KVKK Information Notice
Under Article 10 of Turkish Law No. 6698 (KVKK): which personal data we process, for what purpose and on what legal basis, who we share it with, and your rights.
Last updated: 14 October 2026 · Version v1.7
This notice is issued under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the related Communiqué on the procedures for fulfilling the duty to inform. For our general practices see the Privacy Policy; for cookies see the Cookie Policy.
1. Identity of the data controller
| Data controller | Birileri Dış Ticaret Danışmanlık Sanayi ve Ticaret Limited Şirketi |
|---|---|
| Brand | Smartifie |
| MERSİS | 0177070525100001 |
| Trade registry no | 227539 — Izmir Trade Registry |
| Tax office / Tax ID | Karşıyaka Tax Office / 1770705251 |
| Address | Bahariye Mah. 1865 Sk. Karadoğan Blok No: 9, İç Kapı No: 1, Karşıyaka / İZMİR |
| Phone | +90 555 561 45 47 |
| info@smartifie.com | |
| KEP | kayacan.kirpikli@hs01.kep.tr |
| KVKK contact person | Kayacan Kırpıklı — kayacan.kirpikli@smartifie.com |
2. Our role depends on the product variant
| Variant | Your business data | Account, licence, payment, support |
|---|---|---|
| Device-local (Windows/Android/iOS/macOS) | Stays on your device, never reaches us — you are the controller | We are the controller |
| Cross-platform / cloud | On our servers (Türkiye) — we are the processor, you are the controller | We are the controller |
| Custom DB add-on | On your own database server; we do not store your credentials and have no access to the data — we are not a party to it (neither controller nor processor); you are the controller | We are the controller |
3. Personal data we process
| Category | Data |
|---|---|
| Identity | Name, surname, (where required for invoicing) national ID / tax number |
| Contact | E-mail, phone, billing address |
| Customer transactions | Product/plan purchased, licence records, subscription history, support requests |
| Financial | Payment records, invoice details (card numbers are not stored by us) |
| Transaction security / technical | IP address, device and browser information, device fingerprint for licence activation, session and audit logs |
| Account security | Whether your e-mail is verified; if you enable two-factor authentication, the authenticator secret and recovery codes; a short-lived cookie recording that your password was confirmed recently for a sensitive action; a record if two-factor authentication was reset. No phone number is collected — an authenticator app is used instead of SMS. |
| Marketing (if any) | Only if you give explicit consent: newsletter subscription |
| Website chat | The questions you type into the chat assistant and earlier messages of the same conversation (not stored on our servers); the path and language of the page you are on; the IP address and browser/device characteristics Cloudflare processes for bot protection; the IP address held in memory only for rate limiting — details in section 12 |
4. Purposes and legal bases
| Purpose | Legal basis (KVKK Art. 5) |
|---|---|
| Opening the account, issuing and verifying the licence, delivering the product | Art. 5/2-c — conclusion/performance of the contract |
| Taking payment, issuing invoices, accounting records | Art. 5/2-ç — legal obligation (Tax Procedure Law, Commercial Code) |
| Handling support requests | Art. 5/2-c — performance of the contract |
| Preventing licence piracy and abuse | Art. 5/2-f — legitimate interest |
| Account security: e-mail verification, two-factor authentication, password re-confirmation, rate limiting | Art. 5/2-f — legitimate interest; Art. 12 — data security obligation. Not based on consent. |
| Answering your question about our products, plans and prices in the website chat assistant (section 12) | Art. 5/2-f — legitimate interest; where your question concerns buying a plan, Art. 5/2-c — directly related to concluding a contract |
| Protecting the contact form and the website chat against automated programs (Cloudflare Turnstile); rate limiting in the chat | Art. 5/2-f — legitimate interest; Art. 12 — data security obligation |
| Analytics cookies (Google Analytics) | EXPLICIT CONSENT |
| Marketing e-mail (not sent today) | EXPLICIT CONSENT + Law 6563 / IYS permission |
5. Method of collection
We collect your data electronically and by automated means: through website forms, the website chat assistant, account creation and sign-in, checkout, licence activation and periodic verification calls, support e-mails, and cookies that depend on your consent.
