Alpaco KVKK Privacy Notice

Pursuant to the Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (the “Disclosure Communiqué”), we, Alpaco Yazılım Teknolojileri A.Ş. (“Alpaco” or the “Company”), in our capacity as data controller, exercise the utmost care to protect the personal data and privacy of users who visit our website at https://www.alpacotech.com/ (the “Website”), those who use our mobile application (the “Mobile Application”), and those who request a demo or information.

This Website and Mobile Application Privacy Notice (the “Privacy Notice”) has been prepared to inform the relevant persons about the methods by which personal data is collected during the use of the Website and the Mobile Application, the purposes and legal grounds of processing, the parties to whom the data is transferred, and the rights of data subjects under Article 11 of the KVKK.

1. Identity of the Data Controller

In accordance with the Law No. 6698 on the Protection of Personal Data (“Law No. 6698”), your personal data will be collected and may be processed by Alpaco, as the data controller, within the scope described below.

2. Categories and Types of Personal Data Processed

If you visit the Website, fill in the demo and contact forms, or use our platform’s mobile applications (the “Mobile Application”), the following personal data is processed:

• Identity Data: First name and surname.
• Contact Data: Email address and phone number; the name of the institution/company you work for, and your job title/position.
• Transaction Security Data: IP address, website login/logout and traffic/log records, access dates and times, cookie records, and information on the device, operating system, and internet browser used; and, for the Mobile Application, technical stack traces collected to diagnose problems when the application closes unexpectedly or returns an error, application crash status, device model, operating system version, application version and language, a randomly generated installation ID, and information on the screen where the error occurred (these records do not include your first name, surname, email, phone number, or session information, and are not used for advertising purposes).
• Customer Transaction and Request Data: Message text, requests, suggestions, and complaints submitted via the demo request form or by email.
• Marketing Data: Where you have given your explicit consent; your commercial electronic message consents and preferences, newsletter responses, and your analytics and marketing cookie preferences as regulated in the Cookie Policy.

3. Purposes of Processing Personal Data

Your personal data is processed, in line with the general principles set out in Article 4 of the KVKK (being processed lawfully and fairly; being accurate and, where necessary, kept up to date; being processed for specific, explicit, and legitimate purposes; being relevant, limited, and proportionate to the purposes for which they are processed; and being retained for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed), and is limited to the following purposes:

• Retaining hosting provider traffic and log records as a legal obligation under the Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications (“Law No. 5651”) and the relevant secondary legislation,
• Ensuring information and transaction security; ensuring the technical operation, stability, performance, and continuity of the Website and the Mobile Application; diagnosing and resolving technical errors and crashes in the Mobile Application; and detecting suspicious transactions and cybersecurity breaches,
• Evaluating and responding to communication, information, or demo requests, and contacting the requesters,
• Promoting Alpaco’s products, modules, and services within the scope of our AI-powered social media monitoring, analysis, and digital insights platform, and planning and conducting demo presentation processes,
• Managing request and complaint processes, measuring customer satisfaction, and improving service quality,
• Where you have given your explicit consent; sending commercial electronic messages regarding the Company’s products, modules, and services, and carrying out newsletter and marketing activities, in accordance with Law No. 6563 and the İYS (Message Management System) legislation,
• Serving as evidence in possible legal disputes, establishing and defending rights, and submitting information and documents requested by competent public institutions and organizations and by judicial/administrative authorities within the legal framework.

4. Method of Collection and Legal Grounds for Personal Data

Your personal data is collected by fully or partially automated means: while visiting the Website, through technical communication files (cookies), server logs, and the completion of the contact and demo request forms on the Website; and, for the Mobile Application, through Google Firebase Crashlytics technical diagnostic mechanisms.

This personal data is processed on the basis of the following legal grounds set out in Article 5/2 of the KVKK:

• It is expressly provided for by law: for retaining traffic records and access logs under Law No. 5651 and the relevant legislation (KVKK Art. 5/2-a),
• Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract: for fulfilling demo requests, preparing quotations, and conducting pre-contractual negotiations, with respect to contracts to which the data subject is a party (and, for corporate customer representatives, on the basis of legitimate interest) (KVKK Art. 5/2-c),
• It is mandatory for the data controller to be able to fulfill its legal obligation: for making legal notifications, taking information security measures, and responding to requests from official authorities (KVKK Art. 5/2-ç),
• Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject: for ensuring the security and technical stability of the Website and the Mobile Application, performing Crashlytics error diagnostics, improving service quality, and communicating with corporate customer representatives (KVKK Art. 5/2-f),
• Data processing is mandatory for the establishment, exercise, or protection of a right: for serving as evidence in possible legal disputes and for establishing and defending rights (KVKK Art. 5/2-e),
• Explicit consent of the data subject: where you have given your explicit consent, for sending commercial electronic messages, for newsletter and marketing processes, and for the non-essential analytics and marketing cookies specified in the Cookie Policy (KVKK Art. 5/1). For detailed information on the types of cookies on our website, their purposes of use, and how to manage your cookie preferences, please see our Cookie Policy page.

