KVKK Privacy Notice

Data Controller

This notice has been prepared by Mustafa Sercan Kan - Octofly.io in its capacity as data controller pursuant to Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, “KVKK”).

Address: Cennet Mahallesi Mehtap Sokak 9/7 Küçükçekmece

Email: hello@octofly.io

Tax Office / No.: Küçükçekmece Vergi Dairesi — 53806231918

Personal Data We Process

If you fill in the quote and contact form on our website, the following data are processed:

• Identity data: first name and surname
• Contact data: phone number, email address
• Customer transaction data: company name, current website address, request type and your form message
• Transaction security data: an irreversibly encrypted digest of your IP address (the raw IP address is not stored), browser information
• Marketing data: campaign information on the channel through which you reached the site

Purposes of Processing and Legal Grounds

Your personal data are processed for the following purposes and on the legal grounds indicated:

• Evaluating your request and getting back to you — Article 5(2)(c) KVKK (processing directly related to the conclusion or performance of a contract)
• Measuring the effectiveness of our services and promotional activities — Article 5(2)(f) KVKK (legitimate interest)
• Preventing form abuse and automated submissions — Article 5(2)(f) KVKK (legitimate interest)
• Sending commercial electronic messages — only if you have given your explicit consent (Article 5(1) KVKK and Law No. 6563 on the Regulation of Electronic Commerce)
• Measuring the results of our advertising through Meta — only if you have given your explicit consent to marketing cookies (Article 5(1) KVKK)

Your Customer Panel Account

If you open an account in the customer panel, the following data are processed independently of the quote form:

• Identity data: first name and surname
• Contact data: email address and, optionally, phone number
• Transaction security data: an irreversibly encrypted digest of your password (your password is not stored in plain form), session and last login records, encrypted digests of email verification codes
• Customer transaction data: business name, your list of services, your service area, city and district information, the promotional text to be published on your site
• Visual records: the logo and images you upload to the panel

Purpose of Processing Panel Data

The data processed in connection with the panel are necessary for the performance of the service agreement:

• Creating your account, verifying your identity and providing you with access to the panel — Article 5(2)(c) KVKK (performance of the contract)
• Setting up, publishing and managing your site — Article 5(2)(c) KVKK (performance of the contract)
• Ensuring account security and limiting unauthorised login attempts — Article 5(2)(f) KVKK (legitimate interest)
• Sending password reset and email verification notifications — Article 5(2)(c) KVKK (performance of the contract)

Panel Notifications

If you use the "Bildirimleri aç" (Turn on notifications) option in the customer panel, we use the service of OneSignal, Inc. (USA) as a data processor so that we can send notifications to your browser in cases such as a new request arriving from your site or your preview being ready. If you do not use this option, the data below are not processed.

In this context, the following data are processed:

• Subscription information generated by your browser for notifications
• Browser and device type, operating system, language and time zone
• The time the panel was first and last opened, the number of times it was opened, and whether notification permission is on or off
• Your IP address and the approximate country derived from it
• A pseudonymous user ID that does not directly identify your account and can be matched to your account only on our own servers

Panel Notifications: Purpose, Transfer and Retention

Your name, email address, phone number, business name, domain name and the content of forms submitted to your site are not transferred to OneSignal. Notifications contain only general information such as "Sitenizden yeni bir talep geldi" (A new request has arrived from your site); you see the details in the panel.

These data are processed solely for the purpose of delivering panel notifications to you, in order to provide the notification service you have requested (Article 5(2)(c) KVKK). They are not used for advertising, profiling or any other purpose.

OneSignal’s servers are located in the Netherlands and the data can also be accessed from the USA; the data are therefore transferred abroad. The transfer is carried out on the basis of the appropriate safeguards provided for in Article 9 KVKK.