6. Recipients and transfers abroad
| Recipient | Purpose | Country |
|---|---|---|
| Google Ireland/LLC | Analytics — only with your consent | EU/USA |
| Iyzico | Taking payment in Türkiye | Türkiye |
| Paddle | Merchant of Record for sales outside Türkiye: payment, invoice, tax | EU / UK |
| Pentech Bilişim Teknolojileri San. ve Tic. Ltd. Şti. | Server hosting (VM) — all data held on the server | Türkiye — Bursa |
| Google Play · App Store · Trendyol · Amazon | Distribution and collection if you purchased via that channel | USA / TR |
| Competent public authorities | Legal obligation (Art. 8/2-a) | Türkiye |
| Anthropic, PBC | Generating an AI answer to your question in the website chat (as processor): your question, earlier messages of the same conversation (at most 6), page path and language — no IP address, identity or account data is sent (section 12) | USA |
| Cloudflare, Inc. | Bot protection (Turnstile) — contact form and website chat: IP address, browser/device characteristics | USA |
Basis for transfers abroad (Art. 9). Transfers to Google take place only with your explicit consent. For Anthropic and Cloudflare (USA) there is no adequacy decision for the USA. Both transfers rely on the standard contract under KVKK Art. 9.
Your data is not sold for marketing.
7. Retention periods
| Data | Period |
|---|---|
| Invoice, payment, accounting records | 10 years (Commercial Code Art. 82) |
| Account, licence, subscription records | While the account exists + 10 years to the extent tied to invoicing |
| Support correspondence | 3 years after the request is closed |
| Audit and security logs — raw IP address | 90 days; the raw IP is then deleted, only city/country remains. Deletion runs automatically once a day. |
| Two-factor authentication secret and recovery codes | While two-factor authentication is on; deleted when it is turned off or reset by our support team |
| Password confirmation (step-up) cookie | 15 minutes |
| Cookie consent record | In your browser's localStorage, until you delete it |
| Website chat — chat content | Not stored on our servers; the conversation history stays only in your browser until the tab is closed. Anthropic's copy up to 30 days (exceptions in 12.5) |
| Website chat — IP address for rate limiting | In server memory only, at most 1 hour; not written to disk |
8. Data security
We apply encryption in transit and at rest, access control, logging and regular security audits (KVKK Art. 12). In the event of a data breach we notify the Board within 72 hours and inform you as soon as possible.
Account-specific measures. Starting a trial, buying a plan and linking a device require a verified e-mail address. Two-factor authentication is optional on every account and required for accounts that manage billing, seats or other people's access (authenticator app; no SMS). For sensitive actions such as removing a device or changing billing details, your password is requested again. If you lose both your phone and your recovery codes, our support team can reset two-factor authentication; you are notified by e-mail when this happens.
9. Your rights (KVKK Art. 11)
You have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties to whom it is transferred at home or abroad; to request correction if it is incomplete or inaccurate; to request erasure or destruction where the conditions are met; to request that correction, erasure and destruction be notified to those third parties; to object to a result adverse to you arising from analysis solely by automated systems; and to claim compensation if you suffer damage due to unlawful processing.
You may send your requests to kayacan.kirpikli@smartifie.com or info@smartifie.com, or to our registered electronic mail (KEP) address. We respond free of charge within 30 days at the latest. If you find our reply insufficient, you may complain to the Turkish Personal Data Protection Board.
10. Where explicit consent is collected
The duty to inform and explicit consent are fulfilled separately. This page is the information notice only; where explicit consent is required, it is collected on the screen of the relevant action, separately and never pre-ticked: the cookie notice for analytics cookies, the subscription form for commercial e-mail. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing before it.
