Privacy Policy & Data Protection Notice

This notice is prepared, in the capacity of data controller under Article 10 of Turkey's Law No. 6698 on the Protection of Personal Data ("KVKK"), by Kaya Software. For requests and questions: bilgi@kayasoftsystems.com

The following categories of data may be processed through the website, customer portal, and order processes:

• Identity data: first and last name; for individual orders, your national ID number (T.C. kimlik no) for the purpose of issuing an e-invoice
• Contact data: email address, phone number, billing/delivery address
• Customer transaction data: company name, tax office/tax number, order and invoice records
• Portal account data: the irreversible (hashed) form of your password, your two-factor authentication (2FA) code, and session records — your password is never stored as plain text
• Transaction security data: IP address and timestamp (kept for a limited time, solely to prevent abuse/excessive request attempts)
• Contact form content: the message text you share as part of a demo/quote request or support request

Payment instrument details such as card number, expiry date, or CVV never reach our systems at any stage; this information is processed directly on PayTR's PCI-DSS-compliant infrastructure.

Your personal data is processed based on the following legal grounds listed in Article 5 of the KVKK:

• Establishment/performance of a contract: responding to your demo or quote request, carrying out order and invoicing processes, creating and securing your portal account
• Legal obligation: fulfilling obligations arising from the Tax Procedure Law regarding e-invoicing and accounting records
• Legitimate interest: protecting the site against abuse (bots/excessive requests), ensuring service quality and information security
• Explicit consent: only for the demo/quote and contact forms where you have approved this notice

Except as stated above, your data is not used for marketing-based profiling or automated decision-making mechanisms.

Your personal data is collected electronically, entered directly by you, through the demo request, contact, and customer portal registration/login forms, as well as the order/payment form on the website.

Your personal data is not shared with third parties for marketing purposes. To the extent necessary for the service to function, limited data may be transferred to the following recipient groups:

• PayTR (payment institution): your order and invoice information, for the purpose of processing payment
• Resend (email infrastructure provider): for delivering the 2FA code, welcome emails, and request-notification emails
• Our hosting/infrastructure providers: for the purpose of securely storing data
• Authorized public institutions: only in the event of a legal request or obligation

• Demo/quote and contact form data is retained for a maximum of 2 years from the resolution of the request.
• Records relating to orders, invoices, and collections are retained for the statutory retention period set out in the Tax Procedure Law and the Turkish Commercial Code (a minimum of 5 years).
• Your portal account data is retained for as long as your account is active; following an account-closure request, it is retained for the period required by our legal retention obligations.
• 2FA verification codes are kept only for a validity period of a few minutes, after which they are automatically deleted.

At the end of these periods, data is deleted, destroyed, or anonymized.

Under Article 11 of the KVKK, you may apply to us to exercise the following rights:

• To learn whether your personal data is being processed,
• To request information about it if it has been processed,
• To learn the purpose of processing and whether it is used in accordance with that purpose,
• To know the third parties to whom it is transferred, domestically or abroad,
• To request correction if it has been processed incompletely or incorrectly,
• To request its deletion/destruction once the conditions in KVKK Article 7 are met,
• To request that correction/deletion actions be notified to third parties to whom the data has been transferred,
• To object to a result that is to your detriment arising from analysis of the processed data exclusively by automated systems,
• To request compensation for damages you suffer due to unlawful processing.

To exercise these rights, you may apply in writing to bilgi@kayasoftsystems.com; your request will be resolved free of charge within 30 days at the latest. If your application is rejected, not answered, or found insufficient, you retain the right to file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

This website uses a mandatory session cookie (kaya_session) that enables you to log in and access the portal securely. The portal session does not work without this cookie. The site does not use cookies for analytics, advertising, or third-party tracking purposes.

Every cookie and local-storage entry stored by this site:

Your passwords are stored irreversibly (bcrypt), logins are protected with two-factor authentication, and all connections are encrypted with SSL/TLS. That said, no transmission method over the internet is 100% secure; we take maximum technical and administrative measures but cannot guarantee absolute security.

This notice may be updated in line with changes in legislation or in our data-processing practices. The current version is published on this page.