KVKK Information Notice
Effective date: [DOLDURULACAK] · Last updated: [DOLDURULACAK]
For Customers, Customer representatives, Platform users and website visitors
This Information Notice is issued by [DOLDURULACAK] (the "Company") as controller under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. It also serves as the information required by Article 13 GDPR for data subjects covered by the GDPR; see also our Privacy Policy.
A separate notice exists for people who receive emails on behalf of our Customers: Recipient Privacy Notice.
1. Controller
[DOLDURULACAK] (Leadivo) MERSIS no.: [DOLDURULACAK] · Tax office/no.: [DOLDURULACAK] / [DOLDURULACAK] Address: [DOLDURULACAK] Email: [DOLDURULACAK] · KEP: [DOLDURULACAK] · Phone: [DOLDURULACAK] Data protection requests: [DOLDURULACAK]
2. Personal data processed, purposes and legal bases
| Data category | Purpose | Legal basis (Art. 5(2) KVKK / Art. 6(1) GDPR) |
|---|---|---|
| Identity (first and last name) | Creating and managing the account; showing the sender person in emails; contract processes | (c) contract / 6(1)(b) |
| Contact (business email, notification email, phone, address) | Sending login links; positive-reply and meeting notifications; service and security notices; support | (c) contract / 6(1)(b); (f) legitimate interest for security notices / 6(1)(f) |
| Customer transaction (company name, short name, industry, targeting segments, offer and topic texts, campaign settings, sending limits, dashboard actions) | Setting up and running the Service; reviewing and approving targeting requests; reporting | (c) contract / 6(1)(b) |
| Sender identity (legal name, MERSIS/tax ID, address, sender email) | Showing sender identity in messages under Law No. 6563 and Art. 8 of the Regulation on Commercial Communication and Commercial Electronic Messages; evidence | (ç) legal obligation / 6(1)(c); (c) contract / 6(1)(b) |
| Finance (LemonSqueezy customer/order/subscription IDs, subscription status, renewal/end dates, amount, currency) | Starting, renewing, pausing and ending subscriptions; accounting and dispute processes | (c) contract; (ç) legal obligation; (e) establishment, exercise or defence of rights / 6(1)(b), (c), (f) |
| Transaction security (IP address, session cookies, authentication records, browser information, event/audit logs, rate-limit counters) | Information security; prevention of unauthorised access and abuse; error detection; language-based redirection | (f) legitimate interest; (ç) legal obligation (Art. 12 KVKK) / 6(1)(f), (c) |
| Integration (Slack webhook URL) | Sending notifications to the channel chosen by the Customer | (c) contract / 6(1)(b) |
| Requests/complaints (support requests, applications, correspondence) | Answering requests; resolving data subject requests | (ç) legal obligation; (c) contract; (e) defence of rights / 6(1)(c), (b), (f) |
Card and payment instrument data is not processed by the Company; it is processed by LemonSqueezy, acting as Merchant of Record, as an independent controller under its own privacy policy.
No processing relies on explicit consent. Should consent-based processing (e.g. analytics cookies) be introduced, explicit consent will be obtained separately.
3. Method of collection
Personal data is collected electronically, by partly or fully automated means, through forms on the Platform and the dashboard, signed webhook notifications from the payment provider, email and support channels, and server logs and strictly necessary cookies during use of the website and Platform.
4. Recipients and purposes of transfer
| Recipient group | Purpose | Basis |
|---|---|---|
| Hosting and infrastructure providers (Vercel Inc., Supabase Inc.) | Hosting the Platform, database and authentication | Arts. 8(2)(a) and 9 KVKK (as processors) |
| Notification email provider (Resend) | Delivering login links and notifications | Arts. 8(2)(a) and 9 KVKK |
| Email sending infrastructure (Instantly.ai) | Setting up and warming Sending Mailboxes and showing sender identity in messages | Arts. 8(2)(a) and 9 KVKK |
| AI providers (Anthropic PBC and/or OpenAI) | Generating email drafts from the Customer's offer and topic texts | Arts. 8(2)(a) and 9 KVKK |
| LemonSqueezy (independent controller) | Payment, invoicing, tax collection | Arts. 8(2)(a) and 9 KVKK (performance of contract) |
| Slack workspace chosen by the Customer | Delivering notifications on the Customer's instruction | Art. 8(2)(a) KVKK |
| Competent public authorities, courts | Fulfilling legal obligations | Art. 8(2)(a) KVKK (Art. 5(2)(ç)) |
| Legal, financial and technical advisers | Protecting rights, audits | Art. 8(2)(a) KVKK (Art. 5(2)(e), (f)) |
The current sub-processor list, countries and transfer safeguards are published at Sub-processors.
International transfers
Some of the providers above are established in the United States; the main database is hosted in the [DOLDURULACAK] region. Transfers abroad are carried out under Art. 9 KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad: to countries without an adequacy decision, on the basis of one of the processing conditions in Art. 5 and by signing the standard contract published by the Turkish Personal Data Protection Board. Signed standard contracts are notified to the Turkish Personal Data Protection Authority within five business days of signature. For GDPR data subjects, the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework apply.
5. Retention periods
Retention periods are set out in detail in Section 8 of our Privacy Policy. In summary: account and operational data is deleted no later than 60 days after termination; contract and subscription records after 10 years; event and audit logs after 12 months; rate-limit counters within 24 hours at the latest.
6. Your rights (Art. 11 KVKK)
You have the right to:
a) learn whether your personal data is processed, b) request information about processing, c) learn the purpose of processing and whether data is used in line with that purpose, d) know the third parties in Turkey or abroad to whom data is transferred, e) request rectification of incomplete or inaccurate data, f) request erasure or destruction under the conditions of Art. 7 KVKK, g) request that actions under (e) and (f) be notified to third parties to whom data was transferred, h) object to a result to your detriment arising from analysis exclusively by automated systems, i) claim compensation for damage arising from unlawful processing.
GDPR data subjects additionally have the rights under Arts. 15–22 GDPR (including restriction, portability and objection) and the right to lodge a complaint with a supervisory authority.
7. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Controller, you may submit requests in Turkish (we will also accept requests in English):
- In writing: with a wet signature, in person, by registered mail with return receipt or through a notary, to [DOLDURULACAK];
- By KEP: to [DOLDURULACAK];
- With a secure electronic or mobile signature: to [DOLDURULACAK];
- By registered email: from an email address previously notified to the Company and registered in our systems, to [DOLDURULACAK].
The request must include your name, surname and, for written requests, signature; for Turkish citizens the Turkish ID number, for foreign nationals nationality and passport or ID number; residential or business address for notifications; email address for notifications if any; phone and fax number; and the subject of the request, with supporting documents attached.
Requests are resolved free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. If the action requires additional cost, the fee in the tariff set by the Turkish Personal Data Protection Board may be charged. If the request is rejected, the answer is found insufficient or no answer is given in time, you may lodge a complaint with the Turkish Personal Data Protection Board within thirty days of learning of the answer and in any case within sixty days of the application date (Art. 14 KVKK).
The Turkish version of this notice (KVKK Aydınlatma Metni) is authoritative; in case of conflict, the Turkish version prevails.