Last updated: 3 September 2026

KVKK Privacy Notice

This notice has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, in order to inform data subjects about the personal data processing carried out by dyrdev. in its capacity as data controller.

The Turkish version of this text is the authoritative one. Translations are provided for information only; in case of any discrepancy, the Turkish text prevails.

1. Identity of the data controller

Data controller: dyrdev. Yazılım ve Dijital Çözümler (hereinafter "dyrdev."), Kocaeli / İzmit. Contact: kvkk@dyrdev.com · 0551 515 93 12

dyrdev. processes the personal data described in this notice in accordance with the KVKK and the related legislation.

2. Categories of personal data processed

The following personal data is processed through our website and the project brief form:

Identity data: first name, surname.
Contact data: phone number, email address, preferred contact channel and, where given, Telegram username.
Customer transaction data: the name of the company you represent, its sector, employee and user counts, existing systems, your selections and explanations about the project scope, budget and timing preferences, and the notes you write into free-text fields.
Transaction security data: records relating to the use of the access code; irreversible hash values derived from IP address and browser information in order to prevent abuse and automated submissions; technical records relating to the session cookie.
Request and complaint management data: the information you send through the contact form or a callback request.

3. Purposes of processing

Assessing your project request, working out its scope and presenting you with a quote.
Contacting you through the channel you chose and keeping you informed about the process.
Planning, carrying out and supporting the work should a contract be concluded.
Managing requests, suggestions and complaints.
Ensuring information security, preventing fake and automated submissions, and keeping system records.
Meeting obligations arising from the applicable legislation and responding to requests from authorised bodies.

4. Method of collection

Your personal data is collected electronically and by partly automated means, based directly on your own declaration, through the brief form, the contact form and callback requests on our website. Data may also be obtained through contact you make with us over WhatsApp, Telegram, phone or email.

5. Legal grounds for processing

Your personal data is processed on the following legal grounds set out in Article 5 of the KVKK:

Art. 5/2-c: Processing personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract.
Art. 5/2-ç: Processing is mandatory for the data controller to fulfil its legal obligation.
Art. 5/2-e: Processing is mandatory for the establishment, exercise or protection of a right.
Art. 5/2-f: Processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Art. 5/1: Where none of the above conditions apply, the explicit consent you give in the form.

6. Transfer of personal data

Your personal data may be transferred solely for the purposes set out in this notice and in accordance with the conditions laid down in Articles 8 and 9 of the KVKK.

Briefs and contact requests are delivered to the dyrdev. team over an encrypted connection through Telegram, which is used as the messaging infrastructure. Hosting providers are used for the site and application infrastructure. Those providers' servers may be located abroad; in that case the transfer is carried out only to the extent necessary for the performance of the service and within the conditions laid down in Article 9 of the KVKK.

Your personal data is never sold, rented or assigned to third parties for marketing purposes. Duly made requests from legally authorised public institutions are reserved.

7. Retention and destruction

An unfinished brief draft is kept only in the browser on your own device for at most 24 hours; it is deleted when the form is submitted or when that period ends. This data is never transferred to dyrdev. servers.
Submitted briefs and contact records are retained throughout the quotation process and any resulting contractual relationship, and thereafter for the limitation and retention periods set out in the applicable legislation.
Access code records are retained for the validity period of the code and for as long as necessary for security reviews.
At the end of the retention period, personal data is deleted, destroyed or anonymised.

8. Data security measures

Data is transferred over an encrypted connection (HTTPS).
Form data is re-validated on the server side, with size and content limits applied.
Access codes are never stored in plain text; only irreversible hash values are kept.
The session cookie is signed, set as httpOnly and SameSite=strict, and expires after a limited period.
Rate limiting, a bot trap and access control are applied against abuse.
Access rights are defined according to the principle of least privilege.

9. Rights of the data subject

Under Article 11 of the KVKK you have the following rights as a data subject:

To learn whether your personal data is being processed.
To request information if your personal data has been processed.
To learn the purpose of processing and whether the data is used in accordance with that purpose.
To know the third parties, in Türkiye or abroad, to whom the personal data has been transferred.
To request correction where the data has been processed incompletely or incorrectly.
To request deletion or destruction within the conditions set out in Article 7 of the KVKK.
To request that correction, deletion and destruction be notified to the third parties to whom the data was transferred.
To object to a result reached against you through analysis of the processed data exclusively by automated systems.
To claim compensation where you suffer damage due to unlawful processing.

10. How to apply

You may submit requests relating to the rights above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, together with information verifying your identity, by email to kvkk@dyrdev.com or in writing to the address Kocaeli / İzmit.

Your application is concluded as soon as possible and in any event within thirty days, depending on the nature of the request. Where the process incurs an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

Should your application be rejected, the response be found insufficient, or no response be given in time, your right to lodge a complaint with the Personal Data Protection Board is reserved.

11. Sharing data belonging to third parties

You should share only your own personal data through the form. If you share personal data belonging to your employees, customers or other third parties, you are deemed to have declared that you obtained that data lawfully, that you informed the data subjects, and that you have the necessary legal ground. You hold the capacity of data controller for that data.

You are liable for any claim, administrative fine and loss directed against dyrdev. as a result of that declaration being untrue.

The form does not ask for special-category or sensitive data such as passwords, card details, health data, biometric data or criminal conviction records; you should not enter such data into the form fields.

12. Updates to this notice

dyrdev. may update this privacy notice due to changes in legislation or in its business processes. The current text is always published on this page and takes effect on the date of publication.