Personal Data Protection Notice (KVKK Disclosure)

1. Data Controller

This notice relates to the processing of your personal data in connection with the corporate website operated under the KODMIS brand at https://www.kodmis.com, its communication channels, demo / application processes, and SaaS platform services.

Data Controller: KODMIS · Türkiye · Tax Office: Mardin Vergi Dairesi, Tax No: 29573225566.

Contact: [email protected] · 0537 252 23 27 · KVKK requests: [email protected]

2. Scope

This notice applies to website visitors, demo / contact form submitters, pilot programme applicants, prospective customers, customer representatives, account users, business partners, and natural persons who submit support requests.

With respect to end-consumer data processed by customer stores on their own storefronts, the data controller is in principle the relevant store operator. As the platform provider, KODMIS processes such data solely within the scope of its contractual and technical services; store-level privacy policies are published by the store operator.

3. Categories of Personal Data Processed

• Identity: first name, last name, title, company / store name
• Contact: email address, phone number, preferred communication channel
• Customer transaction: demo request, plan preference, pilot application, message content, support records
• Transaction security: IP address, browser / device information, session and security logs, cookie identifiers
• Marketing (with explicit consent): communication preferences, campaign interactions
• Financial / billing (for subscribers): billing name, tax information, payment status (card data is held by a PCI-compliant payment institution; KODMIS does not store card numbers)
• Usage data: product / feature usage metrics, AI credit consumption (at account level)

4. Purposes of Processing

• Providing, securing, and monitoring the performance of the website
• Managing demo, quotation, pilot programme, and pre-sales communications
• Setting up, managing, billing, and supporting SaaS subscriptions
• Fulfilling contractual and statutory obligations
• Preventing, detecting, and investigating fraud, misuse, and security incidents
• Product development, bug fixing, and service quality improvement (anonymised / aggregated wherever possible)
• Commercial electronic messaging and marketing communications based on explicit consent
• Managing processes related to the exercise of rights under KVKK and applicable legislation

5. Legal Bases (KVKK Art. 5 / Art. 6)

Your personal data are processed on the basis of one or more of the following legal grounds, depending on the processing purpose:

• Directly related to the establishment or performance of a contract (Art. 5/2-c)
• Necessary for the data controller to fulfil its legal obligation (Art. 5/2-ç)
• Legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed (Art. 5/2-f) — e.g. site security, product improvement, B2B sales communications
• Explicit consent (Art. 5/1) — non-essential cookies, marketing communications, certain special-purpose processing activities
• Necessary for the establishment, exercise, or protection of a right (Art. 5/2-e)

6. Collection Methods

Data are collected automatically or semi-automatically via web forms, email / phone communications, account registration, in-product usage, cookies and similar technologies, support channels, and (within the scope of explicit consent / contract) third-party integrations.

7. Data Transfers

Your personal data may be transferred to the following recipient groups, limited to the purposes set out above and subject to appropriate technical and administrative safeguards:

• Hosting, infrastructure, email, analytics, customer support, and payment service providers (processors / sub-processors)
• Legal, financial, and audit advisors (to the extent required)
• Authorised public authorities and institutions (where legally required)
• Overseas service providers where permitted by your explicit consent or applicable law — in such cases, appropriate safeguards under KVKK Art. 9 are observed

8. Retention Periods

Data are retained for the period required by the processing purpose and the limitation / retention obligations set out in applicable legislation; upon expiry, data are deleted, destroyed, or anonymised.

• Communication / demo records: until the request is concluded + a reasonable follow-up period (generally up to 3 years, unless otherwise required)
• Contract / billing records: commercial and tax law retention periods (generally 10 years)
• Security logs: security and dispute requirements (generally 1–2 years)
• Cookies: durations specified in the Cookie Policy
• Marketing consents: until consent is withdrawn or a deletion request is fulfilled

9. Rights of the Data Subject (KVKK Art. 11)

Pursuant to Article 11 of KVKK, you have the right to: learn whether your personal data are processed; request information if they are; learn the purpose of processing and whether data are used in accordance with that purpose; know the third parties to whom data are transferred domestically or abroad; request rectification of incomplete or inaccurate data; request deletion or destruction within the framework of KVKK Art. 7; request that transfers to third parties be notified; object to any result that arises to your detriment through analysis conducted exclusively by automated systems; and claim compensation for damages arising from unlawful processing.

10. How to Submit a Request

You may submit your requests in writing to [email protected] or via [email protected], together with information that verifies your identity. Requests are resolved as soon as possible and within thirty days at the latest, in accordance with KVKK and the Communiqué on Principles and Procedures for Data Subject Applications. If the process entails an additional cost, the fee set out in the schedule determined by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) may be charged.

If your request is rejected, the response is deemed inadequate, or no response is given within the prescribed period, you retain the right to file a complaint with the Personal Data Protection Board.

11. Updates

This notice is valid as of 12 Eylül 2026. It may be updated due to changes in legislation or our processing activities; the current version is published at https://www.kodmis.com/yasal/kvkk.