Notice under the Turkish Data Protection Law (KVKK)

This notice is given under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu; the "KVKK" or the "Law") and the Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation to Inform. It is addressed to natural persons who visit the Qante Assist website, submit the "Get a free store review" form or contact us by e-mail, and explains how their personal data are processed.

The Turkish version of this notice is authoritative; the English version is a faithful rendering provided for information only (see section 14).

1. Identity of the Data Controller

Your personal data are processed by the company identified below, acting as data controller (veri sorumlusu). "Qante Assist" is the service brand of that company.

• Company name: 1337 Werk UG (haftungsbeschränkt)
• Address: Obere Wöhrstraße 29, 73431 Aalen, Germany
• Register: Amtsgericht Ulm, HRB 746887 (Ulm Local Court)
• E-mail: care@qante.ai

2. Scope

This notice covers the processing activities we carry out as data controller in connection with our website and the free store review request process.

• Once a service agreement is in place, we access data in our clients' stores (for example order data and end-customer data) on the client's behalf and on the client's instructions. In that respect we act as data processor (veri işleyen). Those operations are governed by a separate data processing agreement with the client and fall outside the scope of this notice. The same applies where we work for agencies under their brand.
• The information required under the EU General Data Protection Regulation (GDPR) is set out in the Privacy policy.
• The Law protects only data relating to natural persons. Information about legal entities (for example the name of a limited company) is not personal data. Information about sole proprietorships, and e-mail addresses that can be linked to a natural person, are personal data and are covered by this notice.

3. Personal Data Processed

3.1 "Get a free store review" form

When you submit the form, the following information is processed:

• Contact details: e-mail address, phone number, name (optional)
• Business detail: store address (URL) or, if you do not have a store yet, what you sell and where
• Request details: your answers to two questions after submitting (who does this work today, what takes most of your time; optional), the plan button you pressed on the website and how you reached the form (where applicable)
• Technical request details: language of the page from which the form was submitted, the source that referred you to the site (utm_source parameter or referring page), time of submission, time taken to fill in the form (only for the misuse check in section 3.2)

3.2 Server logs and security checks

When you visit the site, the hosting infrastructure automatically records the following data: IP address, date and time of access, page or file requested, response status code, browser and operating system information, referring page.

To prevent misuse of the form:

• Your IP address is held briefly in the server's volatile memory in order to limit the number of submissions made from the same address within one hour; it is not written to any permanent record.
• To distinguish automated submissions, the time taken to complete the form and a hidden check field are verified at the moment of submission; this information is not stored.

3.3 Site usage statistics

Site usage is measured with the software OpenPanel, which we run on our own server (Google Cloud, Frankfurt am Main) and which uses no cookies: pages and sections viewed, time on screen, scroll depth, links clicked, the names of form fields touched (not what was typed), referring source, country or city and device type. Your IP address is not stored; what you type into forms, your name and your e-mail address are not passed to this measurement (with the exception in the next paragraph).

If you allow "Analytics" in the cookie window, Google Analytics 4 (Google Ireland Limited) also runs with cookies, and a random visitor id is stored in your browser; if you send a request, this id is linked to your record in our CRM. If you requested a review, your name, your e-mail address, your company's name and the link to your CRM record are also added to your profile in OpenPanel; these details go to no other measurement tool. Without your consent, Google Analytics sets no cookies; only cookieless signals without an identifier (page, type of event, time, browser details, approximate location derived from the IP address) go to Google, from which Google estimates the number of visitors without consent in aggregate. You can withdraw your consent at any time via the "Cookie settings" link at the bottom of the page.

No advertising cookies, tracking pixels or remarketing tools are used on the site.

3.4 E-mail correspondence

When you send us an e-mail, we process your e-mail address, your name and job title where you state them, and the content of the correspondence.

3.5 Content in return for your e-mail address

To send you the rule calendar by e-mail or let you open a sample review on the website, we process your e-mail address, the content you asked for, the language version and the time, and store them in our CRM as a prospect record. For the sample review, OpenPanel measures which page is viewed and for how long, whether it is downloaded and whether a link to share it is created; if you allowed "Analytics", this measurement is linked to your CRM record through the visitor id. If you arrive through a shared link, the random id of the person who shared it is also stored with your record. Your e-mail address is not passed to measurement tools.

3.6 Contact form and partner form

In the contact form, your name (optional), your e-mail address, your message and the page from which you sent the form are processed. In the partner form, the type of request, your name, your e-mail address, your phone number (for workshop and partnership requests), the name, type and city of your organisation, the expected number of participants and the timing, your store address (for the referral link) and your note are processed. For both forms the language of the page and the time of submission are also recorded; the information, including the details of your organisation, is stored in our CRM.

