SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ PRIVACY POLICY FOREWORD
As SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ, we attach importance to the protection of your personal data and/or special categories of personal data within the scope of the Law on the Protection of Personal Data. We are sensitive to the storage of all personal data and/or special categories of personal data belonging to you that are communicated to our Company through various channels. In this context, as SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ, we have taken the necessary technical and administrative measures in order to comply with the provisions of the Law No. 6698 on the Protection of Personal Data in particular, the Constitution of the Republic of Türkiye and other legislation. We would also like to emphasise that we will protect your rights guaranteed by law. In this context, you may safely share your personal data with SERVİSSOFT ANONİM ŞİRKETİ and communicate your suggestions, complaints and concerns to us.
We hereby share with you our Privacy Policy, which has been put into effect within SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ, which attaches particular importance to the protection of your personal data.
SERVİSSOFT ANONİM ŞİRKETİ
1. DEFINITIONS
Term
Definition
Data Controller
Refers to SERVİSSOFT ANONİM ŞİRKETİ, which determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system.
Data Owner – Data Subject
Refers to the natural person whose personal data is processed.
Company
Refers, for the purposes of this Policy, to SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ.
Law
Refers to the “Law No. 6698 on the Protection of Personal Data”.
Personal Data
Refers to any information relating to an identified or identifiable natural person.
Special Categories of Personal Data
Refers to data relating to persons’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Board
Refers to the Personal Data Protection Board.
Policy
Refers to this “Privacy Policy”.
Processing of Personal Data
Refers to any operation performed on data, such as obtaining, recording, storing, preserving, altering, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, wholly or partly by automated means or by non-automated means provided that it forms part of a data filing system.
Explicit Consent
Refers to consent relating to a specific matter, based on information and given with free will.
Destruction
Refers to rendering personal data inaccessible, irretrievable and unusable again by anyone in any way.
Erasure
Refers to rendering personal data inaccessible and unusable again in any way for the relevant users.
Anonymisation
Refers to rendering personal data impossible to associate in any way with an identified or identifiable natural person, even by matching it with other data.
Disposal
Refers to the erasure, destruction or anonymisation of personal data.
Data
Refers to personal data and special categories of personal data together.
2. PURPOSE OF THE PRIVACY POLICY
The protection of personal data and compliance with the law is our fundamental principle. In all of our work as SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ (hereinafter referred to as “SERVİSSOFT” or the “Company”), the personal data and/or special categories of personal data that we have received from you have been kept confidential and have not been shared with third parties. In this context, our company has always shown the necessary sensitivity regarding the protection of personal data and/or special categories of personal data. Furthermore, pursuant to the Law No. 6698 on the Protection of Personal Data (hereinafter referred to as the “Law” or “KVKK”), our internal regulations have been revised and technical and administrative measures have been taken. Going forward, as SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ, we accept, declare and undertake to comply with all obligations imposed by the Law.
3. SCOPE OF THE PRIVACY POLICY
This Privacy Policy has been prepared in accordance with the Law No. 6698 on the Protection of Personal Data.
Your personal data and/or special categories of personal data are processed with your consent or within the scope of the cases of lawfulness provided by law. Such data is used for the purposes of:
ensuring the security of the Company,
providing you with complete services,
conducting our commercial activities,
resolving your issues promptly,
improving our quality.
Certain personal data and/or special categories of personal data received from you are de-identified and anonymised in accordance with the procedures provided by the Law. Data used for statistical purposes currently falls outside the regulation of the Law and the scope of our Policy. As SERVİSSOFT, we reserve the right to amend this Policy for the purpose of protecting personal data in compliance with the Law.
The Privacy Policy aims to protect the data, obtained by any means, of the natural and legal persons with whom SERVİSSOFT has solution partnerships, its customers, its employees and all other persons. In this context, it contains various provisions intended to achieve this objective.
- FUNDAMENTAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA Our fundamental principles regarding the processing of personal data and/or special categories of personal data are set out below. In this context, these principles shall apply to data processed by SERVİSSOFT on the basis of explicit consent or within the scope of the cases of lawfulness provided by the Law.
- Lawfulness: SERVİSSOFT examines the source and lawfulness of the personal data and/or special categories of personal data that it receives from natural and legal persons and collects through various channels. In this context, obtaining data lawfully is of importance to SERVİSSOFT.
