roles, their actions and each one's credit spending.
• Our advisers: accountant and legal counsel, only as far as our obligations require.
• Competent public authorities: on the request of authorities empowered by law or where the law requires it.

Your data is not sold or rented to third parties for marketing.

6. Transfers abroad

Transfers to OpenAI, Google and Vercel are transfers abroad. OpenAI not storing requests does not change this: the data leaves Türkiye to be processed. As there is no adequacy decision of the Personal Data Protection Board for these countries, the transfers are made under Article 9 KVKK with the standard contract published by the Board, and the contract is notified to the Personal Data Protection Authority within 5 business days of signature.

7. Retention

• Account data: while your account is open; after it closes, 10 years for claims that may arise from the contractual relationship (Turkish Code of Obligations Art. 146).
• Contract, invoice and payment records and wallet movements: 10 years (Turkish Commercial Code Art. 82).
• Usage records of the model gateway: 12 months.
• Acceptance records: for the term of the agreement and 10 years after it ends.
• Support requests: while the relationship with your company lasts and 10 years after.
• Security and technical records: application logs 14 days, monitoring data up to 30 days; traffic records under Law No. 5651 2 years.
• Commercial communication consent and opt-out records: while the consent lasts and, after withdrawal, for the period the law sets for proof.

When the period ends the data is deleted, destroyed or anonymised.

8. Your rights

Under Article 11 KVKK you may ask iyibir to:

• tell you whether your personal data is processed and, if so, give information about it;
• tell you the purpose of processing and whether it is used accordingly;
• tell you the third parties in Türkiye or abroad to whom it is transferred;
• correct it if it is incomplete or inaccurate;
• delete or destroy it under the conditions of Article 7 KVKK;
• notify correction, deletion and destruction to the third parties it was transferred to;
• object to a result against you arising solely from automated analysis;
• compensate damage you suffer from unlawful processing.

9. How to apply

Send your request in Turkish and in writing, stating your identity and request clearly, by one of these routes:

• a signed letter to iyibir's address;
• to our KEP address, with a secure electronic or mobile signature;
• from the e-mail address registered in your iyibir Cloud account to destek@iyibiryazilim.com.tr.

We conclude your request free of charge within 30 days at the latest, depending on its nature. If it involves additional cost, the fee schedule set by the Board may apply. If your request is refused, you find the answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board.

10. Changes

We update this notice as our processing changes. A new version is announced in the panel and to your registered e-mail address and shown to you to read at your next sign-in.