Privacy Policy

The official identity/business name and contact details of the Data Controller determining the purposes and means of Personal Data processing under KVKK must be published and kept current in Rvzsoft’s relevant legal information or contact area.

In this policy, “Rvzsoft” refers to the relevant Data Controller providing services under the Rvzsoft brand.

This Privacy Policy covers the processing of Personal Data relating to individuals who:

• visit rvzsoft.com;
• create a customer account;
• contact Rvzsoft;
• submit a quotation or project request;
• purchase a service;
• submit a support request;
• use contact, quotation and project forms.

Where information about corporate customers includes data that makes individuals identifiable, that information is also treated as Personal Data.

Depending on the nature of your relationship with Rvzsoft, the following data categories may be processed.

Identity Information

• First name
• Last name
• Other identity information required by the service for individual customers

Unnecessary identity information is not requested.

Contact Information

• Email address
• Telephone number
• Information provided through the contact form
• Preferred communication channel

Account Information

Where a customer account is used, the following may be processed:

• user account information;
• account preferences;
• secure records relating to password verification;
• session information;
• account activity.

Where passwords must be stored in the system, the principle is that they must not be stored in plain text and must be protected using current security methods.

Project and Service Information

When Rvzsoft carries out a project or service, the following may be processed:

• project requests;
• technical requirements;
• project documents;
• content provided by the customer;
• quotation and order information;
• service history;
• support requests;
• customer feedback.

Billing and Transaction Information

Depending on the nature of the service and legal requirements, the following may be processed:

• billing information;
• address information;
• payment status;
• order amount;
• transaction and collection references;
• company/invoice information relating to corporate customers.

Information required by tax or accounting legislation is processed only within the scope of the relevant legal obligation.

Support and Communication Content

The following may be retained to provide the service:

• support requests;
• email correspondence;
• messages sent by the customer;
• error reports;
• files and documents attached to requests.

Technical and Security Data

For the security of the website and customer systems, the following may be processed:

• IP address;
• session information;
• sign-in dates and times;
• failed sign-in attempts;
• browser and device information;
• operating system information;
• error records;
• transaction records;
• security logs.

This data may be used to maintain system security, prevent misuse and resolve technical issues.

Website Usage Data

Depending on the cookie and analytics systems used, the following may be processed:

• pages visited;
• time spent on a page;
• traffic source;
• basic device and browser information;
• user preferences.

Analytics and marketing technologies subject to consent operate according to the user’s preferences where required.

Personal Data may be collected electronically through:

• forms on rvzsoft.com;
• customer accounts;
• registration and sign-in screens;
• quotation and project request forms;
• email;
• WhatsApp or communication channels preferred by the user;
• the support system;
• order and payment processes;
• cookies and similar technologies;
• technical system and security records.

Where required by the service, data may also be obtained through documents provided directly by the user.

Depending on the relevant data category, Personal Data may be processed for the following purposes:

• creating and managing user accounts;
• verifying user identity and account security;
• receiving service requests;
• preparing quotations;
• planning and carrying out projects;
• providing purchased services;
• communicating with customers;
• providing technical support;
• carrying out order and payment processes;
• managing service renewals;
• performing billing and accounting operations;
• managing services such as domain names, hosting, servers or email;
• maintaining system security;
• preventing misuse, fraud and unauthorised access;
• identifying technical errors and performance issues;
• fulfilling legal obligations;
• protecting rights in legal disputes;
• measuring and improving service quality;
• sending commercial electronic communications where the user has made that choice;
• operating cookies and technologies requiring consent according to user preferences.

Personal Data is processed on the basis of one or more legal grounds for processing provided under KVKK, depending on the nature of the relevant activity.

These may include, in particular:

• being directly related to the establishment or performance of a contract;
• fulfilment of a legal obligation of the Data Controller;
• processing being necessary for the establishment, exercise or protection of a right;
• legitimate interests of the Data Controller, provided that the data subject’s fundamental rights and freedoms are not prejudiced;
• processing being expressly provided for by law;
• the data subject’s Explicit Consent where required.

Explicit Consent is not made a mandatory condition for a processing activity that is not necessary for performance of the contract.

Rvzsoft implements appropriate technical and organisational security measures to protect customer accounts.

Depending on the technical structure of the service, these may include:

• secure password storage methods;
• access control;
• session security;
• sign-in records;
• failed sign-in checks;
• authorisation;
• two-step verification;
• abnormal activity detection.

Users must also maintain the confidentiality of their account credentials.

If a user chooses Continue with Google or a similar third-party authentication method, Rvzsoft may receive the limited account information specified on the relevant provider’s permission screen.

The data received may vary according to the integration and may include, for example:

• first name;
• last name;
• email address;
• account identifier.

Rvzsoft does not receive the password for the user’s Google account.

The third-party provider’s own data processing activities are subject to that provider’s privacy terms.

Public service orders are paid by bank transfer, EFT or FAST. Transaction references, amounts, currencies and receipts supplied by customers may be processed for payment reconciliation.

Personal Data may be transferred to third parties only to the extent necessary to provide the service or fulfil legal obligations.

