This notice has been prepared under Article 10 of Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. Its purpose is to inform people who use the Policyful platform ("Platform"), become members of it or apply to it about how their personal data is processed.
The Platform is operated by CDR Araştırma Hizmetleri Limited Şirketi ("Company" or "we").
1. Data Controller
CDR Araştırma Hizmetleri Limited Şirketi is the data controller for your account, usage, security and billing information. The position for content you enter into the Platform is explained in Section 3.
Name: CDR Araştırma Hizmetleri Limited Şirketi
Tax Office / No: Bakırköy / 2030790478
Address: Yeşilköy Mah. Havaalanı Cad. Dış Hatlar Sitesi Terminal İstanbul Şube No: 2/5 İç Kapı No: 20 Bakırköy/İstanbul
2. Personal Data We Process
Identity information: first name, last name
Contact information: email address and, if you share it, phone number
Professional information: the name of the organisation you work for and, if you share it, your job title
Account information: username, password (stored encrypted), membership and plan information, organisation profile preferences (organisation type, areas of interest, institutions followed)
Platform usage information: your saved searches, watchlists, the reports you create and other actions within the Platform
Transaction security information: IP address, browser and device information, session and log records
Customer transaction information: support requests and correspondence
Financial information: billing information and payment transaction records. Your card details are processed by the payment service provider; the Company does not store your card details.
Marketing information: records of consent to and refusal of commercial electronic messages
Cookie data: explained in Section 11.
3. Content You Enter into the Platform
The questions and search content you submit to the Platform ("User Content") may contain personal data about you or third parties. If you use the Platform on behalf of your organisation, your organisation is the data controller for personal data in User Content; the Company is a data processor acting only on behalf of your organisation and for the purpose of providing the service.
You are responsible for obtaining third-party data in User Content lawfully and for entering it into the Platform. The Platform does not need personal data in User Content in order to work. Please do not add personal data to your questions, especially special categories of personal data such as health or criminal convictions.
4. How Personal Data Is Collected
Your personal data is collected electronically, by automated and partly automated means, through membership and application forms, account settings, use of the Platform, support requests, email correspondence and cookies.
5. Purposes and Legal Grounds for Processing
Creating your membership, managing your account and providing Platform services (search, watchlists, matching based on your organisation profile, summary, report and assistant features)Legal ground: Formation and performance of a contract (KVKK Art. 5/2-c)
Assessing applications for free use by civil society organisations and demo requests from institutionsLegal ground: Formation of a contract (Art. 5/2-c)
Sending service-related notifications (daily email digest, account and security notifications, notifications about changes to this notice)Legal ground: Performance of a contract (Art. 5/2-c)
Responding to your support and contact requestsLegal ground: Performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f)
Fulfilling billing, accounting and tax obligationsLegal ground: Legal obligation (Art. 5/2-ç) and performance of a contract (Art. 5/2-c)
Ensuring information security, preventing unauthorised access and misuse, and keeping log recordsLegal ground: Legal obligation (Art. 5/2-ç; Law No. 5651 and related legislation) and legitimate interest (Art. 5/2-f)
Improving the Platform, fixing errors and producing usage statisticsLegal ground: Legitimate interest (Art. 5/2-f). Anonymous or aggregated data is used for this purpose wherever possible. Processing through analytics cookies relies solely on your explicit consent (Art. 5/1).
Complying with requests and decisions of competent public authorities and judicial bodiesLegal ground: Legal obligation (Art. 5/2-ç)
Establishing, exercising and protecting rights in legal disputesLegal ground: Establishment, exercise or protection of a right (Art. 5/2-e)
Sending newsletters, event and campaign announcements by emailLegal ground: Explicit consent (Art. 5/1) and the approval you give under Law No. 6563. Not giving approval does not prevent you from using the Platform. You can withdraw your approval at any time.
Processing with artificial intelligence: The summary and assistant features of the Platform work with models from our AI service providers. User Content and the related document texts are sent to these providers solely to generate the answer. Your name, email address and other account information are not sent to these providers. Matching and analysis on the Platform concern regulations, not people; no automated decision producing legal effects about you is made.
6. Transfer of Personal Data
Transfers within Türkiye
Our service providers: companies providing us with hosting, email delivery, customer support, payment and accounting services. Transfers are made only to the extent the service requires (Art. 5/2-c, ç and f).
