Data controller information notice under Turkish PDPL (Law No. 6698, Art. 10) and GDPR.
This notice is prepared under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR") by Ali Enis Tekin ("Data Controller"), operator of the Teknik Danışman platform, regarding the processing of personal data of panel users.
| Data Controller | Ali Enis Tekin |
|---|---|
| Address | ADNAN KAHVECİ MAH. HASBAHÇE CAD. HASBAHÇE HASBAHÇE SİTESİ A2 BLOK NO: 1 A İÇ KAPI NO: 3 Beylikdüzü / İstanbul 34528 |
| Contact | legal@teknikdanisman.net |
| KVKK Contact Person | kvkk@teknikdanisman.net |
| VERBİS Registration No | VERBİS registration is in progress; this field will be updated with the registration number once issued. Until then, data subject requests continue to be handled directly via the channels in Section 6. |
The following categories of data may be processed in the course of providing our service:
| Category | Data Type | Source |
|---|---|---|
| Identity | Name, surname, username, Turkish ID no. (only if the employer uploads it for HR documents) | User / Employer |
| Contact | Email address, phone, address | User / Employer |
| Employee | Position, department, start/end date, leave/warning records | Employer |
| Transaction security | IP address, session data, browser/device info, MFA status, audit log | Automatically collected |
| Technical access | Branch network configuration (static IP, subnet, gateway, DNS), modem/router panel credentials, service and license access credentials — all stored AES-256 encrypted | Employer |
| Employee usage / behaviour | SaaS tools used without IT approval (Shadow SaaS detection), usage frequency and department attribution — only when the Customer enables these features | Employer / automatically compiled |
| Financial | Billing address, payment method reference (card number stored by the payment provider, not by us) | User |
| Visual/audio | Profile picture, company logo | User / Employer |
| Support ticket and record attachments | Photos and PDF documents uploaded to a support ticket in the panel, attached to emails received by the support mailbox, or chosen in the WhatsApp assistant to be attached to a ticket; documents chosen in the WhatsApp assistant to be added as a record (insurance policy, hardware, payment — the document is attached to the record). Their content may include personal data | User / email sender |
| Device inventory (inventory agent) | Computer name; make, model and serial number; operating system; processor, memory and disk details and disk usage; signed-in user name; names, versions and install dates of installed programs; the IP address the agent connects from. Processed only when the Customer installs the agent on its own computers. File contents, browsing history, screenshots and keystrokes are not collected | Customer's computer (automatic) |
| Help desk performance summaries (CRM connection) | Only where the Customer connects its own CRM help desk (e.g. Zoho Desk), read-only: the Customer's help desk agents' name, email, agent ID and departments; daily summary figures per agent (tickets solved and reopened, responses, average first response and resolution time); the number of open, on-hold and past-SLA tickets per agent (counts only, taken at each sync — once a day by default, at most every 6 hours as chosen by the Customer); hourly incoming ticket counts. Ticket content and the Customer's customers' contact details are not read. When an administrator requests AI recommendations, the month's summary figures are sent to the AI service provider with each agent replaced by a code (name, email and agent ID are not sent). The CRM provider is the Customer's own service provider, not our sub-processor | Employer (CRM) |
| Remote support connection records | The ID and public key of the remote help program (RustDesk) downloaded by the staff member; the IP addresses of the program and the technician and the connection time; the ID entered in the support ticket. The connection runs through our own server and the screen and file transfer are end-to-end encrypted — the content is neither read nor stored on the server. Processed only when the staff member runs the program, shares the ID and approves the connection | Staff member's computer (automatic) / User |
| Content and copyright notices | For notices sent via the content notice page or legal@: name, email, organisation, role, the content location and description given, evidence details, IP address and browser information, and the steps of the process (date-stamped) | The person submitting the notice |
| Purpose | Legal Basis (KVKK Art. 5/2) |
|---|---|
| Performance of the service agreement, creating and maintaining the user account | Formation or performance of a contract (c) |
| Billing, payment tracking, commercial and technical support | Legal obligation (a) / Performance of contract (c) |
| Security audit, fraud prevention, brute-force protection, audit logging | Legitimate interest of the controller (f) |
| Marketing communication (only with explicit consent) | Explicit consent (a) — Law No. 6563 |
| Providing tools to the Customer (employer) for running HR, IT security and asset-management operations — including shadow SaaS discovery, device and fleet health scoring, and license optimisation | Performance of contract (c) — we act as Data Processor for the Customer |
| Fulfilment of legal obligations (tax, commercial, KVKK, GDPR) | Legal obligation (a) |
| Reviewing and concluding content and copyright notices as a hosting provider (Law No. 5651) and evidencing the process | Compliance with a legal obligation (Art. 5/2-ç); establishment, exercise or protection of a right (Art. 5/2-e) |
Your personal data may be shared with the following third parties, only to the extent necessary to provide the service:
| Recipient Category | Data Type | Purpose | Location |
|---|---|---|---|
| Server infrastructure (Hetzner Online GmbH) | All panel data | Hosting | Germany (EU) |
| Email provider (Microsoft 365 / Google Workspace — provider the customer connects via OAuth or, for Microsoft 365, via app permission) | Notification email content; if a support mailbox is connected, the emails arriving in that mailbox (read to create support tickets) and ticket replies. With an app-permission connection, access is limited to the mailboxes chosen by the customer's administrator. In the connection wizard, the administrator's organisation ID, name and user name from their Microsoft sign-in are processed, and the names and email addresses of users in their organisation are read only to show the mailbox list (not stored) | Automated notification delivery; creating and answering support tickets from email | EU / US |