- Compliance with the Principles of Good Faith: SERVİSSOFT examines the source of the personal data and/or special categories of personal data that it receives from natural and legal persons and collects through various channels. In this context, obtaining data within the framework of the principles of good faith is of importance to SERVİSSOFT.
- Being Limited, Proportionate and Relevant to the Purposes for which they are Processed: SERVİSSOFT uses the personal data and/or special categories of personal data it obtains through various channels in a manner consistent with, limited to and proportionate to the purpose of processing, and to the extent required for the performance of the service.
- Accuracy of Personal Data and/or Special Categories of Personal Data: SERVİSSOFT attaches importance to ensuring that the personal data and/or special categories of personal data that it receives from natural and legal persons and collects through various channels do not contain incorrect information and are accurate. However, SERVİSSOFT is not obliged to investigate the accuracy of the personal data and/or special categories of personal data declared by its customers or by the natural and legal persons with whom it is in contact, since this is not possible legally or in line with our working principles.
- Being Kept Up to Date Where Necessary: Where there has been a change in the personal data and/or special categories of personal data obtained by SERVİSSOFT in various ways, SERVİSSOFT attaches importance to such change being communicated to the Company and, once communicated, to the data being updated.
- Processing for Specified and Legitimate Purposes: SERVİSSOFT processes personal data and/or special categories of personal data on the basis of the explicit consent given by the data subject or, without obtaining explicit consent, within the framework of the exceptions provided by law. The purpose of processing of each item of data is specified, and no personal data processing activity is carried out for any illegitimate purpose.
- Retention for the Period Provided for in the Law and/or Necessary for the Purposes for which they are Processed: SERVİSSOFT retains the personal data and/or special categories of personal data it obtains for the periods provided for in the relevant laws and/or necessary for the purposes for which they are processed. When such purposes cease to exist, it anonymises, destroys or erases the data.
5. ERASURE, DESTRUCTION AND ANONYMISATION OF PERSONAL DATA
Your personal data and/or special categories of personal data are erased, destroyed or anonymised upon the expiry of the limitation and retention periods provided for in the Law, the completion of judicial proceedings or the cessation of other requirements relevant to the purpose. Erasure, destruction and anonymisation operations are carried out upon the request of the relevant data subject or ex officio (of its own motion) by SERVİSSOFT.
6. PRINCIPLE OF DATA MINIMISATION
The principle of data minimisation (parsimony) is also known as the principle of maximum economy. Personal data and/or special categories of personal data reaching us through various channels are transferred to our company’s system. Pursuant to this principle, data is processed in the system only to the extent necessary.
The data to be collected by SERVİSSOFT is determined in line with the purpose and varies accordingly. In this context, data is collected in line with the purpose, and data that is not consistent with the purpose is not collected. Excess data beyond the purpose is not recorded in the company system and is erased, destroyed or anonymised. However, such data may be used for statistical purposes.
7. CONFIDENTIALITY AND SECURITY OF DATA
As SERVİSSOFT, we attach importance to the confidentiality of your personal data and/or special categories of personal data. In this context, your personal data and/or special categories of personal data reaching our Company by any means are confidential. SERVİSSOFT observes the confidentiality of such data at every stage of its commercial activities. In this context, full compliance with this company privacy policy is ensured.
The necessary technical and administrative measures are taken to prevent personal data and/or special categories of personal data collected through various channels from falling into the hands of unauthorised persons, to prevent harm to the rights of data subjects or their being aggrieved, and to protect the data. In addition, within the framework of lawfulness, data protection is also requested, where necessary, from third parties with whom we share personal data and/or special categories of personal data. Furthermore, our software programs are updated and continuously renewed. In order to ensure a high level of protection, technological requirements are met and compliance with standards is ensured.
8. KEEPING DATA UP TO DATE
The principle of keeping data up to date is fundamental within SERVİSSOFT, since personal data and/or special categories of personal data obtained in various ways may be updated where necessary or upon request. The necessary measures regarding updating are also taken by SERVİSSOFT.
9. ACCURACY OF DATA
The principle of accuracy of the personal data and/or special categories of personal data declared has been adopted by SERVİSSOFT. SERVİSSOFT is not obliged to investigate the accuracy of the personal data and/or special categories of personal data declared by its customers or by the natural and legal persons with whom it is in contact, since this is not possible legally or in line with our working principles. In this context, operations are carried out on the basis that the declared data is accurate.