Your subscription information is kept until you turn off notifications on all devices or your account is deleted. When you turn off notifications using the "tüm cihazlarda kapat" (turn off on all devices) option on the panel’s Notifications screen, or when your account is deleted, your record at OneSignal is also deleted. Records of the notifications sent are deleted by OneSignal after 30 days. You can also turn off notifications on a single device from your browser settings; in that case no notifications are sent to that device, but to have the record deleted you need to use the "tüm cihazlarda kapat" (turn off on all devices) option.

Access to Your Account by Our Support Team

So that it can see first-hand a problem you have reported, our support team may view your customer panel using its own corporate account. During such access, the data you see in the panel are displayed; your password cannot be seen or used under any circumstances.

For each access, the identity of the person accessing, the reason, the start and end time and the actions taken are recorded. The records are not deleted.

By default, access is VIEW-ONLY. Write permission is granted separately and with a stated reason; even when granted, it is limited to your site’s CONTENT only: logo and images, promotional text, company information, blog posts, service pages and design references — including adding, editing and deleting them.

The following actions are blocked in all circumstances: accepting agreements, creating orders, payment, closing the account, approving the design, security settings (password and two-step verification) and connecting a domain name. These are decisions only you can make, or actions that cannot be undone.

This processing is carried out within the scope of the performance of the service agreement (Article 5(2)(c) KVKK) and our legitimate interest in resolving your support request (Article 5(2)(f) KVKK).

Panel Help Assistant (Octo) Conversations

The questions you write to Octo, the help assistant in the customer panel, and the answers Octo gives are used to help you and to improve Octo. We see which questions Octo could not answer and improve our help content accordingly.

Conversations are stored linked to your business’s account; your name, email address and IP address are not included in the conversation record. Email addresses, phone numbers, IBANs, links and domain names in your question are masked before recording. Please do not write personal information such as names or addresses in your questions.

Conversations are kept for 90 days from the last message and are then deleted. If Octo has learned a useful match from a question (e.g. the question "logo değiştir" (change logo) matched to the article "Logomu nasıl değiştiririm?" (How do I change my logo?)), this match is not deleted. The match retains a search key made up of the first five letters of the words in the question and, at the end of the 90 days, a sample question reduced to words belonging only to the help topic. These are not associated with any business or person and are used indefinitely so that better answers can be given to all customers. If a name or an address was written in the question, shortened fragments of it may remain in the search key, and a name spelled the same as a help-topic word (e.g. "Alan", "Aydın" — Turkish words that are also used as personal names) may remain in the sample question.

This processing is carried out within the scope of our legitimate interest in providing and improving the service (Article 5(2)(f) KVKK) and the performance of the service agreement (Article 5(2)(c) KVKK).

Processing of Campaign Source Information

Information on the channel through which you reached the site (for example, a search engine advertisement or a direct visit) is processed on the basis of our legitimate interest, so that we can evaluate your request correctly and measure the effectiveness of our own promotional spending. This information is kept in your browser’s session storage, contains no persistent identifier and is not shared with third parties.

If you do not allow analytics and marketing cookies in your cookie preferences, persistent records of your visit history and advertising click IDs are not processed.

Advertising Measurement (Meta)

If you have allowed marketing cookies in your cookie preferences and our quote or contact form has been recorded successfully, a "form submitted" notification is sent from our server to Meta Platforms (Facebook, Instagram) so that we can measure how many requests our advertising brings in.

This notification contains only the following: an irreversible version of your email address and phone number, hashed using the SHA-256 method; your IP address; your browser information; the address of the page on which you submitted the form (with search parameters removed); the IDs of Meta advertising cookies, if present in your browser; and the time of submission and a random transaction code specific to the submission. Your name, company name, message and the other information in the form are not sent.

Meta matches the hashed information with its own records, reports the results of our advertising to us in aggregate, and processes these data within the framework of its own terms.

This processing and the transfer abroad are based on the explicit consent you give for marketing cookies (Article 5(1) and Article 9 KVKK). If you do not give consent, or if you withdraw your consent from the cookie preferences, no notification is sent; your form is still recorded and we will get back to you. Withdrawal does not reverse notifications already sent.