| Payment provider (PayTR) | Billing info | Collection | Türkiye |
| Backup storage and AI service provider (Amazon Web Services — Amazon S3, Amazon Bedrock) | (1) Since 10.10.2026: an encrypted copy of the nightly system backup (all panel data). (2) No earlier than 10.11.2026: AI chat messages, related panel records retrieved to answer the question, the text read from PDF documents sent to the WhatsApp assistant, support ticket subject and text (automatic classification), monitoring report statistics and coded help desk summary figures (CRM recommendations) | (1) Second off-site backup copy, (2) AI response generation (Anthropic Claude model) | EU (Frankfurt) — under the AWS data processing addendum (incl. EU SCC). The backup is encrypted with AES-256 before it leaves our server; AWS does not have the key. AI requests are processed only in AWS Regions within the EU; prompts and responses are not stored by default, are not used to train models and are not shared with the model developer (Anthropic). |
| AI service provider (Google — Gemini API) | AI chat messages and conversation summary, related panel records retrieved to answer the question (e.g. device, license, employee name), support ticket subject and text (automatic classification), coded help desk summary figures (CRM recommendations), — only when optional AI document scanning is used — the uploaded document image, and — only when a user whose administrator enabled the WhatsApp assistant sends a voice message — the voice recording (processed only to convert it to text; we do not store the audio file in our systems — its text is handled as the question), and — only when such a user sends an image — the screenshot or photo (processed to read its content; we do not store the image in our systems unless the user chooses "Attach to ticket" or to add it as a record — insurance policy, hardware, payment — in which case it is attached to that record), and — only when such a user sends a PDF document — the text extracted from the document on our server; if the document has no readable text (a scanned document), the PDF file itself, to read its content (we do not store the file in our systems unless the user chooses to attach it to a ticket or add it as a record) | Response generation, ticket classification, reading document fields, converting voice messages to text, reading images and answering questions about PDF documents sent to the WhatsApp assistant | US — paid tier, under Google's data processing addendum (Google acts as data processor): prompts and responses are not used to improve Google products; they are logged for a limited period only to detect abuse. Do not enter sensitive personal data into AI chat. |
| AI service provider (Groq) | AI chat messages, conversation summary, related panel records retrieved to answer the question, support ticket subject and text, coded help desk summary figures (CRM recommendations) and the text read from PDF documents sent to the WhatsApp assistant | Response generation (some conversations are routed here) | US — provider commits to not storing data |
| Semantic search provider (NVIDIA — API catalog) | Only the question text typed into AI chat | Converting the question into a numeric vector to find relevant guide sections | US — subject to the provider's API terms |
| Error monitoring (Sentry) | Stack trace, request ID, user ID (only when configured) | Diagnosing errors | US — under SCC |
| Bot protection (Cloudflare, Inc. — Turnstile) | On the contact forms and the free domain check page: IP address, browser and device characteristics, page interaction signals | Preventing automated (bot) submissions and abuse | US — under SCC |
| Map service (Google Ireland Ltd — Google Maps) | Only on the Contact page, and only after the visitor clicks Show map: IP address and browser information | Showing our office location | EU / US — under SCC |
| Messaging infrastructure (Meta Platforms Ireland Ltd — WhatsApp Business Platform) | Only for users whose administrator enabled WhatsApp notifications and who connected their number: phone number and notification content (notification type, record name, branch name, date, amount and record details such as provider or insurer; employee names are not sent; for personal reminders the user set up, the reminder title and time — the note text is not sent). In addition, for users whose administrator enabled the WhatsApp assistant: questions and documents written, sent as voice messages, images or PDF documents to the assistant and the answers generated from panel records — answers cover only records the user is authorised for and, depending on the question, may include record details such as employee names; passwords, licence keys and identity numbers are never sent | Delivering notifications; question-and-answer over WhatsApp | EU / US — under SCC |
| Browser push services (Google Firebase Cloud Messaging, Microsoft Windows Push Notification Service, Apple Push Notification service, Mozilla Push Service — whichever belongs to the browser the user chose) | Only for users who turn on browser notifications on their own device from their profile: the device's notification address and the panel notification (title, short text and panel link — e.g. the record or ticket name). The content is end-to-end encrypted on our server (RFC 8291); the push service cannot read it and only sees the encrypted data, its size and delivery time | Delivering panel notifications to the user's device | EU / US — the service run by the browser maker; content is end-to-end encrypted |
| Communication/support tools | Contact info + support message content | Customer support | EU / US |
Panel data is hosted within the EU (Hetzner, Germany). Cross-border transfers are made under appropriate safeguards (provider data processing agreement + EU Standard Contractual Clauses / SCC 2021/914) per KVKK Art. 9. Transfers to Amazon Web Services (Amazon S3 and Amazon Bedrock) are made under the AWS data processing addendum, which incorporates the EU Standard Contractual Clauses; data is stored and processed in the EU (Frankfurt). Transfers to Google (Gemini API) are made under Google's data processing addendum, which incorporates the EU Standard Contractual Clauses. The semantic search service (NVIDIA API catalog) is used without a separate data processing agreement and is governed by the provider's standard terms of use; only the question text is sent to it.
