Personal Data Protection Law (KVKK) Notice

Identity of the Data Controller

Under the Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller for the processing activities in which we determine the purposes and means relating to the NEFES Ajansı service is TRADE YAZILIM SANAYİ VE TİCARET LİMİTED ŞİRKETİ (the “Company”). MERSIS: 0859139224600001; VKN: 8591392246; head office: Alsancak Mah., Kıbrıs Şehitleri Cad., Galeri Mazhar No:39 İç Kapı:202 Konak/İzmir. General contact: info@nefesajans.com.

This text is intended for our website visitors, persons using the free trial flow, authorized representatives of business accounts, and relevant persons who contact the Company. For data processing carried out on behalf of a business's own followers or customers who send messages, depending on the specific activity, the business may be the data controller and the Company may act as a data processor acting on its instructions.

What Data Can Be Processed?

Depending on the processing you use, the following data categories may be involved. A feature appearing in the promotion does not mean that this data is collected from all visitors.

• Identity and contact: name, form of address, role or representation information within the business, email, verified phone number and support message.
• Account and security: session identifier, login and verification events, IP and technical access records, security and error logs.
• Business and content: business name, sector, logo, brand preferences, photos and videos of uploaded products, premises or persons, content instructions and approval records.
• Authorized social accounts: account identifier shared within the official connection, access permissions, publishing and engagement data, permitted message and comment records.
• When paid services are launched: company and invoicing information, package selection, payment transaction statuses and commercial relationship records. It is not claimed that NEFES holds bank card information.

Purposes and Legal Grounds

Data is evaluated only in a manner that is related to the processing purpose, limited and proportionate. The legal ground for each data type is applied separately to the specific processing operation.

• Membership and session, free trial, requests and service delivery: necessity for the establishment or performance of a contract under KVKK m.5/2(c).
• Invoicing, commercial records, legal requests and, where required, notification to competent authorities: fulfillment of a legal obligation under m.5/2(ç).
• Prevention of unauthorized access, service security, auditing and protection of rights: depending on the circumstances, legitimate interest under m.5/2(f) or establishment, exercise or protection of a right under m.5/2(e).
• Where separate permission or explicit consent is required: the relevant consent or permission is obtained separately for each purpose. Reading the general privacy notice does not constitute explicit consent.

How Is Data Collected?

Data may be collected by automated or partly automated methods: by entering data directly into site and panel forms, uploading photos and files, explicitly granting authorization for the business account connection, support correspondence, generation of security and session records, or transfer of data within the scope of permission from authorized platforms.

For images provided for the free trial, you are expected to be the owner or an authorized user of them. If a recognizable person or special category data appears in a photo, a separate legal assessment must be carried out before sharing and processing.

Recipient Groups and Cross-Border Transfers

To the extent required by the work, the following may be data recipients: authorized social network connection and publishing infrastructure providers, SMS verification and email service providers, hosting and security services, artificial intelligence, image and video generation services, the payment institution to be selected, accounting advisors, and legally authorized public institutions.

Some technology providers may be located outside Türkiye or may provide access from abroad. The specific recipient, the data involved and the legal safeguard on which an actual transfer will rely are assessed separately. For cross-border transfers, this text alone does not constitute transfer permission or adequate safeguards unless the applicable mechanism under KVKK m.9 has been fulfilled.

Retention, Deletion and Security

Data is retained for as long as the processing purpose and the applicable statutory retention and accountability requirements continue. For data relating to purposes that have ended, a retention and destruction assessment is carried out. Retention periods may differ for account, commercial accounting, security incident and contract records. Matching the specific periods with the record inventory is ongoing; no fixed day or year commitment that has not been verified is made here.

Access restriction, session control, authorized account connection and corporate security methods are applied. No absolute security guarantee is given for any system.

Your Rights Under the KVKK and How to Apply

Within the framework of KVKK m.11, you may exercise your statutory rights, including learning whether your data is being processed, requesting information, learning the processing purpose and the recipients of transfers, requesting correction, requesting deletion or destruction where the legal conditions exist, objecting to an automated analysis result that is against you, and claiming compensation for damages.

You may submit your application in writing to the Company's head office, which enables verification of your identity and request. For information about application methods, info@nefesajans.com you may request information via the address. Applications are concluded within the legal procedures and time limits, and in any case within thirty days at the latest. Since the KEP (Registered Electronic Mail) address has not yet been verified, no KEP information that is not real is provided on this page.