Visit and Interaction Measurement

Both on this site and on the customer sites we publish as part of the service, we measure the number of visitors and how much interest the pages attract. Measurement is carried out on our own server; no data are sent to a third-party analytics service.

The information measured is: the address of the page viewed (with search parameters removed), the channel through which you came to the site, device type, the approximate location (city/country) reported by the hosting provider, and whether you clicked on the contact links on the page (phone, WhatsApp, email, map).

When you click a link, only the TYPE of link is recorded; the number you call, the email you write or the address you view is not recorded. These links are in any case the relevant business’s own contact details.

Measurement does not write any cookie or persistent record to your browser. The visitor ID is an irreversible digest derived on the server from your IP address and browser information and RENEWED EVERY DAY; your raw IP address is not stored. Because the ID is renewed daily, it is technically not possible to track you across days.

This processing is carried out within the scope of our legitimate interest in providing and improving the service (Article 5(2)(f) KVKK). Since no persistent identifier is used and no record is written to your device, explicit consent is not sought.

Transfer of Personal Data

Your personal data are transferred to the suppliers below so that the service can be provided. All of these transfers qualify as transfers abroad within the meaning of Article 9 KVKK; the fact that servers are located within the European Union does not change this.

Transfers to Service Providers in Türkiye

Some customer sites are hosted on the servers of our hosting service provider established in Türkiye, Veridyen Bilişim Teknolojileri Sanayi ve Ticaret Limited Şirketi. Veridyen is a service provider with which we have signed a data processing agreement and which processes data on our behalf; this transfer takes place within Türkiye.

In this context, the following information is transferred to Veridyen: your site’s domain name; the username and password of the hosting account; and, for publication on your site, your business name, slogan, logo, phone number, email address, address and WhatsApp number. The purpose of the transfer is hosting your site and managing the hosting account.

Our platform does not send form or measurement data relating to your site’s visitors to Veridyen.

If you pay by card, the payment is taken through the infrastructure of PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş., a licensed payment institution established in Türkiye; this transfer takes place within Türkiye.

In this context, the following information is transferred to PayTR: the first name and surname or company name, address and phone number in your billing details; your email address; your IP address at the time of payment; and the name and amount of the service paid for. The purpose of the transfer is taking the payment, checking the payment status, making refunds where necessary and, if you so choose, renewing your subscription automatically from your saved card.

The card number, expiry date and security code are sent directly from the payment form to PayTR; this information does not reach our platform and is not stored by us. If you choose to save your card, the card is stored with PayTR; we keep only the card reference issued by PayTR for automatic renewal. You can remove your saved card at any time from the Subscription page.

Retention Periods

In anonymisation, the name, contact details and message content are permanently deleted; a statistical record that cannot be associated with your identity is retained.

• Records flagged as automated submissions (spam): deleted after 30 days
• Requests evaluated but not concluded: anonymised 24 months after the last contact
• Records relating to customers with whom a contract has been concluded: for the retention periods provided for in the applicable legislation
• Panel notification subscription information: until you turn off notifications on all devices or your account is deleted; records of notifications sent are deleted by OneSignal after 30 days
• Octo help assistant conversations: deleted 90 days after the last message; the matches Octo has learned (a shortened search key and a sample question reduced to help-topic words) are kept indefinitely without business or personal information
• Customer site backups: kept for 30 days; a deleted record remains in backups for no longer than this period, and when the agreement ends and the customer record is deleted, the site’s backups are permanently deleted within 30 days at the latest

Your Rights

Under Article 11 KVKK, you have the right to: learn whether your personal data are processed; request information about it if they have been processed; learn the purpose of the processing and whether the data are used in line with that purpose; know the third parties in Türkiye or abroad to whom the data are transferred; request correction if the data are incomplete or inaccurately processed; request their erasure or destruction; request that these operations be notified to the third parties to whom the data have been transferred; object to a result arising against you through the analysis of the data exclusively by automated systems; and claim compensation for damage you suffer as a result of unlawful processing.

You can send your requests to hello@octofly.io. Your applications are concluded within 30 days at the latest.