Data Protection Notice (KVKK Art. 10)

#1. Data controller

This notice covers personal data that the Owner processes as a controller. That data belongs to:

• Website visitors.
• People who e-mail us and prospective customers.
• Representatives of customer companies.
• Application users.
• People whose numbers are registered for the WhatsApp assistant and notifications.

Out of scope: data about home buyers and agents that customer companies enter into the FORA application is not covered by this notice. The respective company is the controller of that data and the Owner is only a processor. The company also has the duty to inform. Send requests about that data to the company that recorded it.

#2. Data subjects and data processed

#A. Website visitors (forapp.online)

• Category: transaction security.
• Data: IP address, browser and device information, page visited, date and time.
• Purposes:
  • Delivering the website technically.
  • Running information security processes.
  • Preventing abuse.
• Legal basis: KVKK Art. 5(2)(f), legitimate interest.
• Collection method: automatically, by the server and hosting infrastructure during your visit.
• Recipients:
  • Railway Corporation, for hosting (a US company; its log infrastructure is in the US).

#B. People who contact us by e-mail and prospective customers

• Categories: identity, contact, professional details, requests and complaints.
• Data: name, e-mail, phone, job title, company, message content and attachments.
• Purposes:
  • Responding to demo, quote and information requests.
  • Pre-contract discussions.
  • Running communication activities.
• Legal basis:
  • KVKK Art. 5(2)(c), directly related to concluding a contract.
  • KVKK Art. 5(2)(f), legitimate interest.
• Collection method: electronically, through e-mails you send to info@forapp.online.
• Recipients:
  • Cloudflare, Inc., for e-mail routing.
  • Google LLC, for the mailbox.

#C. Customer representatives and contacts

• Categories: identity, contact, professional details, customer transactions, finance.
• Data: name, job title, business e-mail and phone, signing authority details, billing and payment details, correspondence.
• Purposes:
  • Running contract processes.
  • Running sales of goods and services.
  • Finance and accounting.
  • Invoicing.
  • Handling legal matters.
  • Informing authorised persons and institutions.
• Legal basis:
  • KVKK Art. 5(2)(a), expressly provided for by law (Tax Procedure Law, Commercial Code).
  • KVKK Art. 5(2)(c), conclusion and performance of a contract.
  • KVKK Art. 5(2)(ç), legal obligation.
  • KVKK Art. 5(2)(e), establishment, exercise or protection of a right.
• Collection method: through contracts, order forms, e-mail and meetings.
• Recipients:
  • Competent public authorities (tax administration, etc.).
  • Accountants and legal advisers.
  • E-mail infrastructure providers.

#D. FORA application users (customer employees)

• Categories: identity, contact, professional details, transaction security, customer transactions.
• Data:
  • Name, e-mail, role, account status.
  • A one-way hash of the password (bcrypt).
  • Login and logout records, failed login attempts and their reason.
  • A record of actions taken in the application: when, which record, old and new values.
  • IP address and browser information.
  • Session cookies.
• Purposes:
  • Creating the account and authenticating you.
  • Managing access rights.
  • Providing the service.
  • Running information security processes.
  • Audit activities, so the customer company can review its own activity history.
  • Detecting and preventing unauthorised access and abuse.
  • Evidence in legal disputes.
• Legal basis:
  • KVKK Art. 5(2)(c), necessary to perform the subscription agreement between the Owner and the customer company.
  • KVKK Art. 5(2)(ç), legal obligation (e.g. the data security duty under KVKK Art. 12).
  • KVKK Art. 5(2)(e), establishment, exercise or protection of a right.
  • KVKK Art. 5(2)(f), legitimate interest in system security and audit trail integrity.
• Collection method:
  • Through your company's account request.
  • Automatically and electronically while you use the application.
• Recipients:
  • Railway Corporation, for hosting and the database.
  • Authorised users of your customer company. Activity records, and your name in note, document and sales representative history, are visible to your company's authorised roles for internal audit.
  • Competent authorities and courts, on request.

#E. People whose numbers are registered for the WhatsApp assistant and notifications

• Categories: contact, transaction security, customer transactions.
• Data:
  • Mobile number and authorisation role.
  • The text of the questions you send to the assistant and its answers.
  • The content of notifications sent to you.
• Purposes:
  • Providing the WhatsApp assistant and notification service the customer company requested.
  • Verifying that a message comes from an authorised number.
• Legal basis:
  • KVKK Art. 5(2)(c), performance of a contract.
  • KVKK Art. 5(2)(f), legitimate interest.
• Collection method:
  • Through the customer company's registration request.
  • Through the messages you send on WhatsApp.
• Recipients:
  • Twilio Inc., and Meta Platforms for the WhatsApp channel, to deliver messages.
  • An AI service provider (US), whose AI model answers the question. Your phone number is not sent to this provider; the question text and query results are.

#3. Transfers abroad

The providers listed above have servers outside Türkiye. Providers and their locations:

The Turkish Personal Data Protection Board has not yet issued any adequacy decision. The process of putting in place the appropriate safeguards under KVKK Art. 9 (the standard contracts published by the Board and notification to the Authority) is under way for these transfers.

#4. Retention

Personal data is kept for as long as the purpose requires and for any legal retention period. It is then deleted, destroyed or anonymised. Personal data is kept for the periods set by law and the periods in this notice; for details, see the "Retention" section of the Privacy Policy.

#5. Your rights (KVKK Art. 11)

By applying to the controller, you may:

a) Learn whether your personal data is processed.

b) Request information about the processing if it is.

c) Learn the purpose of the processing and whether the data is used for that purpose.

ç) Know the third parties, in Türkiye or abroad, to whom your data is transferred.

d) Request correction of incomplete or inaccurate data.

e) Request deletion or destruction under the conditions of KVKK Art. 7.

f) Request that actions taken under (d) and (e) be notified to the third parties who received the data.

g) Object to an adverse outcome arising exclusively from automated analysis.

ğ) Claim compensation for damage caused by unlawful processing.

#6. How to apply

Requests are made in line with the Communiqué on the Procedures and Principles of Application to the Data Controller.

A request must include:

• Your name and, for written requests, your signature.
• For Turkish citizens, the Turkish ID number; for foreign nationals, nationality and passport or ID number.
• A residential or business address for notifications.
• If available, an e-mail address, phone and fax number for notifications.
• The subject of the request.

Where to send it:

• E-mail: info@forapp.online. Sending from the e-mail address registered in our system helps us verify your identity.

We resolve requests as soon as possible and within 30 days at the latest, free of charge. If the request involves an additional cost, a fee under the Board's tariff may apply.

If your request is rejected, you find the answer insufficient or we do not answer in time:

1. You may complain to the Personal Data Protection Board within 30 days of learning of the answer, and in any case within 60 days of your request.
2. You must apply to the controller first before you can complain.