4. Purposes of Processing

Your personal data are processed for the following purposes:

• assessing your request; preparing a free review (what the store needs and which plan fits) for your store or agency and sending it to you by e-mail, as a rule within 24 hours on working days
• communicating with you about your request and answering your questions
• if you so wish, preparing for the conclusion of a service agreement (proposal, scope of the plan, contract text)
• keeping the site secure and running without interruption, identifying errors, preventing spam and misuse
• sending the content you requested (rule calendar, sample review) and contacting you about it
• answering questions and cooperation requests you send through the contact or partner form
• measuring, at an aggregate and anonymous level, which pages and sources attract interest
• complying with legal obligations; exercising and protecting our rights in the event of a dispute

Your data are not used for advertising purposes, are not used for profiling, and are not sold or rented to third parties. Apart from the reply to your request and the correspondence connected with it, no commercial electronic messages for marketing purposes are sent to you without your separate consent.

5. Legal Grounds for Processing

Your personal data are processed on the following legal grounds listed in Article 5(2) of the Law:

• Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract (Art. 5(2)(c)): form data and the correspondence connected with the request. The review, plan and price are preliminary work prepared at your request with a view to concluding a service agreement.
• Processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed (Art. 5(2)(f)): server logs, measures against spam and misuse, referring-source information, aggregate usage statistics and the retention of requests as business records for a limited period; and the processing of data of persons who submit the request on behalf of a company and would not themselves become a party to the contract, for the purpose of handling the business enquiry.
• Processing is necessary for the data controller to comply with a legal obligation (Art. 5(2)(ç)): where a contract is concluded, the retention and documentation obligations under commercial and tax legislation, and lawful requests from competent authorities.
• Processing is necessary for the establishment, exercise or protection of a right (Art. 5(2)(e)): retention as evidence in the event of a dispute.

Sending content you requested in return for your e-mail address relies on Art. 5(2)(c), and storing the shared link on Art. 5(2)(f); news about new rules is sent only with your explicit consent (Art. 5(1)). The contact and partner forms rely on Art. 5(2)(c) where the request is directed at a contract, and otherwise on Art. 5(2)(f).

Measurement with Google Analytics and the visitor id rely on the explicit consent you give in the cookie window (Art. 5(1)); you may withdraw it at any time. We do not ask for special categories of personal data and do not knowingly process them.

Completing the form is voluntary. Without an e-mail address, a phone number and basic store details, however, the request cannot be accepted.

6. Method of Collection

Your personal data are collected electronically, by fully or partly automated means:

• directly from you, when you complete and submit the "Get a free store review" form on the website;
• automatically through server logs during your visit to the site;
• through the e-mails you send us.

We do not obtain data about you from other sources (databases, data brokers and the like). In preparing the review we look only at the content that is publicly available at the store address you stated in the form.

7. Recipients and Purposes of Transfer

In accordance with Articles 8 and 9 of the Law, and limited to the purposes stated below, your personal data may be transferred to the following groups of recipients:

• Hosting provider — Vercel (USA): publishing the site, processing the form request and keeping server logs
• E-mail delivery provider — Resend (USA): notifying our team of your request and sending the reply e-mail to you
• CRM and record-keeping provider — Twenty CRM on Google Cloud (Google Cloud EMEA Limited), server location Frankfurt am Main, Germany: recording the request and placing it in the workflow
• E-mail and office software provider — ALL-INKL.COM – Neue Medien Münnich, servers in Germany: conducting correspondence
• Usage statistics — our own OpenPanel server on Google Cloud (Google Cloud EMEA Limited), server location Frankfurt am Main, Germany: producing usage statistics without cookies
• Measurement provider (only with your explicit consent) — Google Ireland Limited (Ireland; parent company Google LLC, USA): measuring site usage with Google Analytics
• Legal, tax and accounting advisers: to the extent necessary and subject to a duty of confidentiality
• Competent public authorities and judicial bodies: limited to lawful requests based on legislation

The service providers are data processors that process the data solely on our instructions and on our behalf; a data processing agreement is concluded with each of them. Beyond this, your data are not shared with third parties and are not transferred to advertising networks or data brokers.

8. Transfers Abroad

The servers of the hosting, e-mail and automation providers listed in section 7 are located outside Turkey (in the United States of America and in Member States of the European Union). Your form data, your e-mail address and the server logs are therefore transferred abroad, limited to the purposes set out in section 4. With your explicit consent, Google Analytics measurement data may also be transferred to Google's servers (including in the USA).