Depending on the nature of the service, these parties may include:

• hosting and data centre providers;
• cloud infrastructure providers;
• payment service providers and banks;
• email service providers;
• SMS or communication services;
• domain name registrars;
• technical infrastructure and security providers;
• service providers acting within the scope of accounting and regulatory requirements;
• legally authorised public institutions and bodies.

Transfers are limited to the data necessary to provide the relevant service.

Personal Data is not sold to third parties for marketing purposes.

The servers of certain cloud, email, analytics, authentication, artificial intelligence or technical infrastructure providers used by Rvzsoft may be located abroad.

Where Personal Data must be transferred abroad, the transfer mechanisms prescribed in Article 9 of KVKK are applied.

Under the new system that entered into force in Türkiye in 2024, standard contracts also became one of the appropriate safeguard mechanisms, and a notification mechanism to the Authority was introduced for signed standard contracts. KVKK

International Data Transfers are assessed separately according to the actual service provider used and the nature of the data flow.

A general statement that “our servers may be located abroad” does not replace a legally compliant transfer mechanism.

The Rvzsoft website may use:

• Strictly Necessary Cookies;
• preference cookies;
• Analytics Cookies;
• advertising/Marketing Cookies where required.

Technologies that are not necessary for the technical operation of the service and require consent are enabled according to user preferences under applicable legislation.

Cookie types, durations and providers may be explained in the separately published Cookie Policy.

Commercial electronic communications such as campaigns, promotions and announcements are sent only where the necessary legal conditions under applicable legislation are satisfied.

Users may change or withdraw their marketing communication preferences using the permitted methods.

However, operational notifications necessary to provide the service may not constitute marketing communications, such as:

• account security notifications;
• payment notifications;
• order notifications;
• service renewal notifications;
• project or support messages.

Personal Data is retained only for the period required by the purposes of processing and the mandatory retention periods prescribed by applicable legislation.

When the processing purpose and the relevant legal ground cease to exist, data is:

• deleted;
• destroyed; or
• anonymised.

Under KVKK, Personal Data must be deleted, destroyed or anonymised when the conditions for processing cease to exist.

Records relating to invoices, accounting, payments or legal disputes may be retained for the applicable statutory retention periods.

Account deletion therefore does not, in every case, mean that all records relating to the data subject are deleted simultaneously and unconditionally.

Rvzsoft endeavours to take technical and organisational measures appropriate to the nature of the data processed to prevent Personal Data from being:

• processed unlawfully;
• accessed by unauthorised persons;
• altered;
• lost; or
• disclosed unlawfully.

Depending on the system’s structure, these measures may include:

• access permissions;
• TLS/SSL encryption;
• password security;
• security records;
• software updates;
• access restrictions;
• backups;
• security checks.

No guarantee is given that any electronic system is entirely free of risk.

If it is determined that Personal Data has been obtained by others through unlawful means, the notification and response procedures required by legislation are followed.

The Turkish Personal Data Protection Board interprets the expression “as soon as possible” in the Law as no later than 72 hours for notification to the Board; affected individuals are also to be notified as soon as reasonably possible. KVKK

Under Article 11 of KVKK, data subjects have the following rights where the applicable conditions are met:

• to learn whether their Personal Data is processed;
• to request information if it has been processed;
• to learn the purpose of processing and whether the data is used in accordance with that purpose;
• to know the third parties to whom Personal Data is transferred;
• to request correction of incomplete or inaccurate data;
• to request deletion or destruction of Personal Data where the statutory conditions are met;
• to request notification of correction, deletion or destruction to the relevant third parties;
• to object to an outcome against them resulting from analysis carried out exclusively through automated systems;
• to seek compensation for damage suffered due to unlawful processing of Personal Data.

Where GDPR applies to the relevant processing activity, additional rights recognised under GDPR may also apply.

For general privacy enquiries, contact [info@rvzsoft.com](mailto:info@rvzsoft.com).

You may submit requests relating to your Personal Data to the Data Controller through the valid contact channels published by Rvzsoft.

A request must include:

• sufficient information to establish identity;
• the subject of the request;
• a clear explanation of the request;
• supporting information and documents where necessary.

Requests under KVKK are resolved within 30 days at the latest in accordance with legislation. The Authority’s regulations also prescribe a 30-day response period for requests concerning deletion or destruction of Personal Data.

Where a request entails additional costs, the applicable legislation and the fee principles determined by the Board may apply.

Rvzsoft services are, as a rule, offered to customers and businesses legally capable of entering into transactions on their own behalf.

Unless a specific service for children is provided, there is no intention to knowingly collect Personal Data from children.

Rvzsoft may be contacted if it is believed that a child’s data has been submitted to the system unlawfully or without the necessary permission.

The Rvzsoft website may contain links to third-party websites or services.

Rvzsoft is not responsible for those sites’:

• content;
• security practices;
• privacy policies;
• independent data processing activities.

Users are advised to review the relevant third party’s privacy terms separately.

Rvzsoft may update this Privacy Policy for reasons such as:

• legislative changes;
• changes to services;
• use of new technologies;
• changes to data processing activities.

The current version is published on rvzsoft.com.

For changes that significantly affect users, additional notification is provided through appropriate methods where required by applicable legislation.