This Privacy Policy (the "Policy") has been prepared within the framework of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and its secondary legislation in order to inform data subjects about how personal data is collected, for which purposes it is processed, for how long it is retained, to whom it is transferred and how it is protected, in the context of the website at www.cirometre.com (the "Site") operated by Tutech Bilişim Anonim Şirketi ("the Company" / "Cirometre") and the connected services (the "Platform").
This Policy does not on its own satisfy the duty to inform under Article 10 of the KVKK; it forms a whole together with the Information Notice (Turkish), the Cookie Information Notice and the Explicit Consent Text (Turkish).
| Information | Detail |
|---|---|
| Legal name | Tutech Bilişim Anonim Şirketi |
| Brand / trade name | Cirometre |
| Registered address | Gebze OSB Mh. Kemal Nehrozoğlu Cd. No:507/8 Z01 Gebze/KOCAELİ, Turkey |
| [email protected] | |
| Website | www.cirometre.com |
This Policy covers Site visitors, registered users, Subscribers, former customers, prospective customers, suppliers, business partners, those who submit support requests and all other natural persons who enter into a relationship with the Company. Separate information notices are issued for employees, job applicants and persons visiting the Company premises.
Order and revenue data pulled through APIs from the Subscriber's own e-commerce platforms with the Subscriber's authorisation is processed stripped of end-customer identity information, and therefore does not constitute personal data under the KVKK.
4.1. Membership and account data
4.2. Financial and invoicing data
4.3. Usage and technical data
4.4. Communication and support data
4.5. Marketing data
4.6. Third-party data uploaded to the Platform by the Subscriber or pulled from connected systems (in the capacity of data processor)
The Company processes the data under this heading in the capacity of data processor; the data controller is the Subscriber. The data is used solely for the purpose of the Subscriber carrying out its own pre-accounting and invoicing operations.
This data is not used for marketing, profiling, artificial intelligence model training or for any purpose outside the Subscriber's instructions. If the subscription ends, the data is deleted or returned to the Subscriber in accordance with the Subscriber's instructions; records for which legislation prescribes a minimum retention period are only stored for that period.
Your personal data is processed in line with the purposes below and on the legal ground under Articles 5 and 6 of the KVKK stated opposite each purpose:
| Purpose of processing | Legal ground |
|---|---|
| Membership, account management, sign-in | 5/2-c: establishment and performance of a contract |
| Performance of the subscription agreement, provision of the service | 5/2-c: performance of a contract |
| Invoicing, accounting and fiscal obligations | 5/2-a, 5/2-ç: expressly provided for by law, legal obligation (Tax Procedure Law, Turkish Commercial Code) |
| e-Invoice / e-archive invoice processes | 5/2-a, 5/2-ç: Tax Procedure Law and related communiqués |
| Platform and network security, access log records | 5/2-a, 5/2-ç: Law No. 5651; 5/2-f: legitimate interest |
| Management of requests and complaints, support processes | 5/2-c and 5/2-f: performance of a contract and legitimate interest |
| Use of strictly necessary cookies | 5/2-f: legitimate interest |
| Dispute management, establishment and protection of rights | 5/2-e: establishment, exercise or protection of a right |
| Provision of information to authorised public institutions and bodies | 5/2-a, 5/2-ç: expressly provided for by law and legal obligation |
| Marketing, promotion, commercial electronic messages, surveys | 5/1: explicit consent |
| Advertising, marketing and analytics cookies | 5/1: explicit consent |
| Profiling and personalised content | 5/1: explicit consent |
| Transfer of data abroad (other than under an adequacy decision or appropriate safeguards) | 5/1 together with Article 9: explicit consent |
Your personal data may be transferred to the groups of recipients listed below within the framework of Articles 8 and 9 of the KVKK:
7.1. Transfers abroad
Under the Article 9 regime of the KVKK that entered into force on 2 June 2024, transfers abroad are carried out by one of the following methods, in order of priority:
For cloud infrastructure, e-mail, communication, analytics and advertising services the Company makes use of international service providers such as Google LLC (USA), Microsoft Corporation (USA) and Meta Platforms Inc. (USA). Where a transfer takes place through cookies, the explicit consent of the data subject is additionally obtained. For the automated reading of document images uploaded by Subscribers, a document reading service provider located abroad is used; that transfer is carried out for the purpose of performing the contract and by one of the appropriate safeguard methods listed above.
