KVKK & Privacy
Privacy Notice & Cookie Policy
This notice explains how BAYAKA Yazılım ("we") processes personal data through this website, the client portal and related services, under the Turkish Personal Data Protection Law No. 6698 (KVKK) Art. 10. A separate notice applies where we process personal data on behalf of our clients (as a data processor) — for example data stored in software or hosting we provide; that processing is governed by our contract with the client.
Last updated: 10 November 2026
1. Data controller
BAYAKA Yazılım.
2. How each channel processes data
Each form links to its own section below. We do not ask for consent where processing relies on another legal basis (e.g. steps prior to a contract).
2.1 Contact form
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, optional phone and company, project type, budget range, message | Answering your request, preparing a proposal | Art. 5/2-c (steps prior to a contract) | Reviewed periodically and deleted when no longer needed; no automatic deletion yet |
2.2 Quote wizard
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Selections (project type, scope, features, timeline), contact details, notes | Preparing a proposal, contacting you | Art. 5/2-c | As 2.1 |
2.3 Booking a call
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, optional phone and company, topic, note, chosen time | Scheduling and holding the call, reminders | Art. 5/2-c | As 2.1 |
2.4 Live chat
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Message, optional name and email, a chat cookie | Answering your question | Art. 5/2-c and f | Deleted automatically after 90 days |
2.5 Virtual assistant
Replies are generated on our own server; messages are not sent to a third-party AI service.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Questions you type; if you choose “create a request”, your contact details and the conversation | Answering questions; passing your request to our team | Art. 5/2-c and f | Requests: as 2.1 |
2.6 Job applications
Please do not include special categories of personal data (health, religion, union membership, etc.) in your CV.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, optional phone, LinkedIn, cover note, CV file | Running the hiring process | Art. 5/2-c | Deleted automatically after 180 days (including the CV file) |
2.7 Newsletter
Commercial electronic messages are sent only with your separate approval under Law No. 6563 (double opt-in by email). You can unsubscribe via the link in every email.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, language, approval date and text, confirmation date | Sending the newsletter | Your approval under Law No. 6563 Art. 6 / KVKK Art. 5/2-a | Until you unsubscribe; the approval record is kept as legally required |
2.8 Account, client portal and sign-in
Optional sign-in with Google or Apple shares your verified email and an account identifier with us.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, phone, company, tax office/number, billing address, password hash, 2FA settings, session records (device/browser), audit logs | Providing the portal, contract performance, invoicing, account security | Art. 5/2-c, ç and f | During the contract; invoice-related records 10 years (Turkish Commercial Code / Tax Procedure Law) |
2.9 Orders, subscriptions and invoices
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Order and billing details, accepted contract versions and dates, invoices, payment status | Concluding and performing the contract, invoicing, legal retention | Art. 5/2-c and ç | 10 years |
2.10 Satisfaction surveys and testimonials
Your comment is published on the site with your name only if you separately give explicit consent; you can withdraw it at any time.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Score, comment; optionally name and title for publication | Improving our service; publishing a testimonial (consent only) | Art. 5/2-f; explicit consent for publication (Art. 5/1) | Until withdrawn / as long as needed |
2.11 Proposal links
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| When a client opens a proposal link: time of first/last opening and number of openings (our staff's openings are not counted) | Following up the sales process | Art. 5/2-c and f | With the proposal record |
3. Recipients and international transfers (KVKK Art. 8–9)
We do not sell personal data. We use the service providers below to operate the site and services. Several of them process data outside Türkiye. Transfers abroad must rely on one of the instruments in KVKK Art. 9 (adequacy decision, standard contract notified to the Authority, binding corporate rules, or the incidental-transfer exceptions in Art. 9/6). The status of these instruments for each provider is listed in our internal transfer inventory and is being completed; this notice will be updated accordingly.
- Competent public authorities when legally required.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel Inc. | Hosting the website and application | All data processed via the site (in transit), server logs | USA / EU |
| PostgreSQL provider (e.g. Neon) | Database | All stored records | Region of the chosen server |
| Cloudflare (R2, Turnstile) | File storage (CVs, attachments); bot protection on forms | Files; IP and browser signals for bot checks | Global network / USA |
| Resend | Sending emails | Recipient address, email content | USA |
| Netgsm / Twilio (if SMS enabled) | Sign-in codes by SMS | Phone number, code | Türkiye / USA |
| Google LLC, Apple Inc. (if you choose) | Sign-in | Email, account identifier | USA |
| Telegram (staff notifications) | Internal notifications to our team | Event summaries and reference numbers; we avoid personal data | Outside Türkiye |
4. Your rights (KVKK Art. 11) and how to apply
You may learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, learn the recipients in Türkiye or abroad, request correction, erasure or destruction, request notification of these to recipients, object to a result against you arising from automated analysis, and claim compensation. You can apply with the form below, in writing, by registered email (KEP) or from the email address registered with us; we answer free of charge within 30 days at the latest. You may complain to the Personal Data Protection Board (KVKK Art. 14).
5. Cookie Policy
Only essential cookies are used by default. Optional analytics or advertising cookies are loaded only after your consent; you can accept, reject or choose per category, and change your choice any time via “Cookie preferences” at the bottom of every page.
| Name | Purpose | Type | Duration |
|---|---|---|---|
| __Host-session | Keeps you signed in to the portal/panel | Essential | 7 days |
| __Host-mfa | Completes two-step verification | Essential | 10 minutes |
| __Host-verify | Completes email verification after sign-up | Essential | 30 minutes |
| __Host-oauth-google / -apple | Secures Google/Apple sign-in | Essential | 10 minutes |
| chat_visitor | Keeps your live chat conversation | Essential (only if you start a chat) | 30 days |
| locale | Remembers the language you selected | Functional (set only when you switch language) | 1 year |
| cookie_consent | Stores your cookie choice | Essential | 1 year |
| theme (local storage) | Remembers light/dark theme | Functional (browser storage, not sent to us) | Until cleared |
| bayaka.cart.v1 (local storage) | Keeps your package cart | Functional (browser storage, not sent to us) | Until cleared |
| Cloudflare Turnstile | Bot protection on forms (loaded from challenges.cloudflare.com) | Security (third party) | Per Cloudflare |
| Analytics (only if enabled) | Visit statistics | Optional — only with consent | Per provider |
6. Security
Passwords are stored as scrypt hashes; two-step verification, role-based access control, rate limiting, signed short-lived file links and audit logs are used. No method is completely secure.