Transfers abroad are made in accordance with Article 9 of the Law and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad:

• Where the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu; the "Board") has issued an adequacy decision for the destination country, a sector within that country or an international organisation, the transfer is based on that decision.
• Where there is no adequacy decision, the transfer is made on condition that one of the processing conditions in Article 5 of the Law is met and one of the appropriate safeguards in Article 9(4) is provided. The safeguard we rely on: [Transfer mechanism used — for example, signing the standard contract published by the Board with the relevant provider and notifying it to the Authority within five working days of signature].
• Where no appropriate safeguard can be provided and the transfer is incidental in nature, the transfer may be based only on one of the exceptions in Article 9(6), in particular that the transfer is necessary for the implementation of pre-contractual measures taken at your request.

You may request information on the transfer arrangements made with the relevant providers through the contact channels in section 12.

9. Retention Period and Disposal

Your personal data are retained for as long as is necessary for the purpose for which they are processed:

• Review requests that do not lead to a contract, and the related correspondence: 6 months from the last correspondence
• Where a contract is concluded: the request data are placed in the client file and are retained for the term of the contract and thereafter for the retention periods under the commercial and tax legislation that applies to us and for the applicable limitation periods. Applicable periods: the German commercial and tax retention periods of six to ten years (section 257 HGB, section 147 AO)
• Server logs: no more than 30 days
• Delivery records at the e-mail delivery provider: 30 days
• IP address held for submission limiting: in volatile memory only, limited to the one-hour counting window
• Usage statistics without cookies (OpenPanel): 14 months
• Google Analytics measurement data: 14 months
• Requests for content in return for your e-mail address: 6 months from the last contact; if you consented to news about new rules, until you withdraw that consent
• Contact and partner forms: 6 months from the last contact if no contract results
• Visitor id: in your browser until you withdraw consent

When the period expires or the reason for processing ceases to exist, your data are erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. An erasure request is fulfilled without waiting for the period to expire, to the extent that no statutory retention obligation applies.

10. Data Security

Under Article 12 of the Law, we take appropriate technical and organisational measures to prevent the unlawful processing of personal data and unlawful access to them, and to ensure that the data are kept safe. In particular:

• the site is served only over an encrypted connection (HTTPS/TLS);
• form data are accessed only by the team members who assess your request; access is restricted on a need-to-know basis;
• service providers are bound by contract to confidentiality and security obligations.

11. Your Rights as a Data Subject

Under Article 11 of the Law, you have the right to apply to the data controller and to:

• learn whether your personal data are processed,
• request information about the processing if your personal data have been processed,
• learn the purpose of the processing and whether the data are used in accordance with that purpose,
• know the third parties, in Turkey or abroad, to whom your personal data are transferred,
• request the rectification of your personal data if they have been processed incompletely or inaccurately,
• request the erasure or destruction of your personal data under the conditions laid down in Article 7 of the Law,
• request that rectification, erasure and destruction be notified to the third parties to whom your personal data have been transferred,
• object to any result to your detriment arising from the analysis of the processed data exclusively by automated systems,
• claim compensation for damage you suffer as a result of the unlawful processing of your personal data.

12. How to Apply

You may submit requests concerning your rights, in accordance with the Communiqué on the Principles and Procedures for Application to the Data Controller, by one of the following means:

• in writing, by a petition bearing a handwritten signature, to the following address: 1337 Werk UG (haftungsbeschränkt), Obere Wöhrstraße 29, 73431 Aalen, Germany
• using a secure electronic signature or mobile signature, or from the e-mail address that you previously notified to us and that is recorded in our system: care@qante.ai

The application must contain the following information:

• first name, surname and, if the application is in writing, signature;
• for citizens of the Republic of Turkey, the Turkish identity number (T.C. kimlik numarası); for foreign nationals, nationality and passport number or, if any, identity number;
• residential or business address for notifications;
• if any, e-mail address, telephone number and fax number for notifications;
• the subject of the request.

Information and documents relevant to the matter are to be attached to the application. Applications are made in Turkish. We may ask for additional information in order to verify that the application is yours.

Depending on its nature, your request is concluded free of charge as soon as possible and within thirty days at the latest. If the operation entails a separate cost, the fee set out in the tariff determined by the Board may be charged. The reply is given in writing or electronically; if the request is refused, the reasons are stated.

13. Right to Lodge a Complaint with the Board

If your application is refused, if you find the reply insufficient, or if the application is not answered in time, you may lodge a complaint with the Board within thirty days of the date on which you learn of the reply and in any event within sixty days of the date of the application (Art. 14 of the Law). A complaint cannot be lodged before the remedy of applying to the data controller has been exhausted.

Website of the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu): www.kvkk.gov.tr

14. Language and Updates

The binding version of this notice is the Turkish version. The German and English versions are provided for information only; in the event of any discrepancy between the versions, the Turkish text prevails.

This notice is updated when our processing activities or the legislation change. The current version is published on this page.

Last updated: 26 October 2026