KVKK Privacy Notice and Explicit Consent Text

Version

1.0

Effective date

6 November 2026

Last updated

6 November 2026

About this translation: This English text is a translation of the Turkish original, provided for information only. The Turkish version is the binding text and prevails in the event of any discrepancy. This translation is pending legal review.

Data Controller: PROTOOLBAG YAZILIM TEKNOLOJİLERİ A.Ş.

PART A — Privacy Notice (KVKK Art. 10)

This notice has been prepared pursuant to Article 10 of the Law on the Protection of Personal Data No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

1. Identity of the Data Controller

Distinction of roles: Protoolbag is the data controller for your own account, identity and billing data. For the employee/HR, CRM and other business data that a customer-tenant uploads to the platform, Protoolbag is the data processor; the data controller for such data is the relevant customer organisation, and that organisation's privacy notice applies.

2. Personal Data Processed

• Identity: First name, last name, username.
• Contact: E-mail address, telephone.
• Profile: Avatar/profile photo (via signed URL), biography, preferred language.
• Account/Authorisation: User ID, role (RBAC), tenant/organisation affiliation, account status, last login.
• Authentication: Password (one-way hashed), TOTP MFA status.
• Transaction security: IP address, audit/log records, session and error events.
• Subscription/Billing: Plan, licence, invoice/payment records.
• Preferences: Language, theme, selected organisation (browser local storage).
• Artificial intelligence interaction: The prompt and context text you enter into the AI assistant/natural-language query (only when you use the relevant feature — see §4).

Special categories of personal data (KVKK Art. 6): Special categories of personal data are not routinely processed within the scope of Protoolbag's own (data controller) data. With respect to sensitive data such as Turkish national ID number, IBAN, salary, date of birth, gender, marital status and address, which may be processed by the employer customer-tenant in the HR/payroll (PHR) module, the data controller is the relevant customer organisation (see Data Processing Agreement §3.1); in this context, that organisation's privacy notice and explicit consent apply.

3. Purposes of Processing Personal Data

• Access to the platform, authentication and account management,
• Role-based access and multi-tenant data isolation,
• Subscription, licensing, billing,
• Information security, audit trail, prevention of misuse,
• Delivery of service-related notifications,
• Fulfilment of legal obligations, responding to legal claims.

4. Parties to Whom Personal Data Is Transferred and Purpose of Transfer

Your personal data may be shared, strictly limited to the purposes above, with:

• The hosting/infrastructure service provider (Supabase — database, authentication, file storage, server-side functions; region: EU — Frankfurt, Germany),
• The e-mail delivery provider (Resend by default — USA; Microsoft Exchange 365 / SendGrid depending on the tenant's configuration),
• Artificial intelligence / embedding providers (Anthropic, Google, Groq, OpenAI and Voyage AI — USA; only when you use AI features; the relevant API inputs are not used for model training),
• Authorised public institutions and organisations and legal authorities, upon request.

Detailed list of sub-processors: Data Processing Agreement §6.

Transfer abroad (KVKK Art. 9): Primary data is held in the EU (Frankfurt); the transfer of data from Türkiye to the EU and transfers to US-based artificial intelligence/embedding/e-mail providers are carried out in accordance with the conditions laid down in KVKK Art. 9 (appropriate transfer instruments provided for under KVKK; Standard Contractual Clauses for GDPR purposes).

5. Method and Legal Basis of Collecting Personal Data

Your personal data is collected electronically through account creation/invitation, use of the platform and automatic system records. Legal bases (KVKK Art. 5):

• Establishment/performance of a contract (Art. 5/2-c) — provision of the service,
• Legal obligation (Art. 5/2-ç) — billing, record retention,
• Legitimate interest (Art. 5/2-f) — security, logs, prevention of misuse,
• Establishment/protection of a right (Art. 5/2-e) — legal claims/defence,
• Explicit consent (Art. 5/1) — only in cases requiring consent (see Part B).

6. Rights of the Data Subject (KVKK Art. 11)

Every data subject has the right to learn whether their personal data is processed, to request information, to learn whether it is used in line with its purpose, to know the third parties to whom it is transferred, to request rectification if it is processed incompletely/inaccurately, to request erasure/destruction within the framework of KVKK Art. 7, to request that such actions be notified to the third parties to whom the data was transferred, to object to a result to their detriment arising from analysis by automated systems, and to claim compensation for damage.

You may submit your applications, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by e-mail to info@protoolbag.com or in writing to Bilişim Vadisi, Gülbahçe Mah. İçmeler Cad. No:14/1 İç Kapı No: B05, Urla / İzmir, Türkiye. Applications are concluded within 30 days at the latest pursuant to KVKK Art. 13. The platform technically supports data export and data erasure requests.

PART B — Explicit Consent Text (only for cases requiring consent)

Note: The explicit consent below is obtained only for processing activities to which none of the exceptions in KVKK Art. 5/2 and Art. 6/3 apply. Processing based on the performance of a contract, a legal obligation or legitimate interest does not require explicit consent, and refusal of consent does not stop such processing.

B.1 Scope of Explicit Consent

You declare that you give explicit consent, within the meaning of KVKK Art. 3/1-a, freely, on a specific matter and on an informed basis, on the following matters:

• Transfer abroad — I give explicit consent to the transfer of my personal data to sub-processors established abroad (e.g. hosting/e-mail providers) for the purpose of providing the service.
• Marketing/information messages — I give explicit consent to the sending of commercial electronic messages to me containing products, campaigns and newsletters. (Commercial electronic messages are sent in accordance with Law No. 6563 and the rules of the Message Management System (İleti Yönetim Sistemi).)
• Artificial intelligence features — I give explicit consent to the prompt and context text I enter, when I use the optional artificial intelligence features (assistant, natural-language query), being transmitted for inference purposes to artificial intelligence providers established abroad (USA). (Details: Privacy Policy §8.)

B.2 Explicit Consent for HR / Special Categories of Data (PHR module — customer-tenant controller)

Where special categories of personal data (KVKK Art. 6) relating to employees are processed in the HR/payroll (PHR) module, the data controller is the relevant employer customer-tenant. Explicit consent in this context is collected through the in-product KVKK consent module in the HR module, and consent records are stored on the platform. The employer must configure this module with the correct content and consent types; Protoolbag only provides the technical infrastructure (data processor).

B.3 Withdrawal of Consent

You may withdraw your explicit consent at any time by writing to info@protoolbag.com. Withdrawal does not render processing carried out up to the time of withdrawal unlawful.

Version history