Personal Data Protection Notice (KVKK)
This is an English translation provided for convenience. In case of any discrepancy, the Turkish text prevails.
Personal Data Protection Notice under the Law on the Protection of Personal Data
İmacyu Teknoloji San. ve Tic. Ltd. Şti.
Last updated: 14 October 2026
1. Identity of the Data Controller
İmacyu Teknoloji San. ve Tic. Ltd. Şti. (“İmacyu”) acts in the capacity of data controller under Law No. 6698 on the Protection of Personal Data (“KVKK”) in respect of the personal data processing activities for which it determines its own purposes and means.
This notice describes the personal data processing activities relating to visitors to the corporate website, persons who submit contact and quotation requests, prospective customers, customer representatives, business partners and natural persons who communicate with İmacyu within the scope of a service relationship.
The independent data processing activities carried out by customers in their own ERP or CRM systems are assessed separately within the scope of the responsibility of the relevant data controller.
2. Personal Data Processed
The following categories of personal data may be processed within the scope of the relevant activity:
Identity information: First name and surname.
Contact information: Telephone number, e-mail address, correspondence address and business address.
Professional information: Employing company, position, title and department.
Customer transaction information: Quotation, contract, licence, subscription, order and support request information.
Transaction security information: IP address, session information, and access and user transaction records.
Financial transaction information: Necessary personal information relating to invoicing, service fees and collection transactions.
Request and complaint information: The content of contact and support applications and the responses given to them.
3. Purposes of Processing and Legal Grounds
Depending on the nature of the relevant activity, personal data may be processed on the following legal grounds set out in Article 5 of the KVKK.
Necessity for the establishment or performance of a contract — KVKK Art. 5/2(c)
Conducting quotation processes, creating the customer account, managing software licences, operating subscriptions and providing technical support services.
Fulfilment of a legal obligation — KVKK Art. 5/2(ç)
Invoicing, keeping accounting records, meeting mandatory retention obligations and fulfilling the requests of legally authorised institutions.
Establishment, exercise or protection of a right — KVKK Art. 5/2(e)
Protecting rights arising from the contract, assessing claims and disputes, and creating evidence in legal proceedings.
Legitimate interest — KVKK Art. 5/2(f)
Ensuring system security, preventing unauthorised access and conducting the necessary customer relations processes, provided that the fundamental rights and freedoms of the data subject are not harmed.
Explicit consent — KVKK Art. 5/1
Personal data processing activities for which none of the other data processing conditions in the Law is present and for which valid explicit consent is required.
In processing based on explicit consent, the processes of providing information and of obtaining explicit consent are carried out separately from one another.
4. Methods of Collecting Personal Data
Personal data may be obtained electronically or, where necessary, physically through the following channels:
- The İmacyu corporate website.
- Contact, information and quotation request forms.
- E-mail correspondence and telephone calls.
- Customer quotation and contract processes.
- Software licensing and user management systems.
- Technical support and service requests.
- System access and transaction security records.
5. Parties to Whom Personal Data May Be Transferred and Purposes
Provided that the relevant legal conditions are met, personal data may be transferred:
- To hosting and information technology infrastructure providers: for the purpose of operating the server, system operation and service infrastructure,
- To authorised technical service providers: for the purpose of carrying out maintenance, support, integration and related services,
- To authorised business partners: for the purpose of providing the services requested by the customer and carried out within the scope of the business partnership,
- To accounting, legal and audit service providers: for the purpose of carrying out the relevant professional services and legal obligations,
- To competent public institutions and organisations: for the purpose of fulfilling statutory obligations and meeting lawful official requests
as set out above.
6. Google Maps and Transfer of Data Abroad
The Google Maps service is offered on the Contact page of our corporate website.
The embedded map is activated upon the visitor granting permission. When the map is loaded, the visitor's IP address, browser and device information and technical data relating to the connection may be transmitted to Google.
The transfer of personal data abroad may be involved within the scope of this processing.
The local storage area in the visitor's browser is used to store the map preference.
In the data processing and transfer-abroad processes associated with Google Maps, the conditions and necessary safeguards in Articles 5 and 9 of the KVKK are taken into account.
The map preference may be withdrawn from the Contact page. The consequences of data transfers that have already taken place are not eliminated retroactively merely by closing the map.
7. Data Processing Roles in ERP, CRM and Cloud Services
İmacyu's customers may process personal data in ERP and CRM systems within the scope of their own activities.
Where the customer determines the purposes and essential means of processing such data, the customer may be the data controller.
In activities in which İmacyu processes personal data on behalf of the customer and on the customer's instructions, İmacyu may be acting in the capacity of data processor.
These roles are determined within the framework of the parties' actual activities, authorities and contracts and the relevant legislation.
8. Retention and Disposal of Personal Data
Personal data is retained for the periods required by the relevant purposes of processing and for the duration of the retention obligations prescribed by the legislation.
Where the legal grounds requiring retention cease to exist, personal data is erased, destroyed or anonymised in accordance with the applicable legislation.
In respect of data in customer systems, the data return, retention and disposal arrangements in the relevant service agreement apply in addition.
9. Rights of the Data Subject
Under Article 11 of the KVKK, data subjects have the right to:
- Learn whether their personal data is being processed,
- Request information in that regard if it has been processed,
- Learn the purpose of the processing and whether the data is being used in accordance with that purpose,
- Know the third parties to whom the data is transferred, within the country or abroad,
- Request the rectification of personal data that has been processed incompletely or inaccurately,
- Request its erasure or destruction within the scope of the statutory conditions,
- Request that the rectification, erasure and destruction operations be notified to the relevant third parties,
- Object to any result arising to their detriment by reason of analysis carried out exclusively by means of automated systems,
- Claim compensation for the damage they have suffered by reason of unlawful processing
as set out above.
10. Applications and Contact
You may submit your requests under the KVKK to İmacyu by the methods specified in the relevant legislation.
Applications are assessed and concluded as soon as possible and within 30 days at the latest.
Explanations regarding the application procedures are provided on the “Personal Data Request” page on our website.
Data Controller: İmacyu Teknoloji San. ve Tic. Ltd. Şti.
E-mail: [email protected]
Address: Gürselpaşa Mahallesi, Seyhan / Adana, Türkiye