Competent public authorities and judicial bodies: upon request and to the extent required by legislation (Art. 5/2-ç).
Our legal and financial advisers: to protect rights and meet legal obligations (Art. 5/2-e and f).
Transfers abroad
The servers of some of the Platform's infrastructure and AI service providers are located abroad, primarily in the United States. In this context, User Content and the related document texts may be transferred to our AI service providers, and your account, usage and security information may be transferred to our infrastructure service providers to the extent the service requires. Data transferred abroad is limited to what is necessary to provide the service. Transfers are carried out in line with Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. You can apply using the methods in Section 9 to obtain information about the service providers data is transferred to.
7. Retention Periods
Account and usage information: for as long as your account is open; after the account is closed, for 10 years, the general limitation period, in view of possible disputes
User Content: for as long as your account is open; deleted in the first periodic destruction after your account is closed.
Billing and accounting records: for the period required by the relevant legislation (10 years under the Turkish Commercial Code)
Transaction security and log records: for the period required by Law No. 5651 and related legislation
Support correspondence: 2 years from the conclusion of the request
Information from applications that do not become memberships: 1 year from the conclusion of the application
Consent records for commercial electronic messages: 3 years from the withdrawal of consent
Data whose retention period has expired is deleted, destroyed or anonymised in the first periodic destruction (within 6 months at the latest) under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
8. Your Rights
Under Article 11 of the KVKK, by applying to the Company you have the right to:
a)learn whether your personal data is processed,
b)request information about it if your personal data has been processed,
c)learn the purpose of processing your personal data and whether it is used in line with that purpose,
ç)know the third parties in Türkiye or abroad to whom your personal data is transferred,
d)request correction of your personal data if it is processed incompletely or incorrectly,
e)request deletion or destruction of your personal data within the conditions in Article 7 of the KVKK,
f)request that the actions taken under paragraphs (d) and (e) be notified to third parties to whom your personal data has been transferred,
g)object to an outcome against you arising from analysis of the processed data exclusively through automated systems,
ğ)request compensation for damage if you suffer damage due to unlawful processing of your personal data.
Requests concerning data in User Content must be sent to your organisation as the data controller. We help your organisation respond to these requests.
9. How to Apply
You can submit your application in Turkish by one of the following methods:
By a petition bearing a wet signature, delivered by hand, by post or through a notary to the address in Section 1
By sending your application signed with a secure electronic signature or mobile signature to info@policyful.com By sending an email to info@policyful.com from the email address registered on the Platform Your application must include your first and last name, your signature for written applications, your Turkish ID number (for foreign nationals, nationality and passport or ID number), your residential or business address for notification, your email address and phone number for notification if any, and the subject of your request.
We conclude your application free of charge as soon as possible according to the nature of the request, and within 30 days at the latest. If the action requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.
If your application is rejected, the answer is found insufficient or no answer is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning the answer, and in any case within 60 days of the application date.
10. Data Security
Under Article 12 of the KVKK, we take appropriate technical and administrative measures to keep your personal data secure. These measures include encryption in data transfer, storing passwords encrypted, authorisation and access control, keeping log records, and contracts with service providers containing confidentiality obligations.
If your personal data is obtained unlawfully by others, we will notify you and the Personal Data Protection Board as soon as possible.
11. Cookies
Three types of cookies are used on the Platform:
Strictly necessary cookies: needed to keep your session open and for the Platform to work securely. These cookies rely on the legal grounds of performance of a contract and legitimate interest (Art. 5/2-c and f) and cannot be switched off.
Preference cookies: used to remember your preferences, such as language.
Analytics cookies: used to produce statistics on how the Platform is used.
Preference and analytics cookies are used only with your explicit consent (Art. 5/1). You can give your cookie preferences through the cookie notice on the Platform and change them at any time.
12. Changes to This Notice
We may update this notice from time to time. The current version is always published on this page. We will also notify you of significant changes by email.
13. Contact
CDR Araştırma Hizmetleri Limited Şirketi
Yeşilköy Mah. Havaalanı Cad. Dış Hatlar Sitesi Terminal İstanbul Şube No: 2/5 İç Kapı No: 20 Bakırköy/İstanbul
info@policyful.com