1. IDENTITY OF THE DATA CONTROLLER
Under Law No. 6698 on the Protection of Personal Data ("KVKK"), Yengech Yazılım Teknolojileri Ltd. Şti. ("Developer" or "Company"), acting as data controller, processes the personal data of customer representatives (corporate administrators and employee users) who register on the platform within the scope of their commercial activities (B2B), for the purposes and on the legal grounds explained below.
2. CATEGORIES OF PERSONAL DATA PROCESSED
The following personal data are processed in the course of using the platform:
- Identity and Contact Data: First name, last name, e-mail address, role and authorization on the platform.
- Customer Transaction Data: Discovery session chat transcripts, discovery request and scope texts, the project's scope baseline (ScopeBaseline) records, uploaded documents, task board (Kanban) approval/rejection notifications and change requests (ChangeRequest).
- Transaction Security and Audit Data: IP addresses used to sign in to the platform, timestamps of click-wrap contract consents, password/session records, administrator action audit logs.
- Financial Data: Proforma and invoice reference numbers, bank receipt references, refund document references, payment/refund status records.
3. PURPOSES AND LEGAL GROUNDS OF PROCESSING
Your personal data are processed for the following purposes on the legal grounds set out in Article 5 of the KVKK:
- KVKK art. 5/2-c (processing directly related to the conclusion or performance of a contract): Opening the account; carrying out the software development, discovery, AI-agent interaction and delivery processes under the Project Model and the Package Model.
- KVKK art. 5/2-ç (compliance with a legal obligation of the data controller): Issuing e-Invoice/e-Archive invoices, keeping commercial books, and retaining traffic/transaction (log) records under Law No. 5651.
- KVKK art. 5/2-e (establishment, exercise or protection of a right): Preserving ScopeBaseline texts for the resolution of scope disputes, proving click-wrap contract and deemed-acceptance consents, and presenting evidence in potential legal disputes.
- KVKK art. 5/2-f (legitimate interest, provided that the fundamental rights and freedoms of the data subject are not harmed): Retaining, for a limited period, the records of discovery sessions that did not turn into a contract (closed without an offer or rejected), against the possibility of unfair competition or commercial complaints; improving system health and estimation quality through aggregated performance metrics that contain no personal data.
4. TRANSFER OF PERSONAL DATA
In accordance with Articles 8 and 9 of the KVKK, your personal data may be transferred to:
- Authorized public institutions and organizations for the fulfilment of legal obligations,
- Contracted banks and financial advisors for the execution of financial processes,
- Legal counsel for the exercise of the right of defence in legal disputes,
- Technology service providers resident in Turkey or abroad (cloud servers, databases, AI language model APIs) for the provision of the platform's core infrastructure — only to the extent required by the purpose and with the necessary data security measures in place.
5. RETENTION AND DISPOSAL PERIODS
Under the platform's data lifecycle policy, your personal data are subject to the following periods:
- 10-Year Retention: Transcripts, ScopeBaseline records, commercial/financial documents and system audit logs belonging to projects whose contract was concluded and performed are retained for the 10-year general limitation and retention periods under the Turkish Code of Obligations and the Turkish Commercial Code.
- 1-Year Retention: Chat transcripts and related supporting texts of discovery sessions without a concluded contract — closed without an offer or rejected — are permanently disposed of at the end of 1 year.
- Account Closure: The Customer may close the account at any time. Upon closure, personal data are not subjected to any new processing purpose; existing records remain subject to the retention classes above and to statutory retention periods, and are deleted or anonymized in accordance with the KVKK when those periods expire. (The 90-day reactivation window upon expiry of a package subscription is independent of account closure and is governed by Article 6.1 of the service agreement.)
6. RIGHTS OF THE DATA SUBJECT (KVKK art. 11)
Under Article 11 of the KVKK, by applying to the data controller you have the right to: learn whether your personal data are processed; request information if they have been processed; learn the purpose of processing and whether they are used in line with that purpose; know the third parties to whom they are transferred in Turkey or abroad; request correction if they are incomplete or inaccurate; request deletion or destruction under the conditions set out in Article 7 of the KVKK; and object to a result arising against you through analysis by automated systems. You may submit your applications in writing via info@yengech.com.