20% off your first order with code:
TRSign inSign up
Company · Legal

KVKK Information Notice

This is a translation provided for convenience; the Turkish version prevails. Read the Turkish version

Under Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK), we at Treas explain which of your personal data we process, for which purposes and on which legal grounds, to whom we transfer it, and how you can exercise your rights.

Last updated:

Contents

1. Data Controller

Under Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by the company whose details are given below, in its capacity as data controller:

Legal name
Dokunmatik Ekran Teknolojileri Bilişim İnşaat Tic. Ltd. Şti. ("Treas")
Address
Hürriyet Mahallesi Altın Sokak No: 35/B Bahçelievler, İstanbul
Tax office / number
Yenibosna / 3090341016

This notice is prepared for our customers, prospective customers, website visitors and people who contact us through our support channels.

2. Personal Data Processed

Identity
First and last name, username; for individual invoices, Turkish national identity number.
Contact
Email address, phone number, billing address.
Customer transactions
Order, service, invoice, refund and Account Balance records; support requests and correspondence; cancellation requests and their reasons.
Financial
For corporate invoices, the company name, tax office and tax number; payment records and the saved-card key issued by the payment institution; card details (card number, expiry date and security code — only at the time of payment, for the purpose of forwarding them to the payment institution, and without being stored).
Transaction security
IP address, login history, browser and device information, approximate location derived from the IP address, two-step verification and passkey information, session and activity logs.
Linked accounts
If you choose to sign in with or link a Google, GitHub, Microsoft or Discord account, the identifier and email address of that account; your Discord username.
Service and traffic
IP addresses assigned to the service, server name, resource and traffic usage measurements, DDoS and firewall logs; hosting provider traffic information under Law No. 5651.

Treas does not request special categories of personal data in order to provide its services. You are the data controller for personal data contained in the content you host on your servers or in your hosting account; for that data, Treas only provides the infrastructure.

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

  • creating your membership and verifying your identity and contact details,
  • taking orders; setting up, providing, renewing, upgrading and terminating services,
  • collecting payments, issuing invoices, and carrying out refund and Account Balance transactions,
  • responding to support requests and sending notifications and announcements about the services,
  • ensuring account and transaction security; preventing unauthorized access, fraud and abuse,
  • protecting the network, the infrastructure and other customers against DDoS and similar attacks,
  • fulfilling obligations arising from tax, commercial and Law No. 5651 legislation, and responding to requests from competent authorities,
  • establishing, exercising and protecting rights in legal disputes,
  • measuring and improving service quality.

4. Method of Collection and Legal Grounds

Method of collection

Your personal data is collected electronically, by partly or fully automated means, through the registration, order, payment and support forms on our website and in the Client Area; communication channels such as email and Discord; the services you choose for sign-in and account linking; information returned by payment and e-invoicing service providers; and system logs generated while the services operate.

Legal grounds

Your personal data is processed on the following legal grounds set out in Article 5(2) of KVKK:

  • Establishment or performance of a contract (Art. 5(2)(c)): membership, orders, provision of the service, payment and invoicing, support.
  • Compliance with a legal obligation (Art. 5(2)(ç)): invoice and accounting records, records under Law No. 5651, requests from competent authorities.
  • Establishment, exercise or protection of a right (Art. 5(2)(e)): handling disputes and collecting receivables, records that must be kept as evidence.
  • Legitimate interest (Art. 5(2)(f)): account and network security, login records, prevention of abuse and attacks, improvement of service quality; provided that your fundamental rights and freedoms are not harmed.

For processing that cannot be based on any of these legal grounds, your explicit consent is obtained in accordance with Article 5(1) of KVKK; you can withdraw your explicit consent at any time.

5. Transfer of Personal Data

Your personal data may be transferred to the following recipient groups, limited to the purposes above and within the framework of Articles 8 and 9 of KVKK.

