KVKK Information Notice

This is an English translation of the Turkish original. Turkish law applies, and the Turkish version prevails in case of any conflict.

1. Data controller

Data controller: Eva Soft Bilişim A.Ş. · Work10 İş Hanı, Hacı İlbey Mah. Ali Hikmet Paşa Cad. No:27/C, 10100 Altıeylül / Balıkesir, Türkiye · hello@cosuite.io · +90 850 308 23 82.

2. Categories of personal data processed

Identity and contact: full name, email, phone.
Customer transaction: business name, country, sector, selected modules, subscription, invoice and payment records, support requests.
Transaction security: IP address, session and action logs, password hash.
Marketing and measurement: Google Analytics cookie data, only if you consent.
Business data entered in the panel: for this data the controller is the business that is our customer; Eva Soft acts as a data processor.

3. Purposes of processing

Creating the membership and account, providing the CoSuite service and the selected modules
Managing contract, subscription, invoicing and collection processes
Handling customer support and contact requests
Ensuring information security, preventing abuse, keeping logs
Passing the account information needed for activated Asist apps to work
Fulfilling legal obligations and providing information to competent authorities
With consent, measuring site usage and sending commercial electronic messages

4. Collection method and legal grounds

Your personal data is collected electronically, by automated and partly automated means, through the sign-up and contact forms, the CoSuite panel, the payment step, email correspondence and cookies.

Legal grounds: processing is directly related to the conclusion or performance of a contract (KVKK art. 5(2)(c)); compliance with the controller's legal obligation (art. 5(2)(ç)); establishment, exercise or protection of a right (art. 5(2)(e)); legitimate interests, provided your fundamental rights and freedoms are not harmed (art. 5(2)(f)); and explicit consent for analytics cookies and commercial electronic messages (art. 5(1)).

5. Transfers

Limited to the purposes above, your personal data may be transferred in line with KVKK articles 8 and 9 to: the hosting provider; the payment infrastructure PaymentHub and its payment institution; the email delivery service; e-Invoice / e-Archive services and our accountant; the Asist apps you activate (only business name, language, currency, time zone, country and members' name, email and role); Google (Google Analytics), if you consent; and public authorities legally entitled to request it.

Google Analytics data may be processed abroad; this transfer is made only with your explicit consent. Transfers to other service providers with servers abroad rely on the appropriate safeguards in KVKK art. 9.

6. Your rights under KVKK art. 11

To learn whether your personal data is processed
To request information if it has been processed
To learn the purpose of processing and whether it is used accordingly
To know the third parties in Türkiye or abroad to whom it is transferred
To request correction if it is incomplete or inaccurate
To request deletion or destruction under the conditions of KVKK art. 7
To request that correction, deletion and destruction be notified to third parties to whom data was transferred
To object to a result against you arising from analysis exclusively by automated systems
To claim compensation if you suffer damage due to unlawful processing

7. How to apply

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send requests about your rights in writing to the postal address above, together with information that identifies you, or by email to hello@cosuite.io from the email address registered in our system.

Your request will be concluded free of charge within 30 days at the latest, depending on its nature; if the action requires an additional cost, the fee set by the Personal Data Protection Board may apply. If your request is rejected, the answer is insufficient or no answer is given in time, you may file a complaint with the Personal Data Protection Board.