This notice is given under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for the Obligation to Inform. The Turkish text is the official version.
1. Data controller
Diyaval · MERSİS — · Selçuk University Technology Development Zone No: 67, Selçuklu, Konya, Türkiye · KEP — · [email protected]
For business data processed in the Diyaval platform and mobile app on behalf of a customer organisation, that organisation is the data controller and Diyaval is the data processor. This notice covers processing for which Diyaval itself is the controller.
2. Processing activities
| Activity | Data | Purpose | Legal basis (KVKK Art. 5) | Retention |
|---|---|---|---|---|
| Contact form and correspondence | Identity, contact, company, message, IP address | Answering requests, preparing offers | 5(2)(c) steps before a contract; 5(2)(f) legitimate interest | 2 years after closure |
| Orders and invoicing | Identity, contact, tax/identity number, address, order and payment result, approval records, IP address | Concluding and performing the contract, invoicing, refunds | 5(2)(c) contract; 5(2)(ç) legal obligation | 10 years |
| Customer account and support | Identity, contact, role, support messages, account activity | Opening accounts, activation, support, renewal notices | 5(2)(c) contract; 5(2)(f) legitimate interest | Contract term + 10 years |
| Commercial electronic messages | Name, email, mobile number, consent record | Product and campaign news | Explicit consent under Law No. 6563 | Until withdrawal; consent record 3 years after withdrawal |
| Website security | IP address, time, requested address, browser information | Detecting attacks, protecting systems | 5(2)(f) legitimate interest | 1 year |
| Legal claims | Any of the above relevant to a dispute | Establishing, exercising or defending rights | 5(2)(e) | Limitation period of the claim |
3. Method of collection
Data is collected electronically through website forms, the checkout, email, telephone and automatically recorded server logs, and from the payment institution (payment result only).
4. Recipients
Hosting provider (—); email provider Yandex 360 (Yandex LLC); Cloudflare, Inc. (contact form only); the licensed payment institution and banks; the Revenue Administration and e-document infrastructure; our accountant, auditors and legal advisers; authorised public bodies when legally required. Transfers abroad (email and Cloudflare) are carried out under KVKK Article 9 on the basis of standard contractual clauses notified to the Authority.
5. Your rights (Article 11)
You may learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, learn the recipients in Türkiye or abroad, request correction, request deletion or destruction, request notification of these to recipients, object to a result arising exclusively from automated analysis, and claim compensation for unlawful processing. Apply as described on the Data Subject Application page; we respond within 30 days.