KVKK Clarification Text

Last Updated: September 21, 2026Effective Date: September 21, 2026

Translation Notice

⚠️ IMPORTANT: This document has been translated from Turkish for informational purposes only. The original Turkish version is the legally binding document. In case of any discrepancy between the Turkish and English versions, the Turkish version shall prevail.

This clarification text is prepared in accordance with Turkish Law No. 6698 on Protection of Personal Data (KVKK) and is primarily applicable to data processing activities in Turkey.

1. Data Controller Identity

Under Law No. 6698 on Protection of Personal Data ("KVKK" or "Law"), your personal data may be processed by the data controller identified below.

DATA CONTROLLER:

Title: Evaste (operated by Group Taiga) Address: Levent, Istanbul, Turkey Email: info@evaste.co Phone: +90 532 494 42 64 Website: https://evaste.co

As the data controller, we take necessary technical and administrative measures for the security and confidentiality of your personal data.

2. Processed Personal Data

The following personal data is processed through our Platform:

2.1. Identity Information

First name
Last name
Username

2.2. Contact Information

Email address
Phone number
Business address

2.3. Financial Information

Billing information
Tax number
Payment history

Note: Credit card information is not stored by Evaste. This information is processed by our secure payment infrastructure provider (Stripe).

2.4. Customer Transaction Information

Subscription information
Service usage history
Support requests and correspondence

2.5. Legal Process and Compliance Information

Consent records
Contract records
Documents related to legal processes

2.6. Transaction Security Information

IP address
Session information
Log records
Device and browser information

2.7. Advertising Measurement and Marketing Attribution Data

Evaste uses the Meta (Facebook) Pixel (browser) and the Meta Conversions API (server) solely to measure the performance of its own advertising on evaste.co and on the sign-up, onboarding and subscription pages of app.evaste.co. These tools are not used in the consent widget on our customers' websites or on data of our customers' end-visitors. They run only if you give explicit consent by accepting the "Marketing" category in Evaste's own cookie banner. The data that may be processed and transferred after consent is given:

Event data (page view, sign-up, e-mail verification, domain verification, sales contact request, paid subscription with plan and amount excluding VAT)
Hashed e-mail address
Hashed internal user ID
Hashed phone number (contact form only)
IP address
Browser user agent
_fbp and _fbc identifiers
Page URL

Payment card data is never shared.

Data Evaste keeps itself: for users who registered with marketing consent, marketing attribution data (UTM values, ad click ID, landing page, referrer, chosen plan, browser identifiers; IP address and user agent are stored encrypted) is kept until a deletion request. For users who registered without consent, only the consent status and the chosen plan are kept.

3. Purposes of Personal Data Processing

Your personal data is processed for the following purposes:

3.1. Service Provision and Contractual Obligations

Providing platform access
Creating and managing user accounts
Providing cookie consent management services
Providing privacy policy creation services
Providing compliance reporting services
Providing API and integration services

3.2. Payment and Billing

Collection of subscription fees
Issuing and sending invoices
Payment tracking and reconciliation

3.3. Customer Relations Management

Responding to support requests
Evaluating complaints and applications
Customer satisfaction surveys
Measuring service quality

3.4. Legal Obligations

Fulfilling obligations under Law No. 6698 (KVKK)
Fulfilling obligations under tax legislation
Fulfilling obligations under Law No. 6563 (E-Commerce Law)
Responding to court orders and official requests

3.5. Measurement of Our Own Advertising (with Explicit Consent)

Measuring and optimizing advertising performance
Sending conversion events to Meta through the Meta Pixel and the Meta Conversions API

Advertising Measurement: Recipients, International Transfer and Legal Basis

Recipients and international transfer

Recipient	Purpose of Transfer	Country
Meta Platforms Ireland Limited and Meta Platforms, Inc.	Measurement of our own advertising (Meta Pixel and Conversions API; only with explicit consent)	Ireland, USA

Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA) act as independent data controllers for their own purposes. The transfer abroad is based on the data subject's explicit consent under KVKK Article 9 and on the Evaste-side safeguards (additional technical security measures and transfer impact assessment). For Meta's data processing practices: https://www.facebook.com/privacy/policy

Legal basis

This processing is based on your explicit consent (KVKK Article 5/1 and Article 9). Without your consent, no data is sent to Meta.

Withdrawal of consent

You may withdraw your consent at any time through Evaste's cookie banner or settings. Withdrawal stops any further sending of data; it does not affect processing carried out lawfully before withdrawal.

4. Your Rights Under KVKK Article 11

Under Article 11 of Law No. 6698, you have the following rights:

To learn whether your personal data is processed
To request information about processing if your data is processed
To learn the purpose of processing and whether data is used accordingly
To know third parties to whom personal data is transferred
To request correction if personal data is incomplete or inaccurate
To request deletion or destruction of personal data under KVKK Article 7
To request notification of corrections to third parties
To object to results arising from automated analysis
To claim compensation for damages due to unlawful processing

You may also withdraw your explicit consent to advertising measurement at any time through Evaste's cookie banner or settings; withdrawal stops future sending of data and does not affect earlier lawful processing.

5. Application Methods

5.1. Application Channels

To exercise your rights under KVKK, you may apply through:

(a) Email: kvkk@evaste.co (Subject: "KVKK Application")

(b) Platform: Account Settings > Privacy > KVKK Application

5.2. Required Information

Your application must include:

Name and surname
T.C. Identity Number (for Turkish citizens) or Passport number
Address for notification
Email address, phone number (if available)
Subject of request
Information and documents related to request

5.3. Response Time

Applications will be concluded within 30 (thirty) days at the latest.

5.4. Complaint to Personal Data Protection Authority

If you find the response to your application insufficient or do not receive a response within 30 days, you may file a complaint with the Personal Data Protection Authority:

Personal Data Protection Authority Address: Nasuh Akar Mah. Ziyabey Cad. No:6, 06520, Balgat/Ankara Web: https://kvkk.gov.tr Email: bilgi@kvkk.gov.tr

Additional Information

Data Retention Periods

Data Category	Retention Period
Identity and Contact	Duration of active account + 3 years
Financial Data	10 years (Tax legislation)
Transaction Records	10 years (Turkish Commercial Code)
Consent Records	Duration of valid consent + 5 years
Support Records	3 years
Log Data	2 years
Marketing Data	Until consent is withdrawn
Marketing Attribution Data (users who registered with marketing consent)	Until a deletion request

This Clarification Text has been prepared in accordance with Article 10 of Law No. 6698 and became effective on September 21, 2026.

By using the Platform or benefiting from our services, you are deemed to have read and understood this Clarification Text.

Back to Legal Center