Privacy Policy and KVKK / GDPR Notice
This notice explains which personal data we process, why, on what legal basis and for how long — under Article 10 of Turkish Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).
1. Data controller
Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by the following company as data controller:
- Name: Baksoft Arge Yazılım Çözümleri Sanayi ve Ticaret Anonim Şirketi ("Baksoft Arge")
- Address: Antalya Teknokent, Ar-Ge 2 Building, Konyaaltı / Antalya, 07070, Türkiye
- Email: [email protected]
- Phone: +90 536 910 70 50
- Website: https://baksoftarge.com
This notice applies to visitors of baksoftarge.com and to anyone who contacts us through the contact form, email, phone or WhatsApp. For customer-portal users and data processed under a contract, the contract terms and in-portal notices apply in addition.
2. Personal data we process and its categories
The table below shows which data we process and in which situation. Each item is processed only in the relevant situation and for the relevant purpose.
| Data category | Data | When / how |
|---|---|---|
| Identity and contact | Name, email address, phone number (optional) | When you fill in the contact form or reach us by email, phone or WhatsApp |
| Request details | Project type, message content (including anything you write in your message), date and time of submission | Contact form |
| Request source | Campaign tags (UTM) of the link or ad you came from, ad click ID (gclid/gbraid/wbraid), first page viewed, referring site | Kept temporarily in your browser when you arrive from a link or ad; attached to your request only if you submit the form |
| Transaction security | IP address, browser/device information, bot-verification result | To prevent misuse and spam of the form (Cloudflare Turnstile and rate limiting); hosting server access logs |
| Consent record | Random consent ID, your choices (analytics / ad measurement: accepted or declined), time of the decision (millisecond precision), policy version, page, keyed hash of the IP address, browser information | When you make a choice in the cookie banner or change it |
| Measurement data (only with your consent) | Page views; clicks on phone, email, WhatsApp and contact buttons; form submissions; device/browser information, approximate location (city level), cookie identifiers; the ad click ID if you consent to ad measurement | Through Google Analytics 4 and Google Ads when you consent to analytics and/or ad measurement in the cookie banner |
We do not want you to share special-category data (health, religion, criminal convictions, etc.); you are responsible for what you write in the message field. If such data is shared, it is used only to answer your request and deleted when not needed.
We do not offer services to persons under 18 and do not knowingly collect their data.
3. Purposes and legal bases
Your data is processed for the purposes below, on the legal bases in Article 5 of KVKK (and, for EU/EEA visitors, Article 6 of the GDPR):
| Purpose | Legal basis (KVKK Art. 5) | GDPR equivalent |
|---|---|---|
| Answering your request, preparing a quote and communicating with you | Steps directly related to forming a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f) | Art. 6(1)(b) and 6(1)(f) |
| Identifying which channel or ad a request came from to measure the efficiency of advertising spend | Legitimate interest (Art. 5/2-f) | Art. 6(1)(f) |
| Protecting the form against spam and misuse; information security | Legitimate interest (Art. 5/2-f) and the data-security obligation (Art. 12) | Art. 6(1)(f) and Art. 32 |
| Analysing and improving website use (Google Analytics 4) | Explicit consent (Art. 5/1) | Art. 6(1)(a); ePrivacy Directive Art. 5(3) |
| Measuring ad conversions (Google Ads) | Explicit consent (Art. 5/1) | Art. 6(1)(a); ePrivacy Directive Art. 5(3) |
| Proving your cookie/measurement choice and consent | Legal obligation (Art. 5/2-ç) and establishment, exercise or protection of a right (Art. 5/2-e) | Art. 6(1)(c), 6(1)(f) and Art. 7(1) |
| Obligations under legislation (tax, accounting, requests of competent authorities) and legal disputes | Expressly provided by law (Art. 5/2-a), legal obligation (Art. 5/2-ç), protection of a right (Art. 5/2-e) | Art. 6(1)(c) and 6(1)(f) |
Where processing relies on consent, you can withdraw it at any time, without retroactive effect, through the “Cookie Preferences” link at the bottom of the page. If you do not consent you can still use the site and the contact form; only the relevant measurement is not performed.
Your data is not used for automated decision-making or profiling that produces legal effects concerning you.
4. How personal data is collected
Your data is collected electronically, wholly or partly by automated means, through the contact form, email, phone and WhatsApp channels, technical information your browser sends automatically and (if you consent) cookies and similar technologies.
5. Recipients of your data
Your personal data is not sold, rented or given to third parties for advertising. It is transferred only for the purposes above, to the extent necessary, to these groups of recipients:
| Recipient group | Purpose | Location |
|---|---|---|
| Hosting and infrastructure providers (website and content-management servers) | Hosting the site and records, keeping access logs | Türkiye |
| Cloudflare, Inc. (Turnstile bot verification, infrastructure) | Protecting the form against spam and misuse | USA / global |
| Google Ireland Limited and Google LLC (Google Analytics 4, Google Ads) — only with your consent | Usage analytics and ad-conversion measurement | Ireland / USA |
| Competent public authorities and courts | Obligations and requests arising from legislation | Türkiye |
| Professional advisers such as lawyers and accountants | Legal and financial processes when needed (under confidentiality obligations) | Türkiye |
When you contact us by WhatsApp, phone or email, the privacy policy of the relevant provider (e.g. WhatsApp/Meta, your email provider) applies; those services are not under our control.
