Personal Data Processing Notice (KVKK)

This notice is prepared under article 10 of Turkey's Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform natural persons who create an account on and use the CloudotNet platform (the "Platform"). This notice is not a consent declaration; it informs you about how your personal data is processed.

1. Data controller

Your personal data is processed by the data controller identified below:

CloudotNet Tech is a service brand developed and operated by Kürşat Turgut; it is not a separate company or legal entity. The Platform serves organizations of any sector.

For personal data of third parties contained in the content an organization enters into the Platform (tasks, records, form responses, documents etc.), the data controller is that organization; the data controller named above acts only as a data processor for that data.

2. Personal data processed

• Identity and contact: name, surname, email address, phone number (optional), profile photo (optional), language preference.
• Account and security: username, password hash, two-factor authentication and passkey records, session and device information, sign-in/sign-out and failed sign-in events, IP address.
• Organization and membership: organization name, roles and permissions, invitation details.
• Usage and activity records: change history of actions on the Platform (who, when, which field), notification preferences and delivery records.
• Technical access logs: server request logs (request path, status code, browser information, masked IP address) and error reports stripped of credentials.
• Legal consent evidence: version, language and date of the accepted text, content digest, IP address and browser information.
• API key usage records: key name and prefix, endpoint called, IP address, time.
• Support requests: request content, attachments, application version, page where the request was opened.

3. Purposes of processing

• Creating the account, verifying identity, managing organizations and memberships, and providing the Platform services.
• Ensuring account and system security; preventing unauthorized access, abuse and attacks.
• Keeping the service operational, detecting and fixing errors.
• Proving acceptance of the Terms of Use and acknowledgement of this notice.
• Keeping change history (audit trail).
• Answering support requests and delivering service notifications.
• Meeting legal obligations and responding to requests of competent authorities.

No data is processed inside the Platform for behavioural analytics, advertising or profiling.

4. Legal bases

Your personal data is processed on the following legal bases in article 5/2 of the KVKK:

• (c) processing is necessary for the personal data of the parties to a contract, provided that it is directly related to the conclusion or performance of that contract,
• (ç) processing is mandatory for the data controller to fulfil its legal obligations,
• (e) processing is mandatory for the establishment, exercise or protection of a right,
• (f) processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

There is no processing inside the Platform that relies on explicit consent.

5. Transfer of personal data

Your personal data is transferred to the following service providers, to the extent technically necessary to provide the Platform and only to be processed on the data controller's instructions:

International transfers to the providers above are carried out under the conditions set out in article 9 of the KVKK. Your personal data may also be disclosed to competent public authorities where the law expressly requires it and only to the extent requested. Your personal data is not shared with third parties for marketing purposes and is not sold.

6. Method of collection

Your personal data is collected electronically, by automated or partly automated means, through registration and sign-in forms, profile and organization settings, actions within the Platform, the support form and server logs.

7. Retention

Your personal data is retained for as long as required by the purpose of processing and by the limitation periods set out in the applicable legislation. Retention periods per data category are listed in the Privacy Policy.

8. Your rights as a data subject (KVKK art. 11)

By applying to the data controller you have the right to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether the data is used in line with that purpose,
• know the third parties to whom the data is transferred, in Turkey or abroad,
• request correction if the data is incomplete or inaccurate,
• request erasure or destruction under the conditions of article 7 of the KVKK,
• request that correction, erasure and destruction be notified to the third parties to whom the data was transferred,
• object to a result against you arising from analysis of the data exclusively by automated systems,
• claim compensation for damage suffered due to unlawful processing.

9. How to apply

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests from the email address registered on the Platform to kvkk@cloudotnet.tech, with a secure electronic or mobile signature, or in writing; the postal address for written requests is provided on request via kvkk@cloudotnet.tech. The request must include your name, surname, signature (for written requests), Turkish ID number (nationality and passport number for foreigners), address for notification, email or phone number for contact, and the subject of the request. Your request is concluded free of charge within 30 days at the latest; if the operation entails an additional cost, the fee set by the Board may be charged.