11. Free tool pages (online tools that require no account)
Our website offers free tool pages that can be used without an account and without payment: smartifie.com/en/tools. Two tools are live today: the barcode generator and the shipping mark generator. This section applies to all tool pages, present and future, and is disclosure only under KVKK Art. 10 and the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation (RG 10.03.2018-30356). No explicit consent is taken for these pages, and none is required.
11.1. We are not the controller of the data you enter into a tool. Barcode and label generation happens entirely inside your browser, on your own device. The barcode contents, label texts and the spreadsheet file you select are not sent to our servers; the file is not uploaded, it is read in your browser's memory. The images and PDF files produced are also created in your browser.
Because this data never reaches us, no processing (collection) takes place within the meaning of KVKK Art. 3/1-e; neither the controller role (Art. 3/1-ı) nor the processor role (Art. 3/1-ğ) arises.
11.2. The only personal data we process on these pages arises from serving you the page. Web server access log: your IP address, browser and device information, and a timestamp. The purpose is system security, fault diagnosis and abuse prevention; the legal bases are Art. 5/2-f (legitimate interest) and Art. 12 (data security obligation). Period: 14 days — the web server logs are rotated daily, at most 14 copies are retained, and anything older is deleted automatically. In addition an aggregate page counter is kept by day, page path, language, referring source and a bot/human split; because no record linkable to a visitor is kept, no personal data is processed in that respect.
These 14 days are separate from the 90-day row in section 7. That period concerns the audit and security records of users who have an account. For someone visiting a tool page without an account, no such record is created at all.
11.3. Method of collection. The technical records above are collected electronically and by automated means while the page is served to your browser. There is no form submission on a tool page; your inputs are not transmitted to us.
11.4. Transfers. The tool's own operation involves no transfer to any third party, at home or abroad: all software libraries the tool needs are hosted on our own server, no request is sent to any content delivery network (CDN), font provider or script provider, and the data you enter into the tool is not passed to any recipient.
The one exception — analytics measurement (subject to explicit consent). The tool pages use the site's general page layout. If you have given explicit consent to analytics cookies, the Google Analytics script also loads here; your browser sends a request to googletagmanager.com and data about your visit (IP, device/browser information, navigation) is transferred to Google Ireland/LLC (EU/USA), listed in section 6. The basis for the transfer is your explicit consent (Art. 5/1; for transfers abroad, Art. 9). If you have not consented, or you rejected, the script is not added to the page at all and no request is sent. This is not a new transfer specific to the tool pages and it adds no new recipient to the list in section 6; you can withdraw your consent at any time from the Cookie Policy page.
The website chat is separate. If you open and use the site's chat assistant on a tool page, the transfers described in section 12 (the Cloudflare check and sending your question to Anthropic) take place. That is not part of the tool's own operation: the data you enter into the tool is not passed to the chat — only the text you type into the chat yourself is sent. Keeping the conversation history in your browser (sessionStorage) likewise belongs to the chat, not to the tool.
11.5. Third-party data you enter into a tool. If you enter another person's personal data into a tool (for example your customer's name or address in a label text), you are the controller of that data: establishing a legal basis, informing the data subject and, where required, obtaining their explicit consent are your obligations. Because we do not see, receive or store that data, we cannot discharge those obligations on your behalf.
11.6. Cookies and browser-local storage. For their own operation the tool pages write no cookie and use no localStorage or sessionStorage; your inputs and settings are not stored and return to defaults when the page is refreshed. The site-wide strictly necessary cookies and the analytics cookies that load only with your explicit consent are separate from this (see the Cookie Policy); the tool page adds no new cookie to them. The record of your cookie choice falls under that same exception: it is kept in your browser's localStorage (see section 7) and belongs to the site as a whole — even if you answer the cookie banner for the first time on a tool page, that record is not the tool's own.
11.7. Your rights and how to apply. Your KVKK Art. 11 rights set out in section 9 apply to the processing described here as well, and you may apply using the procedure explained there.
