Personal Data Protection Notice under Turkish Law No. 6698 (KVKK)

This notice has been prepared by the data controller pursuant to Article 10 of Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

Data controller

• Company name: Provscope Yazılım Ltd. Şti. (Provscope Software Ltd.)
• Address: Barbaros Mah. Tahran Cad. No: 19/A, Çankaya, Ankara, Türkiye
• Tax office and tax ID (VKN): Cumhuriyet, 9320388325
• Email: baris@provscope.com

Personal data processed

Users of the contact and demo form

• Identity and contact data: full name, email address, phone number (optional, Turkish form only)
• Professional and request data: company name, sector and EU export status (Turkish form), country and product group (English form), the free-text message you send and the fact that the consent checkbox was ticked
• Transaction security data: IP address, time of submission, referring page and a hashed IP address kept for 10 minutes for spam prevention

Platform users

• Identity and contact data: full name, business email address
• Professional data: company name and role
• Transaction security data: login credentials stored in hashed form, IP address, browser and device information, timestamps and records of actions performed on the platform

Customer content on the platform

Product, material, supplier and emissions data and evidence documents uploaded to the platform by our customers and their suppliers may contain personal data. For this content, the customer generally acts as the data controller and Provscope acts as the data processor under the service agreement. The obligation to inform data subjects about this data lies with the relevant customer; Provscope processes this data only on the customer’s instructions.

Purposes of processing

• Assessing contact and demo requests, responding to you and determining the scope of the service to be provided
• Creating platform accounts, authenticating users and providing the service in accordance with the agreement
• Carrying out information security processes, preventing unauthorised access and misuse, and maintaining an audit trail
• Preventing automated form submissions and spam attempts
• Complying with legal obligations and providing information to competent authorities
• Establishing, exercising and defending rights in the event of a dispute

Method of collection and legal bases

Your personal data is collected electronically, by partly automated means, through the form on our website and through the Provscope platform. It is processed on the following legal bases set out in Article 5 of the KVKK:

• Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract (Art. 5(2)(c))
• Processing is necessary for the data controller to comply with its legal obligation (Art. 5(2)(ç))
• Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5(2)(f))
• Your explicit consent, where explicit consent is required (Art. 5(1))

By ticking the consent checkbox on the form, you confirm that you have read this notice and accept that your data is processed as described in it.

Transfer of personal data

Your personal data is not sold. It may be transferred, limited to the purposes above and in accordance with Articles 8 and 9 of the KVKK, to the following categories of recipients:

• Hosting and infrastructure providers
• Email service providers
• Analytics providers (only if analytics is enabled in the future and you have given consent)
• AI service providers used to support certain platform features (for example, data extraction from documents)
• Competent public authorities and courts, where legally required

Some of these providers may be located outside Türkiye, including in the EU or the United States. Under Article 9 of the KVKK as amended in 2024, transfers abroad are carried out where there is an adequacy decision for the destination country or sector; where there is no adequacy decision, where one of the appropriate safeguards is in place, such as a standard contract notified to the Turkish Personal Data Protection Authority; or where one of the exceptional, incidental cases listed in the law applies.

Retention periods

• Contact and demo form records: up to 2 years after the last contact, unless a contract follows
• Hashed IP address kept for spam prevention: 10 minutes
• Platform account data: for the duration of the contract and thereafter for statutory retention periods (for example, 10 years for commercial records, where applicable)
• Security logs: up to 1 year
• Customer content: deleted or returned to the customer within 90 days after the contract ends, unless the law requires a longer retention period

Personal data whose retention period has expired is deleted, destroyed or anonymised.

Your rights under Article 11 of the KVKK

By applying to the data controller, you have the right to:

1. learn whether your personal data is processed,
2. request information about the processing if your personal data has been processed,
3. learn the purpose of processing and whether your personal data is used in line with that purpose,
4. know the third parties in Türkiye or abroad to whom your personal data is transferred,
5. request the rectification of your personal data if it is incomplete or inaccurate,
6. request the erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
7. request that the rectification, erasure or destruction be notified to the third parties to whom your personal data has been transferred,
8. object to an outcome against you arising from the analysis of the processed data exclusively by automated systems,
9. claim compensation for damage you suffer as a result of the unlawful processing of your personal data.

How to apply

You can send requests regarding your rights by email to baris@provscope.com or in writing to Barbaros Mah. Tahran Cad. No: 19/A, Çankaya, Ankara, Türkiye. In your application, please state your full name, your contact details, the subject of your request and information that allows us to verify your identity.

Your application will be concluded free of charge as soon as possible depending on the nature of the request, and within 30 days at the latest (KVKK Art. 13). If the action requires an additional cost, a fee may be charged according to the tariff set by the Turkish Personal Data Protection Board. If your application is rejected, if you find the response insufficient or if no response is given in time, you may lodge a complaint with the Turkish Personal Data Protection Board under Article 14 of the KVKK.

For broader information on processing activities on our website and platform, see our privacy policy and cookie policy.

Last updated: 7 October 2026