This text is a draft and has not passed legal review. Fields in square brackets are still to be completed.
KVKK Privacy Notice
Privacy notice under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK).
Last updated: · Version: 0.1-draft
The Turkish version of this document prevails in case of any inconsistency.
1. Data controller
| Field | Detail |
|---|---|
| Legal name | QUIS ARAŞTIRMA VE DANIŞMANLIK LİMİTED ŞİRKETİ |
| Address | BAU TEKMER (BUG Lab TEKMER), Bahçeşehir Üniversitesi Galata Yerleşkesi, Müeyyetzade Mah. Kemeraltı Cad. No: 24/3, Beyoğlu – İstanbul |
| info@quis.com.tr | |
| Registered email (KEP) | quisarastirmavedanismanlik@hs01.kep.tr |
This notice covers processing for which QUIS is the data controller. In research run for a customer, the customer is the controller: see Research Participants.
2. Data, purposes and legal grounds
| Group | Data categories | Purpose | Legal ground (KVKK Art. 5/2) |
|---|---|---|---|
| Website visitor | IP address, request and browser details | Site security, fault detection | (f) legitimate interest |
| Person making contact | Name, email, organisation, message | Responding to the request | (f) legitimate interest; (c) in pre-contract talks |
| Customer or prospect representative (B2B) | Name, title, organisation, contact details, meeting notes | Proposals, contracts, service and relationship management | (c) contract; (f) legitimate interest |
| Person responsible for billing | Identity, tax, contact and payment details | Invoicing, accounting | (ç) legal obligation; (c) contract |
| Supplier or partner representative | Name, title, organisation, contact and contract details | Procurement and contract management | (c) contract; (f) legitimate interest |
| QUIS research participant (B2C) | See Research Participants | Conducting research | See that notice |
| Platform user | Name, email, password hash, workspace, usage and activity records | Account management, service delivery, security | (c) contract; (f) legitimate interest; (ç) legal obligation |
| Job applicant | CV, contact, education, experience | Recruitment assessment | (c) pre-contract; explicit consent for retention [TO BE CONFIRMED] |
| Recipient of commercial messages | Name, email, phone | Marketing communication | Explicit consent and approval under Law No. 6563 |
Special categories of personal data are not processed unless the conditions in KVKK Article 6 are met.
3. Method of collection
Data is collected by automated or partly automated means through the website and server logs, email, contracts, meetings, application documents and research forms.
4. Transfers
- Within Türkiye: Hosting and IT providers, accountants, lawyers and auditors, and competent public authorities.
- Abroad: Google for business and system email and Google sign-in; OpenAI for the platform's AI features. Transfers follow KVKK Article 9: [STANDARD CONTRACT AND BOARD NOTIFICATION TO BE CONFIRMED].
- Personal data is not sold.
5. Retention
| Data | Period |
|---|---|
| Website server logs | 14 days |
| Platform account data | Account lifetime and [24 MONTHS — TO BE CONFIRMED] afterwards |
| Contact emails | [24 MONTHS — TO BE CONFIRMED] |
| Contracts and commercial records | [10 YEARS — TO BE CONFIRMED] |
| Tax records | [STATUTORY PERIOD — TO BE CONFIRMED] |
| Unsuccessful job applications | [12 MONTHS — TO BE CONFIRMED] |
At the end of the period, data is deleted, destroyed or anonymised.
6. Security
Technical and administrative measures are taken under KVKK Article 12. Data breaches are notified to the Board and affected individuals as required by law.
7. Your rights and how to apply
Under KVKK Article 11 you may:
- Learn whether your data is processed and request information about it,
- Learn the purpose of processing and whether data is used accordingly,
- Know the third parties to whom data is transferred in Türkiye or abroad,
- Request correction of incomplete or inaccurate data,
- Request deletion or destruction where the conditions are met,
- Request that corrections, deletions and destruction be notified to recipients,
- Object to an adverse outcome arising solely from automated analysis,
- Claim compensation for damage caused by unlawful processing.
How to apply: With information verifying your identity, apply in writing to the address above, by KEP, secure electronic signature or mobile signature, or from your email address registered with us to info@quis.com.tr.
Requests are answered within 30 days at the latest and, as a rule, free of charge. If you find the response unsatisfactory, you may complain to the Personal Data Protection Board.