6. Transfers abroad
Some of the recipients above are located abroad. Transfers abroad are made by meeting one of the conditions of Article 9 of KVKK: an adequacy decision for the country, sector or recipient; if there is none, appropriate safeguards such as standard contractual clauses in our agreements with the provider; or, for measurement data, your explicit consent.
You can contact us to obtain information on the basis or safeguards of a transfer.
7. Retention periods
Your data is kept for as long as the purpose requires and for the periods set by the relevant legislation; afterwards it is deleted, destroyed or anonymised:
| Data | Retention period |
|---|---|
| Contact request (identity, contact, request content, source information) | 2 years after the request is concluded. If the request turns into a contract, the periods tied to the contract and legislation (10 years under the Turkish Commercial Code and Tax Procedure Law) apply. |
| Notification emails | Same as the contact request |
| Consent record | 3 years from the date of the record |
| Google Analytics 4 measurement data | 14 months (maximum period configured in Google Analytics) |
| Rate-limiting records for security | Kept in memory; deleted automatically after 10 minutes |
| Hosting server access logs | As long as required for security and by legislation |
| Cookies and information stored in the browser | The periods in the table of the Cookie Policy |
8. Cookies and similar technologies
Apart from the cookies and storage strictly necessary for the site to work, analytics and ad-measurement cookies are used only with your explicit choice. The name, purpose and duration of every cookie are listed in the Cookie Policy. You can change your choice at any time through the “Cookie Preferences” link at the bottom of the page. No remarketing or profiling cookies are used.
9. Data security
In line with Article 12 of KVKK, reasonable technical and organisational measures are taken to prevent unlawful processing of and access to your data:
- The whole site is served over encrypted (HTTPS/TLS) connections with strict transport security (HSTS)
- A content security policy (CSP) and other security headers limit the loading of third-party code; measurement tools are not loaded without consent
- The contact form is protected by bot verification and rate limiting
- Access to the admin panel is limited by authentication and authorisation; only personnel who need it for their duties can access data
- In consent records the IP address is stored as a keyed hash (HMAC-SHA256), not in plain text
- No unnecessary data is collected; data is kept within purpose and time limits
10. Your rights as a data subject (KVKK Art. 11)
Under Article 11 of KVKK you can apply to the data controller to exercise the following rights:
- To learn whether your personal data is processed
- To request information if it has been processed
- To learn the purpose of processing and whether it is used in line with that purpose
- To know the third parties to whom your data is transferred, in Türkiye or abroad
- To request correction if your data is incomplete or inaccurate
- To request deletion or destruction of your data under the conditions of Article 7 of KVKK
- To request that correction and deletion/destruction be notified to the third parties to whom your data was transferred
- To object to an outcome against you that results from analysis of your data exclusively by automated systems
- To claim compensation if you suffer damage because of unlawful processing
You can send your applications in writing to the address above, in line with the Communiqué on Application Procedures and Principles to the Data Controller, or to [email protected] in a way that allows us to verify your identity. Your application must clearly include your name, surname, contact details and the subject of your request; we may ask for additional information to verify your identity.
Applications are concluded free of charge within thirty days at the latest, depending on the nature of the request; if the process requires a separate cost, the fee in the tariff set by the Personal Data Protection Board may be charged.
If you receive no reply, find the reply insufficient or the reply is not given on time, under Article 14 of KVKK you can complain to the Personal Data Protection Board within thirty days of learning the reply and in any case within sixty days of the application date.
11. GDPR information for EU/EEA visitors
If you visit the site from the European Union or European Economic Area, the following applies under Regulation (EU) 2016/679 (GDPR), in addition to the information above:
- Controller: the company named in section 1. Our services are directed at Türkiye; we are not established in the EU and have not appointed an EU representative under Art. 27 GDPR. We have also not appointed a data protection officer (DPO); you can send data-protection requests to [email protected].
- Legal bases: shown with their GDPR Art. 6 equivalents in the table in section 3. For processing based on legitimate interest you can request a summary of the balancing assessment.
- Your rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interest (Art. 21). You can withdraw consent at any time (Art. 7(3)); withdrawal does not affect the lawfulness of earlier processing.
- Transfers: your data is processed in Türkiye; because of some recipients in section 5 it may be transferred to third countries such as the USA. For these transfers we rely on the recipient's participation in the EU–US Data Privacy Framework or on safeguards under Chapter V GDPR such as standard contractual clauses.
- Automated decision-making: your data is not used for automated decision-making or profiling that produces legal effects concerning you (Art. 22).
- Right to lodge a complaint: you can complain to the data-protection authority of the country where you live or work or where the infringement took place, and/or to the Personal Data Protection Board in Türkiye.
- Providing data: the mandatory fields of the contact form are needed so that we can answer your request; if they are not provided we cannot answer it. Measurement data is entirely optional.
12. Changes to this notice
This notice is updated when legislation or our processing activities change; the current version and its date are at the top of this page. If measurement purposes or the tools used change materially, cookie consent is requested again. Questions: [email protected]