Turkish Data Protection Notice

1. Data controller

This notice is issued by Layvchat as data controller under the Turkish Personal Data Protection Law No. 6698 (the "KVKK") and the Communiqué on the Procedures and Principles of the Obligation to Inform. Contact: [email protected]

For people who use the chat widget on our customers’ sites or send them emails or tickets, the controller is the business concerned; Layvchat processes that data as a processor on the business’s behalf. These people should contact that business for information and requests.

2. Categories of personal data

• Identity: first name, last name, username
• Contact: email address
• Customer transaction: plan, payment amount, payment address, sending wallet address, blockchain transaction ID, support requests and correspondence
• Transaction security: password hash, two-factor secret, IP address, browser and device details, session and sign-in logs, activity logs
• Mobile device: push notification token and device platform (only if the mobile app is used)
• Visual: optional profile photo
• Marketing: email preferences, only if consent has been given

We do not process special categories of personal data.

3. Purposes

• Running membership and account processes
• Providing the contracted service, verifying payments and giving support
• Running information security processes and preventing unauthorized access and abuse
• Sending necessary service messages
• Meeting finance, accounting and legal obligations and responding to requests from authorities
• Protecting rights in legal disputes
• Product and campaign information, if consent has been given

4. Legal grounds

Your personal data is processed on the following grounds in Article 5(2) of the KVKK: (c) it is directly related to entering into or performing a contract, (ç) it is necessary for the controller to meet a legal obligation, (e) it is necessary to establish, exercise or protect a right, (f) it is necessary for the controller’s legitimate interest, provided it does not harm your fundamental rights and freedoms.

Marketing messages rely only on the separate, optional explicit consent you may give under Article 5(1) of the KVKK. This notice is not a consent form.

5. How data is collected

Data is collected electronically, by fully or partly automated means, through the sign-up form, Sign in with Google, the console and mobile app, the payment screen and public blockchain records, support correspondence and automatic system logs.

6. Transfers

For the purposes above only, your personal data may be transferred to our hosting provider, our domain and security provider, our email sending and receiving provider, to notification services (Expo, Google, Apple) if push notifications are on in the mobile app, to Google if you choose Sign in with Google, and to legally authorized public bodies. The current provider list is on the Sub-processors page.

International transfers are made under Article 9 of the KVKK by signing the standard contract published by the Board and notifying the Authority within five business days of signature.

7. Retention and destruction

Personal data is kept for as long as the purpose requires and for the periods set by law; after that it is deleted, destroyed or anonymized. Retention periods are listed in the Privacy Policy.

8. Your rights

Under Article 11 of the KVKK you have the right to: learn whether your personal data is processed; request information if it is; learn the purpose of processing and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; ask for it to be corrected if incomplete or inaccurate; ask for it to be deleted or destroyed under the conditions of Article 7; ask for corrections and deletions to be passed on to the third parties it was transferred to; object to an outcome against you resulting solely from automated analysis; and claim compensation for damage caused by unlawful processing.

9. How to apply

In line with the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can send your application to [email protected] from the email address registered to your Layvchat account, by registered electronic mail (KEP), or signed with a secure electronic signature or mobile signature.

Your application must include your first and last name, an email address for our reply and a clear description of your request. Applications are concluded free of charge within 30 days at the latest; if the action involves an additional cost, the fee set by the Board may apply.

If your application is rejected, you find the reply insufficient or no reply is given in time, you can complain to the Personal Data Protection Board.

10. Information only

This notice is for information and requires no approval. For more detail, see the Privacy Policy.