12. Website chat assistant
Our website (smartifie.com) has an AI chat assistant that answers your questions about Smartifie products, plans, prices and use cases and requires no sign-in. It exists only on the website, not inside our products (the in-product assistant was removed on 6 August 2026). This section serves as disclosure under KVKK Art. 10 and the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation; no explicit consent is taken for this processing.
12.1. You use it knowing what it is. The answers are generated not by a person but by Anthropic's Claude Haiku AI model; the chat window says so clearly and links to this notice. Answers may be wrong; for prices and plan details, what is binding are the price and terms shown to you at checkout. The assistant has no access to your Smartifie account, your licence or the business data in our products — even if you are signed in to the site. Please do not type personal data into the chat (name, e-mail, phone, identity or payment details, special categories of data such as health data, information about other people).
12.2. Data processed, purpose, legal basis, period.
| Data | Purpose | Legal basis (KVKK Art. 5) | Period |
|---|---|---|---|
| The question you type, earlier messages of the same conversation (at most 6), the path and language of the page you are on | Generating an answer to your question | Art. 5/2-f — our legitimate interest in answering your request for information about our products; where your question concerns buying a plan, Art. 5/2-c | Not stored on our servers; up to 30 days at Anthropic (12.5) |
| IP address (rate limiting) | Limiting abuse | Art. 5/2-f + Art. 12 | In server memory only, at most 1 hour; not written to disk |
| IP address, browser/device characteristics (Cloudflare Turnstile) | Protecting the assistant against automated programs | Art. 5/2-f + Art. 12 | Cloudflare processes this data under its own terms for bot detection; we do not receive or store it — we only get back the result of the check |
| IP address, browser information, timestamp (web server access log) | System security, fault diagnosis | Art. 5/2-f + Art. 12 | 14 days (the same log as across the whole site — 11.2); contains no chat content |
| (not personal data) Daily aggregate usage and cost counters | Monitoring cost | Contain no content and no identifier, so no personal data is processed under KVKK | — |
The conversation history is kept only in your browser, in this tab's session storage (sessionStorage). It is sent to our server with each question so the assistant can follow the conversation; our server does not store it or write it to its logs. When you close the tab, your browser deletes this history. The assistant makes no automated decision about you and builds no profile.
12.3. Method of collection. The text you type into the chat window and the technical details of the request are collected electronically and by automated means when you use the chat. If you do not use the assistant, no data is processed for this purpose.
12.4. Transfers (KVKK Arts. 8-9).
- Anthropic, PBC (USA) — AI model provider, processor. The request is sent from our server (Türkiye); your browser does not connect to Anthropic. Sent: your question, earlier messages of the same conversation (at most 6), the path (without query parameters) and language of the page you are on, and our product information text, which contains no personal data. Not sent: your IP address, name, e-mail, account or company details, cookies, or the business data in our products — even if you are signed in. There is no adequacy decision for the USA. The transfer relies on the standard contract under KVKK Art. 9, published by the Board.
- Cloudflare, Inc. (USA) — bot protection (Turnstile). The Turnstile script is loaded only when you open the chat window (and on the form on our contact page); your browser then connects to Cloudflare's server and Cloudflare processes your IP address and browser/device characteristics. When checking the result, our server also passes your IP address to Cloudflare. The transfer relies on the standard contract under KVKK Art. 9.
12.5. Anthropic's copy. Under Anthropic's commercial terms the content we send is not used to train models. Anthropic keeps API inputs and outputs for trust and safety purposes for up to 30 days and then deletes them. Exception: if content is flagged as violating Anthropic's usage policy, inputs and outputs may be kept for up to 2 years and safety classification scores for up to 7 years; longer where required by law. We have no separate zero data retention agreement with Anthropic.
12.6. Your rights. Your KVKK Art. 11 rights set out in section 9 apply to this processing as well, and you may apply using the procedure explained there. Because we do not store the chat content, we cannot show it to you in response to a later request; Anthropic's copy is deleted at the end of the period in 12.5.
13. Changes
We update this notice from time to time; the version number and last-updated date change with every revision. Questions: info@smartifie.com.