Privacy Notice (KVKK)
Under Article 10 of Turkish Personal Data Protection Law No. 6698
Last updated: 4 October 2026
This notice explains how ATALAY YAZILIM LİMİTED ŞİRKETİ ("Atalay Yazılım", "we") processes your personal data on atalay.tech, in our forms, on our WhatsApp line and in our services: for what purpose, on which legal basis, with whom we share it and for how long. It is information only; no consent is required.
Processing based on your explicit consent (optional cookies and the related transfers abroad) is described in the Explicit Consent Text; marketing messages in the Commercial Message Consent. Both are optional. The Turkish version prevails.
1. Data controller
- Legal name
- ATALAY YAZILIM LİMİTED ŞİRKETİ
- Short name
- Atalay Yazılım Ltd. Şti.
- MERSİS
- 0096046637100001
- Tax office / no
- MECİDİYEKÖY TAX OFFICE · 0960466371
- Trade registry
- İSTANBUL TRADE REGISTRY OFFICE · 1121712
- Address
- FULYA MAH. YEŞİLÇİMEN SK. POLAT TOWER RESIDENCE NO: 12 İÇ KAPI NO: 430 ŞİŞLİ / İSTANBUL
- KEP
- atalayyazilim@hs01.kep.tr
- info@atalay.tech
- Phone
- +90 850 302 34 11
2. Personal data we process
- Identity
- Data: Full name
- Source: Contact, callback, cost calculator, careers and partner forms; WhatsApp profile name
- Contact
- Data: Phone, email, (partners) company name
- Source: The same forms; your number if you write to us on WhatsApp
- Request
- Data: Subject, budget range, message, features chosen in the cost calculator, page and ad campaign of the form
- Source: Forms
- Correspondence
- Data: WhatsApp and email messages, page name and reference code added to the message, meeting time
- Source: WhatsApp, email
- Professional
- Data: CV file, school, department, position, LinkedIn URL, cover letter
- Source: Careers, internship and open application forms
- Security
- Data: IP address, browser (user agent), submission time
- Source: Automatically with every form
- Preferences
- Data: Your marketing consent and cookie choice (time, text version, IP)
- Source: Optional checkbox, cookie banner
- Visit measurement (consent only)
- Data: Session and visitor IDs, pages viewed, referrer, UTM parameters, language, time zone, screen/window size, colour scheme, connection type, approximate location from IP (country, city), contact links clicked
- Source: Analytics cookies and first-party measurement
- Ad measurement (consent only)
- Data: Ad click IDs (gclid, gbraid, wbraid, fbclid…), Meta cookies (_fbc, _fbp), partner code, a one-way hash (SHA-256) of email and phone on form conversion
- Source: Marketing cookies
- Customer and finance (if you buy)
- Data: Contract, quote, invoice data (name, tax/ID number, address), payment records
- Source: Contract and invoicing
| Category | Data | Source |
|---|---|---|
| Identity | Full name | Contact, callback, cost calculator, careers and partner forms; WhatsApp profile name |
| Contact | Phone, email, (partners) company name | The same forms; your number if you write to us on WhatsApp |
| Request | Subject, budget range, message, features chosen in the cost calculator, page and ad campaign of the form | Forms |
| Correspondence | WhatsApp and email messages, page name and reference code added to the message, meeting time | WhatsApp, email |
| Professional | CV file, school, department, position, LinkedIn URL, cover letter | Careers, internship and open application forms |
| Security | IP address, browser (user agent), submission time | Automatically with every form |
| Preferences | Your marketing consent and cookie choice (time, text version, IP) | Optional checkbox, cookie banner |
| Visit measurement (consent only) | Session and visitor IDs, pages viewed, referrer, UTM parameters, language, time zone, screen/window size, colour scheme, connection type, approximate location from IP (country, city), contact links clicked | Analytics cookies and first-party measurement |
| Ad measurement (consent only) | Ad click IDs (gclid, gbraid, wbraid, fbclid…), Meta cookies (_fbc, _fbp), partner code, a one-way hash (SHA-256) of email and phone on form conversion | Marketing cookies |
| Customer and finance (if you buy) | Contract, quote, invoice data (name, tax/ID number, address), payment records | Contract and invoicing |
Our forms do not ask for special categories of data (health, religion, ethnicity etc.). Please leave them out of your CV.
3. How we collect it
- Web forms you fill in and files you upload (partly automated).