5. Transfer of Personal Data

Your collected personal data may be transferred to the following parties, in line with the purposes stated in this Privacy Notice and in accordance with Article 8 of the KVKK:

• To judicial authorities, law enforcement units, enforcement offices, and other public institutions and organizations legally authorized, for the purposes of fulfilling our legal notification and disclosure obligations, conducting judicial or administrative proceedings, and resolving legal disputes,
• To authorized information technology, infrastructure, and software service providers, for the purposes of hosting the Website and the Mobile Application, cloud infrastructure, server services, CRM, email delivery, and technical IT support,
• To independent auditors, legal advisors, and attorneys that our Company works with, for the purposes of establishing, protecting, and exercising our legal rights.

Your personal data is transferred to Google and relevant cloud service providers located abroad within the scope of carrying out the Mobile Application’s technical crash/diagnostic services via Google Firebase Crashlytics and providing cloud computing infrastructure services. These continuous and regular cross-border data transfers are carried out in reliance on the Standard Contract (Standard Contractual Clauses / SCC) announced by the Personal Data Protection Board, pursuant to Article 9/4-(a) of the KVKK as amended by Law No. 7499.

6. Retention Period and Security of Personal Data

Your personal data is retained for the mandatory periods stipulated in the relevant legislation and for the periods required by the purpose of processing. Accordingly: hosting provider traffic records kept under Law No. 5651 are retained for two (2) years; Mobile Application technical crash and error diagnostic records are retained on the Google Firebase infrastructure for ninety (90) days; demo and information requests that do not result in a business relationship are retained for one (1) year; data relating to requests that turn into a commercial relationship is retained for ten (10) years in accordance with the general statute of limitations; and commercial electronic message consent and opt-out records are retained for three (3) years as required by legislation. Upon expiry of these periods or when the conditions for processing cease to exist, your data is deleted, destroyed, or anonymized in accordance with the Company’s Personal Data Retention and Destruction Policy. Under Article 12 of the KVKK, our Company takes all necessary technical and administrative measures to prevent the unlawful processing of and access to personal data and to ensure its safekeeping.

7. Rights of the Data Subject

As a data subject, you may exercise the following rights by applying to our Company under Article 11 of the KVKK:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
• To know the third parties to whom your personal data is transferred, domestically or abroad,
• To request correction of your personal data if it is incomplete or inaccurately processed,
• To request deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK,
• To request that the correction, deletion, and destruction operations be notified to the third parties to whom your personal data has been transferred,
• To object to the occurrence of a result against you through the analysis of your processed data exclusively by automated systems,
• To request compensation for damages if you suffer damage due to the unlawful processing of your personal data.

8. Application Procedure and Contact

You may submit your applications regarding the rights listed above to our Company by the following methods, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• In Writing: By delivering your wet-signed petition, together with documents verifying your identity, in person or via a notary public to 25929-34927-94050,
• By Registered Electronic Mail (KEP): By sending it, bearing your secure electronic signature, to our Company’s KEP address alpacoyazilim@hs01.kep.tr,
• By Email: By sending it to info@alpacotech.com, using the email address that you previously notified to our Company and that is registered in our Company’s system, or signed with a secure electronic signature/mobile signature.

Under the legislation, your application must include your first name, surname, signature (for written applications), Turkish ID number (for foreign nationals, nationality, passport number, or foreign ID number if any), residential or business address for notification, email address for notification if any, phone number, and the subject of your request.

Our Company will conclude the requests included in the application free of charge, as soon as possible depending on the nature of the request and within thirty (30) days at the latest. However, if the process requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged. In cases where your application is rejected, the response given is found insufficient, or no response is given within the time limit, you reserve the right to file a complaint with the Personal Data Protection Board under Article 14 of the KVKK within thirty (30) days from the date you learn of our Company’s response, and in any case within sixty (60) days from the date of application.

9. Changes to the Privacy Notice

This Privacy Notice may be reviewed in line with changes in legislation, decisions of the Personal Data Protection Board, and updates to our Company’s data processing procedures. The updated text enters into force on the date it is published on the Website and the Mobile Application.

10. Statement on Platform Activities and Social Media Data

This Privacy Notice covers exclusively the data of Website visitors and Mobile Application users. Publicly available data of third parties processed within the scope of the social media monitoring, listening, and AI analysis services that the Alpaco platform provides to its corporate customers, as well as corporate subscription/customer account data, are managed under corporate agreements in which the roles of data controller and data processor are determined, and under a separate Personal Data Policy.