Recipients in Turkey

Payment institution
PayTR — name, email, phone, address, IP address, card details (card number, expiry date, security code) and payment information, for card payments, saving cards, saved-card payments and card refunds.
E-invoicing and pre-accounting
Paraşüt — name, email, phone, billing address, Turkish national identity number or tax details, and invoice lines, for issuing e-invoices and e-archive invoices.
SMS service
NetGSM — phone number and message content, for delivering phone verification and two-step verification codes and service notifications (e.g. expiry reminders).
Infrastructure providers
Data center and connectivity (carrier) service providers — for operating the physical and network infrastructure of the service.
Advisors
Persons and organizations providing us with legal and financial advisory services — for legal obligations and the protection of rights.
Competent authorities
Judicial authorities, the Information and Communication Technologies Authority, tax offices and other competent public institutions and organizations — for legal requests and obligations.

Recipients abroad

The servers of the following service providers may be located outside Turkey. These transfers are carried out on the basis of the transfer mechanisms set out in Article 9 of KVKK (an adequacy decision, appropriate safeguards or incidental transfer cases):

Email infrastructure
Google — sending account, order, invoice and security emails; support correspondence (email address, name and message content).
Sign-in and account linking
Google, GitHub, Microsoft and Discord — only if you choose to sign in or link your account with these methods, the information needed for authentication.
Discord integration
Discord — if you link your account, joining our Discord server and role assignment, delivering the notifications you choose, and support requests opened through Discord.
WhatsApp verification
Meta (WhatsApp) — if you choose to receive your verification code via WhatsApp, your phone number and the verification code.
DDoS protection network
DDoS protection and network security service providers — IP addresses and traffic information, for filtering the traffic directed at your service.

6. Retention Period

Your personal data is kept for the period necessary for the purpose for which it is processed, for the periods required by the applicable legislation (including tax, commercial and Law No. 5651 legislation) and for the limitation periods applicable to potential disputes. When these periods end, the data is erased, destroyed or anonymized in accordance with KVKK and the Regulation on the Erasure, Destruction or Anonymization of Personal Data.

7. Rights of the Data Subject

Under Article 11 of KVKK, by applying to Treas you have the right to:

  1. learn whether your personal data is processed,
  2. request information about the processing if your personal data has been processed,
  3. learn the purpose of processing your personal data and whether it is used in line with that purpose,
  4. know the third parties in Turkey or abroad to whom your personal data is transferred,
  5. request the rectification of your personal data if it is processed incompletely or inaccurately,
  6. request the erasure or destruction of your personal data under the conditions set out in Article 7 of KVKK,
  7. request that the rectification, erasure and destruction operations be notified to the third parties to whom your personal data has been transferred,
  8. object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems,
  9. claim compensation for damage if you suffer damage due to the unlawful processing of your personal data.

8. How to Apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your requests regarding your rights in Turkish and in writing by the following means:

  • by delivering a petition bearing your wet signature in person to Hürriyet Mahallesi Altın Sokak No: 35/B Bahçelievler, İstanbul, or by sending it by post or through a notary public,
  • by sending an email to merhaba@treas.net.tr from the email address you previously provided to Treas and that is registered in our system,
  • by sending it to merhaba@treas.net.tr signed with a secure electronic signature or mobile signature.

Your application must include your first and last name, your signature if the application is in writing, your Turkish national identity number (for foreign nationals, your nationality and passport or identity number), your residential or business address for notifications, your email address and phone number for notifications if any, and the subject of your request. Documents relating to your request should be attached to the application.

Your application will be concluded free of charge as soon as possible, depending on its nature, and within thirty days at the latest. If the process requires an additional cost, the fee set in the tariff determined by the Personal Data Protection Board may be charged. If your application is rejected, if you find the response insufficient or if no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of KVKK.

9. Cookies

Our website uses only the cookies needed to maintain your session and for security, and browser storage in which preferences are kept; no cookies are used for analytics or advertising. For details, see the cookies section of the Privacy Policy.

10. Updates

This information notice may be updated in line with changes in the legislation and in our data processing activities. The current notice is always published on this page; the "Last updated" date at the top of the page shows the most recent change.