KVKK Disclosure Notice
Under Article 10 of the Personal Data Protection Law No. 6698
1. Identity of the Data Controller
In accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by denetci.ai platform as the data controller, under the conditions described below.
Note: denetci.ai is an AI-powered audit platform currently in its MVP (Minimum Viable Product) stage. A formal legal entity has not yet been established.
Contact: info@denetci.ai
2. Categories of Personal Data Processed
| Data Category | Data Types | Source |
|---|---|---|
| Identity Data | Full name, username | From user |
| Contact Data | Email address, phone number | From user |
| Account Security | Password (hashed), role, session data | From user / Automatic |
| Transaction Security | IP address, browser info (user agent), access logs, last login | Automatic |
| Professional Data | Company info, audit engagement data, uploaded documents | From user |
3. Purposes of Processing
- Providing and managing platform services
- Performing user authentication and authorization
- Managing audit processes in compliance with ISA/BDS standards
- Providing AI-powered analysis and recommendation services
- Ensuring platform security and preventing unauthorized access
- Fulfilling legal obligations
- Improving service quality and statistical analysis
- Processing payment and billing transactions
4. Legal Grounds for Processing
Your personal data is processed based on the following legal grounds under KVKK Art.5/2:
Art.5/2(c) — Contract performance: Providing platform services, account creation and management
Art.5/2(d) — Legal obligation: Mandatory record-keeping, tax regulations
Art.5/2(e) — Establishment or protection of rights: Legal dispute resolution
Art.5/2(f) — Legitimate interest: Platform security, abuse prevention, service improvement
5. Third Parties to Whom Data is Transferred
Your personal data may be transferred to the following domestic and international third parties:
| Recipient | Transfer Purpose | Country | Legal Basis |
|---|---|---|---|
| Stripe, Inc. | Payment processing | USA | Art.5/2(c) |
| AI Analysis Service Provider | AI analysis service | USA | Art.5/2(c) |
| Embedding Service Provider | Text embedding service | USA | Art.5/2(c) |
| Vector Database Service Provider | Vector database service | Germany | Art.5/2(c) |
International transfer (KVKK Art.9): Data transfers to the above international service providers are carried out based on the necessity for contract performance and/or your explicit consent.
6. Data Retention Periods
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Account data | While active + 5 years | TCC, Tax Law |
| Audit data | 10 years | ISA/CMB Regulations |
| Access logs | 2 years | Law No. 5651 |
| Payment data | 10 years | Tax Law |
| Session data | 1 hour | Technical necessity |
7. Your Rights Under KVKK Art.11
Under Article 11 of the KVKK, you may exercise the following rights by contacting the data controller:
Right to learn whether your personal data has been processed
Right to request information about processing if it has been processed
Right to learn the purpose of processing and whether data is used accordingly
Right to know third parties to whom your personal data is transferred
Right to request rectification of incomplete or inaccurate personal data
Right to request erasure or destruction of personal data under KVKK Art.7
Right to request notification of rectification/erasure to third parties
Right to object to automated decision-making that produces adverse results
Right to claim compensation for damages resulting from unlawful processing
8. How to Apply
To exercise your rights, you may apply through:
- Email: Written request with identity verification to info@denetci.ai
Your request will be processed free of charge within 30 (thirty) days at the latest. If the process requires an additional cost, the tariff determined by the Personal Data Protection Board may be applied.