Your personal data is retained for the period required by the purpose of processing and within the minimum periods prescribed by the relevant legislation:
| Data category | Retention period |
|---|---|
| Membership and account data | 10 years after the membership ends (Turkish Code of Obligations Art. 146) |
| Subscription agreement and its annexes | End of contract + 10 years |
| Invoice and accounting records | 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253) |
| Platform access and transaction logs | 2 years (Law No. 5651) |
| Communication and support records | 3 years after the purpose ends |
| Marketing data (based on explicit consent) | Until consent is withdrawn |
| Commercial electronic message consent records | Until consent is withdrawn + 3 years |
| Cookie data | The periods stated per cookie in the Cookie Information Notice |
| KVKK application records | 3 years (for the purpose of establishing a right) |
| Third-party data uploaded by the Subscriber or pulled from connected systems (customer accounts, invoices, orders) | The minimum period under the legislation to which the Subscriber is subject (Tax Procedure Law Art. 253, Turkish Commercial Code Art. 82 — 5 to 10 years); at the end of the subscription it is deleted or returned to the Subscriber in accordance with the Subscriber's instructions |
| Marketplace-sourced buyer data | The same period as above, because it is a mandatory field of the invoice. The raw API response is not stored; it is processed in memory and discarded |
Cookies in different categories — strictly necessary, performance-analytics, functionality and advertising/marketing — are used on the Site. For detailed information about the types, purposes, retention periods and management of cookies, please refer to the Cookie Information Notice. Third-party analytics and advertising cookies are activated only with your explicit consent; you can update these preferences at any time through the "Manage cookie preferences" link in the consent banner shown on the relevant pages. Visit measurement on the promotional pages, on the other hand, is carried out with the Company's own infrastructure, without creating cookies and without transferring data to third parties; the details are explained in the Cookie Information Notice.
Cirometre services are not directed at individuals under the age of 18. Personal data belonging to children is not knowingly collected. Where we determine, or are notified, that personal data belonging to a child has been collected inadvertently, that data is deleted without delay and the parent or guardian is notified.
The Platform may include features driven by automated systems, such as content ordering, dashboard arrangement and report suggestions based on your usage preferences. These operations are not regarded as automated decision-making producing legal consequences adverse to you within the meaning of Article 11/1-g of the KVKK. Your separate explicit consent is obtained for operations carried out for the purpose of profiling.
12.1. Administrative measures
12.2. Technical measures
Pursuant to Article 12/5 of the KVKK, if the personal data processed is obtained by others through unlawful means, the Company notifies the Personal Data Protection Board as soon as possible (within 72 hours at the latest) and the affected data subjects within a reasonable period.
Under Article 11 of the KVKK you have the following rights:
To exercise your rights, you may submit your request in writing to Gebze OSB Mh. Kemal Nehrozoğlu Cd. No:507/8 Z01 Gebze/KOCAELİ, Turkey or electronically to [email protected], in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your request is answered free of charge within 30 days at the latest from the date it reaches us.
The Company may update this Policy in line with legislative changes, changes in the nature of the services or the requirements of business processes. The current version of the Policy is published on the Site; material changes are additionally announced.
You may submit your questions about this Privacy Policy or your data subject requests to the Company through the following channels: E-mail: [email protected] Postal address: Gebze OSB Mh. Kemal Nehrozoğlu Cd. No:507/8 Z01 Gebze/KOCAELİ, Turkey
Effective date: 24/04/2026 | Version: 1.0 | Data controller: Tutech Bilişim Anonim Şirketi
This English text is a convenience translation; the Turkish version is the binding one.