- Messages and calls via WhatsApp, email and phone.
- IP and browser data recorded by the server on submission (automated).
- Cookies and similar technologies, only with your consent (automated). See the Cookie Policy.
- The contract and invoicing process if you become a customer.
4. Purposes and legal bases
- Replying to your request, scheduling a call, confirming receipt by SMS and email
- Legal basis (KVKK Art. 5): 5/2-c: necessary to enter into a contract
- Performing the service contract
- Legal basis (KVKK Art. 5): 5/2-c: performance of a contract
- Invoicing, bookkeeping and tax duties
- Legal basis (KVKK Art. 5): 5/2-ç: legal obligation
- Form security, preventing spam and abuse
- Legal basis (KVKK Art. 5): 5/2-f: legitimate interest
- Measuring internally which form or page brings requests
- Legal basis (KVKK Art. 5): 5/2-f: legitimate interest
- Establishing, exercising and defending legal claims
- Legal basis (KVKK Art. 5): 5/2-e
- Assessing job and internship applications
- Legal basis (KVKK Art. 5): 5/2-c
- Assessing partner applications, partner code and commission
- Legal basis (KVKK Art. 5): 5/2-c
- Fast replies on WhatsApp (first replies may come from an AI assistant; it makes no decision with legal effect on you)
- Legal basis (KVKK Art. 5): 5/2-c and 5/2-f
- Visit measurement (Google Analytics, first-party visit log)
- Legal basis (KVKK Art. 5): 5/1: explicit consent (analytics cookies)
- Ad measurement: Google Ads, Meta, OpenAI; matching a form conversion through Meta Conversions API
- Legal basis (KVKK Art. 5): 5/1: explicit consent (marketing cookies)
- Sending campaigns and announcements
- Legal basis (KVKK Art. 5): 5/1 explicit consent and Law No. 6563 Art. 6 approval (separate optional box)
| Purpose | Legal basis (KVKK Art. 5) |
|---|---|
| Replying to your request, scheduling a call, confirming receipt by SMS and email | 5/2-c: necessary to enter into a contract |
| Performing the service contract | 5/2-c: performance of a contract |
| Invoicing, bookkeeping and tax duties | 5/2-ç: legal obligation |
| Form security, preventing spam and abuse | 5/2-f: legitimate interest |
| Measuring internally which form or page brings requests | 5/2-f: legitimate interest |
| Establishing, exercising and defending legal claims | 5/2-e |
| Assessing job and internship applications | 5/2-c |
| Assessing partner applications, partner code and commission | 5/2-c |
| Fast replies on WhatsApp (first replies may come from an AI assistant; it makes no decision with legal effect on you) | 5/2-c and 5/2-f |
| Visit measurement (Google Analytics, first-party visit log) | 5/1: explicit consent (analytics cookies) |
| Ad measurement: Google Ads, Meta, OpenAI; matching a form conversion through Meta Conversions API | 5/1: explicit consent (marketing cookies) |
| Sending campaigns and announcements | 5/1 explicit consent and Law No. 6563 Art. 6 approval (separate optional box) |
5. Recipients
- Amazon Web Services (AWS)
- Purpose: Hosting, database, file storage (CVs), email delivery (Amazon SES), company email, AI infrastructure of the WhatsApp assistant
- Location: Germany (Frankfurt) and other AWS regions
- Netgsm
- Purpose: SMS confirming your request
- Location: Türkiye
- Meta Platforms (WhatsApp Business)
- Purpose: Delivering WhatsApp messages you send us
- Location: Ireland / USA
- Google (Calendar)
- Purpose: Meeting invitation if you book a call on WhatsApp
- Location: Ireland / USA
- Google (Analytics, Ads, Tag Manager)
- Purpose: Only with your cookie consent: visit and ad measurement
- Location: Ireland / USA
- Meta Platforms (Pixel, Conversions API)
- Purpose: Only with marketing consent: ad measurement and conversion matching
- Location: Ireland / USA
- OpenAI
- Purpose: Only with marketing consent: ChatGPT ad measurement
- Location: USA
- Google (YouTube)
- Purpose: Loading the player when you play a blog video
- Location: Ireland / USA
- Payment institutions (iyzico, PayTR) and banks
- Purpose: If you pay by card or transfer
- Location: Türkiye
- e-Invoice provider and Revenue Administration
- Purpose: Issuing invoices
- Location: Türkiye
- Our accountant, legal advisers
- Purpose: Bookkeeping, legal claims
- Location: Türkiye
- Competent authorities and courts
- Purpose: Mandatory legal requests
- Location: Türkiye
| Recipient | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, file storage (CVs), email delivery (Amazon SES), company email, AI infrastructure of the WhatsApp assistant | Germany (Frankfurt) and other AWS regions |
