KVKK Notice
Last updated: 24 October 2026
In line with Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK), this notice tells you why, on what legal basis and with whom your personal data is processed and shared.
1. Data controller
Red Şantiye. Its trade name, registry number and address will be published on this page once the company is formally set up.
For any question about these pages or about your personal data, use the "Request a demo" form on the home page; your message goes straight to the platform administrator.
For data about a customer company's own employees and business partners, that company is the controller and Red Şantiye is the processor.
2. Personal data processed
| Category | Data | Where |
|---|---|---|
| Identity | First name, last name, username | Application (account) |
| Contact | E-mail, phone; in a demo request: name, company, phone, role, number of sites, note | Application (account), the website form |
| Security | Password hash, session-key hash, sign-in attempts | Application |
| History of changes | Who created and changed which record and when (with before-and-after values) | Application |
| Technical | IP address, browser information, time and duration of requests | Server logs |
| Work records | Site, work progress, defect, daily report, subcontractor, payment, purchasing and safety records; attached photos and files | Application |
3. Purposes and legal bases
- Account management and providing the service: establishment and performance of a contract (Art. 5/2-c).
- Information security, preventing abuse, debugging: the controller's legitimate interest (Art. 5/2-f).
- Keeping financial and commercial records, notifying authorities: legal obligation (Art. 5/2-ç).
- Answering a demo request: at the data subject's request, a pre-contract step (Art. 5/2-c).
- If marketing communication is ever sent, explicit consent (Art. 5/1) is obtained separately; none is sent today.
4. How data is collected
Data is collected electronically when your account is opened, while you use the application, when you fill in the website form, and through the server's automatic logs.
5. Transfers
Your data is not sold. It is passed to the following recipients for the stated purpose:
- Hosting provider (Amazon Web Services, Frankfurt, Germany): running the application and the database.
- Content-delivery and security service (Cloudflare): protecting and delivering traffic.
- Competent public authorities: where the law requires.
6. Transfer abroad
Because the servers are in Germany, data is hosted abroad. The transfer is made under Article 9 of the Law and the related regulations, as necessary to provide the service and with the required safeguards (contract terms with the provider, encryption in transit, access control). For details of the transfer, contact us through the route above.
7. Retention
| Data | Period |
|---|---|
| User account | Until the account is deleted; afterwards for the legal retention period |
| Work records | For the duration of the service agreement and as long as legal retention obligations require |
| Financial records | The period set by the relevant legislation (Tax Procedure Law and Turkish Commercial Code) |
| Server request logs | 30 days |
| Session-renewal keys | At most 14 days |
| Demo requests | Until the conversation concludes and a reasonable time after |
| Backups | Kept in generations (daily, weekly, monthly); deleted when they expire |
8. Your rights as a data subject
Under Article 11 of the Law you have the right to:
- Learn whether your personal data is processed and request information if it is.
- Learn the purpose of the processing and whether it is used accordingly.
- Know the third parties to whom it is transferred, in Türkiye or abroad.
- Ask for correction if it is incomplete or wrong, and for this to be notified to those it was transferred to.
- Ask for deletion or destruction when the reasons for processing no longer exist, even if it was processed lawfully.
- Object to a result against you arising from analysis exclusively by automated systems.
- Claim compensation if you suffer damage from unlawful processing.
9. How to apply
To use your rights, apply through the contact route above. Your request is answered as soon as possible and within 30 days at the latest, depending on its nature. We may ask for extra information to verify your identity. If you are not satisfied with the answer, you may complain to the Personal Data Protection Board.
This text reflects how the service works today and is updated as the service changes.