Privacy Notice (KVKK)

This notice explains, under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, which personal data are processed on the CSRON platform, by whom, for what purpose and on what legal basis, to whom they are transferred, how long they are kept and how you can exercise your rights.

1. Data Controller

Bekir Koçak (CSRON), Küçükyalı Tax Office, tax identification number 5710340554, the operator of the Platform (the "Operator"), is the data controller for the personal data processed to run the Platform. Application and contact channels are set out in clause 12.

Roles for content uploaded by a Subscriber: for the audit answers, documents (employee lists, payrolls, training records, permits and the like) and facility employee information a Subscriber enters or uploads, the data controller is the Subscriber; the Operator acts only as a data processor hosting and processing that data on the Subscriber’s instructions. The Subscriber must have fulfilled its own information and legal basis obligations before uploading such data.

2. Whose Data We Process

• Subscriber representatives: the people who open and manage the account.
• Facility and audit team account users: holders of the accounts the Subscriber opens for its facilities and audit team.
• Visitors: people browsing without signing in, registering or using the contact form.
• Auditors: people without an account who view documents through a time-limited access code issued by the Subscriber.
• Consultant firm contacts: contact persons of firms applying to the showcase.
• Directory visitors: people who request consultancy from a firm through the form on its directory page (they may not hold a CSRON account).
• Production facility employees: persons named in the documents and answers a Subscriber uploads (subject to the role split in clause 1).

3. Personal Data Processed

• Identity and contact: name, email address, telephone number, company title, production facility name and address.
• Account and transaction security: password (stored only as an irreversible hash), session identifier, sign-in and sign-out times, failed sign-in attempts, IP address, browser and device information, country and city derived from the IP address, last-seen time and page.
• Subscription and payment: subscription type, period dates, credit balance and movements, invoice details, the transaction result returned by the payment institution. Card numbers are not held on the Platform; when you choose to save your card on the payment form for later payments, the card key issued by the payment institution and the card's brand, bank and last four digits are stored, and the key is deleted when you remove the card. For a consultant firm's directory advertising payment, the firm name, contact person's name, email and phone are passed to the payment institution.
• Audit content: audit form answers, notes, findings, corrective action records, uploaded documents and photographs, document library records and document history.
• Expert support: the case text written for an auditor opinion (personal names, ID numbers, telephone, email and IBAN are masked automatically), consultancy request text, facility name, requested date, firm rating and review.
• Tool inputs: the question typed into the legal basis tool, facility details entered into the policy generator, wage and duration values entered into calculators, free-text answers in the SLCP assessment.
• Contact: contact form message, chosen topic, name and email if given, and the IP address, browser information and country/city at the time of sending.
• Security and error records: for unauthorised access attempts the IP address, attempted path, browser, screen resolution and browser language; for server errors the error message, path, browser information and user identifier if any.
• Visit records: for visitors browsing without signing in, a randomly generated visit identifier, the page viewed, time, IP address, browser information and the country and city derived from the IP address; if "Accept all" was chosen in the cookie bar, also the domain name of the referring site and the campaign tags in the link (see the Cookie Policy).
• Preferences: language choice, cookie preference and view preferences in tools (kept in your browser, see the Cookie Policy).
• Mobile app: when you allow notifications, your device's push notification token (a random identifier issued by the phone's operating system that determines which device a notification goes to), the device type (iOS or Android) and the app version. The app does not access your contacts, location or other data on the device; the camera and photo library are used only when you choose to attach a file, with your permission.

The Platform does not request special categories of personal data (health, union membership and the like). Documents a Subscriber uploads (for example health reports or disability records) may contain such data; they are stored solely on the Subscriber’s instructions and are not processed by the Operator for any other purpose.

4. Purposes of Processing

• Opening the account, authentication, enforcing the single active session rule and account security
• Managing production facilities, user accounts and permissions according to the subscription type
• Completing, storing and reporting audit forms; following corrective actions; running the document library
• Time-limited presentation of documents through an auditor access code
• Sending emails for periodic obligation reminders, corrective action and account notifications
• In the mobile app, when you allow notifications, delivering Platform notifications to your phone as push notifications
• Charging paid tools in credits, collecting the subscription fee, invoicing and renewal reminders
• Receiving auditor opinion and consultant firm support requests, forwarding them to the relevant firm and publishing reviews
• Forwarding a consultancy request sent through the directory form to the firm the requester chose
• Running the legal basis, policy generator, calculator and translation tools
• Answering contact and feedback requests
• Measuring the number of visitors and, where consent is given, through which promotional channel the Platform was found
• Service security: detecting unauthorised access, rate limiting, debugging, backup and disaster recovery
• Meeting legal obligations (retaining invoices and commercial records, responding to requests from competent authorities)

5. Legal Bases

• Formation and performance of a contract (KVKK art. 5/2-c): account, subscription, audit and document operations, payment, notification emails and push notifications in the mobile app, expert support requests, processing of tool inputs. Push notifications also require your phone's notification permission, which you can turn off at any time in your phone's settings.
• Legal obligation (art. 5/2-ç): retaining invoices and commercial records, informing competent authorities, recording security incidents.
• Legitimate interest (art. 5/2-f): sign-in, security and error records, rate limiting and backups for the security and continuity of the service; error analysis to improve the product; visitor counting.
• Data made public by the data subject (art. 5/2-d): information a consultant firm asks to have published in the showcase.
• Explicit consent (art. 5/1): requested only for optional processing not covered by the bases above. Today two processing activities are based on explicit consent: forwarding the name, contact details and message sent through the directory request form to the consultant firm the requester chose (consent is given with the checkbox on the form), and recording the arrival source of a visit (consent is given with the "Accept all" option in the cookie bar).