| Netgsm | SMS confirming your request | Türkiye |
| Meta Platforms (WhatsApp Business) | Delivering WhatsApp messages you send us | Ireland / USA |
| Google (Calendar) | Meeting invitation if you book a call on WhatsApp | Ireland / USA |
| Google (Analytics, Ads, Tag Manager) | Only with your cookie consent: visit and ad measurement | Ireland / USA |
| Meta Platforms (Pixel, Conversions API) | Only with marketing consent: ad measurement and conversion matching | Ireland / USA |
| OpenAI | Only with marketing consent: ChatGPT ad measurement | USA |
| Google (YouTube) | Loading the player when you play a blog video | Ireland / USA |
| Payment institutions (iyzico, PayTR) and banks | If you pay by card or transfer | Türkiye |
| e-Invoice provider and Revenue Administration | Issuing invoices | Türkiye |
| Our accountant, legal advisers | Bookkeeping, legal claims | Türkiye |
| Competent authorities and courts | Mandatory legal requests | Türkiye |
We do not sell or rent your personal data or share it for other companies' own marketing.
6. Transfers abroad
- AWS and Meta (WhatsApp Business): transfers needed to run the service rely on the standard contractual clauses announced by the Turkish Data Protection Board (KVKK Art. 9/4).
- Google, Meta and OpenAI measurement: only when you allow them in the cookie banner, with your explicit consent under KVKK Art. 9/6-a. Without consent these services are not loaded. See the Explicit Consent Text.
- YouTube: the player loads from Google only after you press play; until then no request goes to Google.
7. Retention
- Contracts, invoices, bookkeeping
- Period: 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253)
- Requests and correspondence that did not lead to a contract
- Period: 2 years after the last message
- Job and internship applications
- Period: 1 year
- Partner records
- Period: During the partnership; payment records 10 years
- Form security logs (IP, browser)
- Period: 2 years
- First-party visit log
- Period: 2 years
- Google Analytics data
- Period: At most 14 months at Google
- Marketing consent and cookie choice records
- Period: While valid, plus 3 years after withdrawal as proof
- Cookies in your browser
- Period: See the table in the Cookie Policy
| Data | Period |
|---|---|
| Contracts, invoices, bookkeeping | 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253) |
| Requests and correspondence that did not lead to a contract | 2 years after the last message |
| Job and internship applications | 1 year |
| Partner records | During the partnership; payment records 10 years |
| Form security logs (IP, browser) | 2 years |
| First-party visit log | 2 years |
| Google Analytics data | At most 14 months at Google |
| Marketing consent and cookie choice records | While valid, plus 3 years after withdrawal as proof |
| Cookies in your browser | See the table in the Cookie Policy |
Data whose period has expired is deleted, destroyed or anonymised.
8. Your rights (KVKK Art. 11)
- (a) learn whether your personal data is processed,
- (b) request information about it,
- (c) learn the purpose and whether it is used accordingly,
- (ç) know the third parties it is transferred to in Türkiye or abroad,
- (d) request correction of incomplete or inaccurate data,
- (e) request deletion or destruction under KVKK Art. 7,
- (f) request that (d) and (e) be notified to the recipients,
- (g) object to a result against you arising exclusively from automated analysis,
- (ğ) claim compensation for damage caused by unlawful processing.
You can withdraw your explicit consent and marketing approval at any time, with effect for the future.
9. How to apply
- In writing with a wet-ink signature: FULYA MAH. YEŞİLÇİMEN SK. POLAT TOWER RESIDENCE NO: 12 İÇ KAPI NO: 430 ŞİŞLİ / İSTANBUL
- By registered email (KEP), secure e-signature or mobile signature: atalayyazilim@hs01.kep.tr
- From the email address you previously gave us and that is on record: info@atalay.tech
Include your name, ID number (passport number if you are not a Turkish citizen), address, contact details and your request. We answer free of charge within 30 days at the latest; if the request involves an extra cost, the Board's tariff may apply.
If we reject your request, if you find the answer insufficient or if we do not reply in time, you may complain to the Turkish Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application (KVKK Art. 14).