10. PURPOSES OF PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA
The processing of personal data and/or special categories of personal data is carried out in line with the purposes set out in the Information Notices of SERVİSSOFT ANONİM ŞİRKETİ. Such Information Notices may vary depending on the personal data and/or special categories of personal data processed. In parallel with the differences in the Information Notices, the purposes of processing of personal data and/or special categories of personal data may also vary.
11. PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA FOR ADVERTISING PURPOSES
The recipient’s approval must be obtained for electronic messages sent for advertising purposes. In this context, electronic messages for advertising purposes may only be sent to persons from whom approval has been obtained in advance. This matter is also expressly regulated in the “Law on the Regulation of Electronic Commerce” and the “Regulation on Commercial Communications and Commercial Electronic Messages”.
SERVİSSOFT acts in accordance with the above-mentioned legislation when sending commercial electronic messages for advertising purposes. Likewise, in accordance with the legislation, the obtaining of approval and the details of such approval are observed. Such approval may be obtained through any electronic communication means or in writing in a physical medium. The essential elements of the approval are the existence of an affirmative declaration of will by the recipient of the commercial electronic message that he or she accepts the sending of commercial electronic messages, together with his or her electronic communication address and name and surname.
The approval obtained from the recipient covers all commercial electronic messages sent to electronic communication addresses for the purposes of marketing and promoting the company’s goods and services, promoting its business, ensuring its recognition, and increasing its recognition through content such as celebrations, wishes and congratulations.
In addition to all of the above, before commercial electronic messages are sent, persons are informed that their data may be processed and, where necessary, their explicit consent is obtained. When sending such commercial messages, the provisions of the Law No. 6698 on the Protection of Personal Data are also complied with.
- COLLECTION AND PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA WITHIN A CONTRACTUAL RELATIONSHIP Where a contractual relationship has been established with customers or prospective customers, the personal data collected pursuant to the contract may be processed by SERVİSSOFT without obtaining explicit consent. Where special categories of personal data are to be processed, data may be processed on the basis of explicit consent or of the legal grounds under Article 6 of the Law. Such data is used within the framework of the performance of goods and/or services, the execution of the contract and the conduct of commercial activities. Such data may be updated at any time by contacting customers.
13. PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA PROCESSED THROUGH AUTOMATED SYSTEMS
Data derived from information obtained through automated systems without the explicit consent of the persons concerned may not be used against those persons. SERVİSSOFT acts in accordance with the provisions of the relevant legislation with respect to personal data and/or special categories of personal data processed through automated systems.
14. PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA OF SERVİSSOFT EMPLOYEES
PROCESSING WITHIN THE FRAMEWORK OF LEGAL OBLIGATIONS: Personal data of employees may be processed by SERVİSSOFT without obtaining their explicit consent where the processing of the data is expressly provided for in the relevant Law or for the purpose of fulfilling the legal obligation of the data controller.
PROCESSING OF PERSONAL DATA PURSUANT TO THE EMPLOYMENT CONTRACT AND EMPLOYMENT RELATIONSHIP: Personal data of employees may be processed without obtaining their explicit consent, within the framework of proportionality, to the extent necessary to maintain the employment relationship between the company and the employees. SERVİSSOFT undertakes, under all circumstances, to protect employees’ data, to keep it confidential and to take the necessary measures in this regard.
PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA OF EMPLOYEES: Pursuant to the Law No. 6698 on the Protection of Personal Data, the processing of special categories of personal data requires the explicit consent of the person whose data is to be processed and, in addition, the taking of the necessary measures prescribed by the Board. When processing special categories of personal data in compliance with Law No. 6698 and the principles of the Board, SERVİSSOFT obtains, where necessary, both the explicit consent of the data subject and the necessary measures determined by the Board. However, special categories of personal data may be processed without the explicit consent of the data subject in the exceptional cases provided for in the Law, provided that such processing is limited and proportionate.
PERSONAL DATA PROCESSED THROUGH AUTOMATED SYSTEMS: Certain personal data of employees may be processed in automated systems. Such data is used in the performance evaluation of employees, the keeping of statistical data, and promotions and scoring within the company. Employees have the right to object to adverse results arising in respect of them. The objection must be made in accordance with the company’s internal rules and procedures. Such objection is subject to evaluation within the company.
PROCESSING OF PERSONAL DATA FOR THE BENEFIT OF EMPLOYEES:
Personal data of employees may be processed by SERVİSSOFT without obtaining explicit consent for transactions in the employee’s interest within the framework of the relationship established by the employment contract. Likewise, in disputes relating to the employment relationship with SERVİSSOFT, the Company may process the personal data of employees.