6. Transfers and Transfers Abroad

Personal data are transferred to the service providers below only to the extent the relevant service requires. Transfers to providers abroad rest on KVKK art. 9, data processing agreements with the provider and standard contractual clauses.

Providers are listed below by type of service. The current list of providers is given in writing on request through the application route in clause 10 (KVKK art. 11/1-ç).

Beyond service providers, transfers happen only in these cases:

• Consultant firm: when you submit a consultancy request, the request text, facility name and your contact details are emailed to the selected firm. The firm holds no account on the Platform. With the directory request form, your name, email, phone and organisation if given, and your message are emailed, with your consent, directly to the firm whose page you used; the firm replies to you directly.
• Auditor: an auditor viewing your documents through an access code you generated sees only the documents you chose, within the code’s validity.
• Accounts opened by the Subscriber: facility and audit team accounts see the audit and document data of the facilities the Subscriber assigns; that sharing is the Subscriber’s decision.
• Competent public authorities: duly made requests by authorities empowered by law.

Personal data are never sold, rented or shared with any third party for advertising, marketing or data trading. The Platform contains no third-party analytics or advertising tools.

7. Retention Periods

• Account and audit data: as long as the account is open. When the account is closed, deleted or anonymised within a reasonable time. You can delete your account yourself on the My account page.
• Incomplete registrations: the account is created when payment is received. For a registration whose payment is not completed, the information entered is not stored on our servers: during payment it is kept only in your browser in encrypted form and is removed when you close the tab. The name, email and phone needed for payment are passed to the payment institution.
• Deleted records: cannot be restored on the Platform; kept in the system for at most 90 days, then permanently deleted.
• Backups: database versions 30 days, weekly archive 12 weeks, file versions 90 days. Backups are used only for disaster recovery.
• Invoice and payment records: the period required by tax and commercial law (10 years).
• Email delivery logs: 30 days at the delivery provider.
• Rate limit counters: at most 1 hour.
• Visit records: 90 days.
• Push notification token: deleted when you sign out of the app, when your phone invalidates the token (for example when you turn off notifications or uninstall the app) or when your account is closed.
• Sign-in, security and error records: as long as the security and debugging purpose requires; unlinked from the user when the account is closed.
• Auditor access session: the validity of the code (at most 24 hours); ends when the code is revoked.
• Expert support records: for the life of the account after the request is closed; showcase reviews are anonymous.
• Directory request form: the request content and your personal data are not stored on the Platform, only forwarded to the firm; the Platform keeps only a count, with no personal data, of which firm received a request and when. Email delivery records follow the period above.

8. Data Security

• Data are encrypted in transit with TLS and at rest at provider level.
• Each account’s data are isolated at database level (row-level access policies); a user of one account cannot reach another account’s data.
• Passwords are stored only as irreversible hashes; session cookies are inaccessible to browser scripts; a single active session rule applies per account.
• No permanent direct link to documents is produced; every view passes an authorisation check.
• Unauthorised access attempts are recorded; unusual request traffic is limited automatically.
• Regular backups are taken and restore drills are performed.

9. Automated Decisions and Artificial Intelligence

The Platform makes no automated decisions with legal effect about individuals and does no profiling. The output of AI-assisted tools is for information only and is assessed by the user. Text sent to these tools is not used for model training; we still recommend not typing personal data into them.

10. Your Rights

Under KVKK art. 11 you may apply to the Operator to:

• learn whether your personal data are processed and, if so, request information,
• learn the purpose of processing and whether the data are used in line with it,
• know the third parties to whom the data are transferred in Türkiye or abroad,
• request correction of incomplete or inaccurate data,
• request erasure or destruction under the conditions of art. 7 and notification of those operations to third parties,
• object to a result against you produced exclusively by automated analysis,
• claim compensation for damage caused by unlawful processing.

Application: under the Communiqué on the Procedures and Principles of Application to the Data Controller, send your application in writing to the email address in clause 12 or through the contact form, stating your name, the email address registered on your account and the subject of your request. Applications are answered free of charge within 30 days at the latest. If you are not satisfied, you may lodge a complaint with the Personal Data Protection Board.

To close your account or export your data, use the account page or write to us. Employees named in documents uploaded by a Subscriber exercise their rights first against the Subscriber as data controller; the Operator assists the Subscriber with such requests.

11. Children

The Platform is aimed at business users; persons under eighteen are not expected to open an account or enter personal data. If such a case is detected, the account is closed and the data deleted.

12. Changes and Contact

This notice is updated when processing activities change; the current version and effective date appear on this page. Substantive changes are notified to the email address registered on your account or by an in-Platform announcement.

• Email: info@csron.com
• Contact form: csron.com/contact