Under Law No. 6698 on the Protection of Personal Data ("KVKK"), we, as CHEXTA YAZILIM TEKNOLOJİLERİ A.Ş., in our capacity as data controller, would like to inform you about the processing of your personal data.

1. Data Controller

Your personal data is processed by CHEXTA YAZILIM TEKNOLOJİLERİ A.Ş. in its capacity as data controller, for the purposes explained below and in compliance with the conditions set out in the KVKK (Turkish Personal Data Protection Law).

2. Personal Data Processed

Personal data is processed by our company in the following categories:

• Identity data: First name, last name, T.R. identity number, date of birth
• Contact data: Email address, phone number, address information
• Customer transaction data: Order details, request and complaint records, service usage history
• Financial data: Invoice information, payment records, bank account details
• Digital footprint data: IP address, cookie records, session information, log records
• Marketing data: Service usage habits, preferences and survey responses

3. Processing Purposes

Your personal data is processed for the following purposes:

• Carrying out processes for the establishment and performance of the contract
• Providing our services and improving their quality
• Customer relationship management and provision of support services
• Carrying out billing and accounting operations
• Fulfillment of legal and regulatory obligations
• Carrying out information security processes
• Carrying out marketing and promotional activities (within explicit consent)
• Carrying out statistical studies and analyses

4. Transfer of Data

Your personal data may be transferred to the following parties in order to fulfill the purposes stated above and in compliance with the conditions set out in Articles 8 and 9 of the KVKK:

• Our partners and service providers
• Authorized public institutions and organizations within the scope of legal obligations
• Payment infrastructure providers
• Cloud computing and hosting service providers

5. Collection Method and Legal Grounds

Your personal data is collected through the website, mobile application, email, telephone and physical channels by automated and non-automated means. This data is processed based on the following legal grounds set out in Article 5 of the KVKK:

• Your explicit consent being present
• Being directly related to the establishment or performance of a contract
• Enabling the data controller to fulfil its legal obligations
• Being mandatory for the establishment, exercise or protection of a right
• Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

6. Rights of the Data Subject (KVKK Article 11)

Under Article 11 of the KVKK, you have the following rights:

• To learn whether your personal data is being processed
• To request information about whether your personal data has been processed
• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose
• Knowing the third parties to whom personal data is transferred domestically or abroad
• To request the correction of personal data if it has been processed incompletely or incorrectly
• Requesting the deletion or destruction of personal data within the conditions stipulated in Article 7 of the KVKK
• To request that correction, deletion and destruction operations be notified to third parties to whom personal data has been transferred
• To object to an outcome arising against the person themselves as a result of the processed data being analyzed exclusively through automated systems
• To claim compensation for damages suffered due to the unlawful processing of personal data

7. Application Method

You can submit your requests regarding the rights listed above, together with documents establishing your identity, using the following methods:

• Email: By sending it to [email protected] signed with a secure electronic signature or from the e-mail address registered in the system
• Written application: By sending it to our company address through a notary or by registered mail with return receipt

Your applications will be addressed as quickly as possible, depending on the nature of your request, and no later than 30 (thirty) days will be concluded free of charge within. If the process requires an additional cost, a fee may be charged based on the tariff determined by the Personal Data Protection Board.