IN-HOUSE TELECOMMUNICATIONS, INTERNET AND COMMUNICATION:
In order to facilitate the performance of work, computers, telephones, vehicles, applications, software and e-mail may be allocated by SERVİSSOFT to in-house employees. SERVİSSOFT may check and monitor the personal data on the tools it allocates. However, at this point SERVİSSOFT also fulfils the necessary Obligation to Inform.
The employee, in turn, may not use the tools allocated to him or her for private purposes. The employee is obliged to use them solely for the purpose of performing the work. Likewise, the employee accepts, declares and undertakes that, from the moment the working relationship with SERVİSSOFT commences, he or she will not keep any data or information on the allocated tools other than that relating to the work and the requirements of the work.
15. AUDIT AND PROCESSING SECURITY
The necessary technical and administrative measures are taken to prevent personal data and/or special categories of personal data collected through various channels from falling into the hands of unauthorised persons, to prevent harm to the rights of data subjects or their being aggrieved, and to protect the data. In addition, within the framework of lawfulness, data protection is also requested, where necessary, from the companies with which we share personal data and/or special categories of personal data. Furthermore, our software programs are updated, continuously renewed and developed. In order to ensure a high level of protection, all technological requirements are met and compliance with standards is ensured. In parallel with all of the above, SERVİSSOFT has all necessary internal and external audits carried out in order to protect personal data and/or special categories of personal data.
16. NOTIFICATION OF DATA BREACHES
In the event of any breach relating to data, SERVİSSOFT acts immediately to do what is required of it to remedy the breaches notified to it. It takes the necessary measures to minimise the damage suffered by the data subject. You may submit an application for the notification of breaches in accordance with the procedures specified on our company’s website. In addition, where personal data and/or special categories of personal data fall into the hands of unauthorised third parties from outside, the company notifies this matter directly to the Personal Data Protection Board.
17. RIGHTS OF THE DATA SUBJECT REQUESTING INFORMATION
The rights of the data subject are set out in Article 11 of the Law No. 6698 on the Protection of Personal Data. SERVİSSOFT acknowledges that, pursuant to the Law, the data subject must be informed and, where necessary, his or her explicit consent obtained before data is processed and that, after the data has been processed, the data subject has the right to request information about his or her data and to have it updated, erased, destroyed and anonymised.
By means of the “Information Request Form pursuant to the Law No. 6698 on the Protection of Personal Data”, data subjects have the following rights regarding their data:
a) To learn whether personal data is being processed, b) If personal data has been processed, to request information in this regard, c) To learn the purpose of processing of personal data and whether they are used in accordance with their purpose, ç) To know the third parties to whom personal data is transferred domestically or abroad, d) To request the rectification of personal data if it has been processed incompletely or inaccurately, e) To request the erasure or destruction of personal data within the framework of the conditions set out in Article 7 of the Law, entitled “Erasure, destruction or anonymisation of personal data”, f) To request that the third parties to whom personal data has been transferred be notified of the rectification of incompletely or inaccurately processed data, or of the erasure or destruction of the data upon the data subject’s request, g) To object to the occurrence of a result against the person himself or herself by means of the analysis of the processed data exclusively through automated systems, h) To request compensation for damages in the event of suffering damage due to the unlawful processing of personal data. Requests for information made on behalf of another person will not be answered by the company. If SERVİSSOFT determines that an information request has been submitted on behalf of another person, all rights of SERVİSSOFT to bring any action or claim are reserved. The requests of the data subject will be answered as soon as possible and at the latest within thirty days from the date on which they reach SERVİSSOFT. SERVİSSOFT may, if it deems necessary, request further information and documents from the data subject submitting the application.
Example Form:
19. UPDATES
Changes made to this Privacy Policy are listed and shown in the table below.
Policy Update Date
Changes
12.06.2020
Legal compliance and text amendments
21.11.2024
Compliance and text updates under the new KVKK
03.05.2025
Legal compliance and text amendments
17.04.2026
Legal compliance and text amendments
This Privacy Policy has been prepared in Turkish and English. In the event of any conflict or discrepancy in interpretation between the two versions, the Turkish version shall prevail.
SERVİSSOFT ARAŞTIRMA GELİŞTİRME DANIŞMANLIK YAZILIM HİZMETLERİ ANONİM ŞİRKETİ