| Data Category | Retention |
|---|---|
| Active user account data | For the duration the account is active |
| Suspended account data | The account is suspended 15 business days after a paid period ends without renewal; its data is permanently deleted 60 days after suspension |
| Audit log records | 6 months (for security investigation needs) |
| Invoice and commercial records | 5 years under Turkish Tax Procedure Law Art. 253, 10 years under the Turkish Commercial Code |
| Labour Law records (uploaded by the customer) | 10 years per Labour Law Art. 32 (customer's responsibility) |
| Support ticket and record attachments | Until the ticket or record is deleted; deleted together with the other account data when the account is closed |
| Inventory agent data | Until the device record is deleted; disk usage measurements 400 days |
| Help desk performance summaries (CRM) | While the CRM connection is active; deleted in full when the Customer disconnects the CRM or closes the account |
| Remote support connection records | Server connection logs 8 weeks; program ID registration 400 days; the ID in the ticket until the ticket is deleted |
| Deleted records (recycle bin) | Kept for 30 days so they can be restored, then permanently deleted. The Customer can delete them permanently at any time |
| Browser notification subscriptions | Until the user turns them off, signs out on that device, another user signs in on the same browser or the push service invalidates the address; the content of sent notifications is not kept by us apart from the panel notification itself |
| Content and copyright notices | 2 years after the notice is concluded, then deleted with its process log |
As a data subject you have the following rights:
You can submit requests through three channels:
We respond free of charge within 30 days (KVKK Art. 13/2).
Our site uses cookies in 4 categories. On your first visit you can choose which categories to allow via the cookie banner, and change your choice later via the Cookie Preferences link. For the full list and legal bases see the Cookie Policy.
| Category | Example cookie | Purpose | Duration | Mandatory? |
|---|---|---|---|---|
| Necessary | PHPSESSID, td_remember, td_remember_user, td_sec_pass, td_cookie_consent, td_push_dev | Session, remember me (sign-in name), login page bot check, security, preference record, browser notification device match | Session / 4 hours / 30 days / 1 year / 400 days | ✓ Legally required |
| Analytics | Google Analytics 4 (_ga, _ga_*) | Visitor count, page performance — anonymised IP — not currently in use | 12 months | Explicit consent (opt-in) |
| Preferences | Theme, language (localStorage) | User interface preference | Persistent (until cleared by user) | Explicit consent (opt-in) |
| Marketing | (not active — future advertising pixels) | Retargeting, conversion measurement | — | Explicit consent (opt-in) |
Unless you give explicit consent in the Analytics/Preferences/Marketing categories, those cookies are never loaded. Third-party sharing occurs only for Google Analytics (if analytics is enabled) bot protection (Cloudflare Turnstile — only on the contact forms and the free domain check page, necessary) and the location map on the Contact page (Google Maps — loaded only when you click Show map).
For a detailed security architecture see the Trust Center. Short summary:
Under KVKK Art. 12/5 and GDPR Art. 33-34, in the event a data breach is detected:
This notice may be updated in line with changes in legislation and the scope of our service. The current version is always published on this page; active users are notified by email for material changes.
If you are not satisfied with our response, you have the right to lodge a complaint with the Turkish Personal Data Protection Authority:
www.kvkk.gov.tr · Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No:4 Balgat-Çankaya/ANKARA