Personal Data Notice (KVKK)
This text is a translation for information only; the Turkish text prevails in case of conflict. Read the Turkish text
This text is a draft: 14 fields in square brackets have not been filled in yet and it awaits legal review.
This notice is issued under Article 10 of Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
1. Data controller
| Legal name | [COMPANY LEGAL NAME] |
|---|---|
| Address | [COMPANY ADDRESS] |
| MERSIS number | [MERSIS NO] |
| Registered e-mail (KEP) | [KEP ADDRESS] |
| Application e-mail | [DATA PROTECTION E-MAIL] |
| VERBIS registration | [VERBIS NO OR EXEMPTION] |
2. Personal data processed
| Category | Data |
|---|---|
| Identity | First and last name; national ID number where required for invoicing |
| Contact | E-mail address, [PHONE — if requested at sign-up], billing address |
| Customer transactions | Plan, resources created, usage and metering records, invoices, support correspondence |
| Transaction security | IP address, session and request logs, audit records (who, when, which surface), hashes of API tokens, SSH public keys |
| Finance | Billing name, tax office and number, payment status (card details never reach z9cloud) |
| Marketing | Only with your explicit consent: e-mail address and message preferences |
3. Purposes of processing
- Concluding and performing the contract: opening the account, providing the Service, metering and invoicing usage,
- Running information security processes; preventing unauthorised access and abuse,
- Managing customer relations and support,
- Running finance and accounting,
- Informing authorised persons, institutions and organisations; meeting statutory retention and reporting obligations,
- Establishing, exercising and protecting rights in legal disputes,
- Sending product and campaign announcements, if you have given explicit consent.
4. Legal grounds
Your personal data is processed on the following grounds under Article 5(2) of the Law:
- (c) it is directly related to concluding or performing a contract,
- (ç) it is necessary for the data controller to comply with a legal obligation (tax, commercial and Law No. 5651 records),
- (e) it is necessary to establish, exercise or protect a right,
- (f) it is necessary for the data controller's legitimate interests, provided your fundamental rights and freedoms are not harmed (platform security, preventing abuse).
Your explicit consent under Article 5(1) of the Law is obtained for promotional commercial electronic messages. You may withdraw it at any time.
5. Transfers
Your personal data may be transferred, limited to the purposes above, to:
- Service providers: payment provider, e-mail delivery provider, accounting and e-invoicing provider, DNS and domain registration providers, certificate authority. The current list is in section 4 of the Privacy Policy.
- Competent public authorities: on request of legally authorised bodies.
Transfers abroad are made in line with the conditions in Article 9 of the Law. [CROSS-BORDER TRANSFERS — recipients, countries and basis (adequacy decision, appropriate safeguards or the occasional cases in Art. 9(6))]
6. How we collect it
Your personal data is collected electronically and by automated means through the website, console, API and MCP server, through e-mail correspondence, and from notifications sent by the payment provider.
7. Your rights
Under Article 11 of the Law, you may apply to the data controller to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used accordingly,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request deletion or destruction under the conditions in Article 7 of the Law,
- request that correction, deletion and destruction be notified to the third parties it was transferred to,
- object to a result against you arising exclusively from analysis by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
8. How to apply
You may send your application in Turkish, with information that identifies you:
- in writing with a wet signature to [COMPANY ADDRESS],
- by registered electronic mail (KEP) to [KEP ADDRESS],
- signed with a secure electronic signature or mobile signature to [DATA PROTECTION E-MAIL],
- from the e-mail address registered on your z9cloud account to [DATA PROTECTION E-MAIL].
Applications are concluded free of charge within 30 days at the latest, depending on their nature. If the action requires an additional cost, the fee schedule set by the Personal Data Protection Board may apply.
9. Data on your servers
For personal data you process on servers and storage you run on the Service, you are the data controller; z9cloud is the data processor, processing that data only on your behalf and to provide the Service. Requests from data subjects about that data are answered by you.