KVKK data protection notice

This notice has been prepared in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK” or the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It is addressed to everyone (“you”) who visits our website, contacts us, requests a quote, purchases our services or makes a payment through our payment page.

1. Data controller

Your personal data is processed by the data controller, Alican Turan, a natural person trading under the name canturan.dev. In this notice, “we” and “us” refer to the data controller.

As the data controller is established in Türkiye, no data controller’s representative has been appointed. You may send any question about your personal data directly to info@canturan.dev.

2. Categories of personal data processed

We process only the data that the service requires. Depending on the nature of our relationship, this may include:

About the Turkish national ID number: under the payment services regulations, iyzico may ask for the payer’s Turkish national ID number. This number is passed only to iyzico during the payment; we do not record it separately and do not use it for any other purpose.

We do not process special categories of personal data such as health, religious or biometric data. Please do not include such information in forms or correspondence.

With regard to data belonging to your customers or employees that is held in systems you give us access to for a project, you are the data controller; we process that data as a data processor, solely on your instructions and for the purposes of the project.

3. Purposes of processing and legal grounds

We match every processing activity to one of the legal grounds listed in Article 5 of the KVKK:

Should any processing arise that does not rest on one of these legal grounds (for example, sending newsletters or promotional messages), we will carry it out only on the basis of your explicit consent, obtained separately. You may withdraw your explicit consent at any time; withdrawal takes effect for the future. We do not currently send commercial electronic messages; should we do so, we will obtain your prior consent under Law No. 6563 on the Regulation of Electronic Commerce.

4. How we collect personal data

We collect your personal data by partly or fully automated means through the following channels:

• Electronically, through the contact form and the payment page on our website;
• Through information you share with us directly by email, phone, WhatsApp and video call;
• Through documents you share during the quote, contract, order and project stages;
• Through transaction outcome data received from iyzico for card payments;
• Through server logs generated automatically by the hosting infrastructure when you visit the site.

The site does not use cookies for analytics, advertising or tracking. For details, please see our cookie policy.

5. Transfers of personal data

We transfer your personal data to the recipient groups below only to the extent necessary for the purposes set out above and in accordance with Articles 8 and 9 of the KVKK. We do not sell or rent your data, nor share it with third parties for marketing purposes.

Transfers abroad

Transfers to service providers established abroad are carried out under Article 9 of the KVKK as amended by Law No. 7499. As no adequacy decision has been issued by the Personal Data Protection Board (the “Board”) for these countries, transfers are based on appropriate safeguards under Art. 9(4), in particular the standard contracts published by the Board; standard contracts are notified to the Personal Data Protection Authority within five business days of signature. In exceptional cases where appropriate safeguards cannot be provided and the transfer is occasional, we rely on the grounds listed in Art. 9(6), for example where the transfer is necessary for the performance of a contract with you, or on your explicit consent.

6. Retention periods

We retain your personal data for as long as is necessary for the purpose of processing and required by law:

Once the retention period has expired, data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. This takes place in the first periodic destruction cycle following the end of the period and in any event within 6 months.

7. Data security

In accordance with Article 12 of the KVKK, we take appropriate technical and organisational measures to prevent unlawful processing of and unlawful access to your data and to ensure its safekeeping:

• All traffic to the site is encrypted with HTTPS (TLS).
• Card data is processed only within iyzico’s PCI DSS-compliant payment infrastructure; payments are authenticated with 3D Secure.
• Access to hosting, email and administrative accounts is restricted to the data controller; these accounts are protected by strong passwords and, wherever possible, two-factor authentication.
• API keys and access credentials are kept in encrypted environment variables, not in the source code.
• Access credentials you give us for a project are used solely for that project; at the end of the project we remind you to change them.
• We collect only the data we need and delete data that is no longer required.
• The data processors we work with are contractually bound to keep data secure. In line with KVKK Art. 12(2), we accept joint responsibility with these providers towards you for their processing.

If the data we process is obtained by others through unlawful means, we will notify you as soon as possible and notify the Board within the period it has set (72 hours from becoming aware).

8. Your rights under KVKK Article 11

By applying to the data controller, you have the right to:

1. learn whether your personal data is being processed;
2. request information about the processing if it has been processed;
3. learn the purpose of the processing and whether the data is used in line with that purpose;
4. know the third parties in Türkiye or abroad to whom your personal data has been transferred;
5. request rectification if the data has been processed incompletely or inaccurately;
6. request erasure or destruction under the conditions set out in KVKK Art. 7;
7. request that rectification, erasure or destruction be notified to the third parties to whom the data has been transferred;
8. object to an outcome to your detriment that results from analysis of the processed data exclusively by automated systems;
9. claim compensation for damage you suffer as a result of the unlawful processing of your personal data.

These rights may be restricted in the cases listed in KVKK Art. 28.

9. How to submit a request

In accordance with Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request in Turkish by one of the following means:

• By a petition bearing your handwritten signature, delivered in person, by post or through a notary public: Mehmet Akif Ersoy Mah. 2135. Sokak No: 14/5, Esenyurt / İstanbul
• Signed with a secure electronic signature or mobile signature, sent to info@canturan.dev;
• From an email address you have previously given us and which is on our records, sent to info@canturan.dev with the subject line “KVKK Bilgi Talebi” (KVKK information request).

Your request must include:

• your first name, surname and, for written requests, your signature;
• for Turkish citizens, the Turkish national ID number; for foreign nationals, nationality and passport number or, if available, ID number;
• your residential or business address for service;
• if available, an email address, phone or fax number for notifications;
• the subject of the request and, if any, supporting documents.

Requests made on behalf of another person require a specific power of attorney. We may ask for additional information to verify your identity. We conclude your request free of charge as soon as possible, depending on its nature, and within 30 days at the latest; if the process entails an additional cost, we may charge the fee set out in the tariff determined by the Board. We send our response in writing or electronically.

If your request is rejected, you find our response insufficient or we do not respond in time, you may lodge a complaint with the Board within 30 days of learning of our response and in any event within 60 days of the date of your request (KVKK Art. 14).

10. VERBİS

Whether the data controller is obliged to register with the Data Controllers’ Registry Information System (VERBİS) is assessed against the criteria in the Board’s exemption decisions (annual number of employees, annual balance sheet total and main field of activity). If registration is made, the registry details will be added to this notice.

11. Children’s data

Our services are intended for persons aged 18 or over and for businesses. We do not knowingly process data relating to anyone under 18; if we become aware of such a case, we delete the data concerned.

12. Changes

We may update this notice to reflect changes in the law or in our processing activities. The current version is always published on this page together with the date of the last update; we will announce material changes separately. For a plain-language summary of the site’s general data practices, please see our privacy policy.