KVKK Privacy Notice

This English text is an informational translation. The Turkish text prevails and is the binding version.

This Privacy Notice has been prepared pursuant to Article 10 of Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

This text applies to the tazminat.com website, the portal.tazminat.com user portal, the new user interface and the associated calculation application programming interface (API) (together, the "Services").

1. Data Controller

Pursuant to KVKK, your personal data is processed by the legal entity whose details are given below, in its capacity as data controller:

2. Personal Data Processed

Depending on the services we provide, the following personal data of yours may be processed by Tazminat.com:

• Identity data: First name, surname, T.R. identity number (only if a report is prepared).
• Contact data: E-mail address, telephone number, address.
• Customer transaction data: Billing information, order information, account history.
• Transaction security data: IP address, browser information, session records (opening, last activity and closing time), failed login attempts, cookie data. One-time verification codes sent at login are not stored in plain form.
• Financial data: Payment information (card details are not stored by us; they are processed by the payment institution).
• Professional data: Information on whether you are a lawyer, expert, SMMM or HR specialist (for the correct routing of credit packages).
• File data: Documents you upload for calculation (statement of claim, expert report, etc.), power of attorney, vehicle photographs, the corporate buyer's return invoice.
• Health data (special category): Information in documents such as medical board reports and epicrises that you enter or upload for disability calculations and disability applications (may belong to your client).
• AI data: When you use the AI features, document text whose personal identifiers have been redacted on your computer; operation and token counts. If you connect your own AI account, your API key is stored encrypted on the server.
• Legal transaction data: Contracts you approve (terms of use, pre-contract information form, distance sales contract) and the approval date, IP address, browser information; permission records (commercial message approval, explicit consents and their withdrawal); withdrawal notices.
• Trial version data: The verified telephone number, an irreversible hash of the e-mail address and the registration IP address, so that the trial entitlement is used only once.
• Support data: Your support messages and ratings.
• Calculation data: Information you enter for calculation and the reports generated from it. This information may include data of third parties such as clients, workers, accident victims, beneficiaries or convicts.
• Sharing data: When you send a report by e-mail, the recipient's e-mail address and the note you add; the creation and expiry times of sharing links and how many times they have been opened.
• Usage (measurement) data: Only if you consent to analytics cookies: pages visited, device and browser type, approximate location (city/country level), Google Analytics cookie ID. In the portal, record numbers and query information in page addresses are deleted before sending. Your name, e-mail address, and calculation and report contents are not sent for measurement.

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Carrying out membership procedures and account management.
• Providing calculation services and generating reports.
• Conducting billing and payment processes.
• Managing customer relations and support services.
• Responding to requests and complaints.
• Fulfilling legal obligations.
• Improving services and developing new services.
• Sending campaign and announcement messages (only if you have given approval for commercial electronic messages; Law No. 6563).
• Establishing and proving the distance sales contract, processing withdrawal notices and refunds.
• Preventing abuse of the trial version.
• If you have given explicit consent, providing the AI features and reading documents containing health data.
• Information security and combating fraud; ensuring account security through two-step login (password and a one-time code sent by SMS or e-mail).
• Delivering reports by sharing link, WhatsApp or e-mail at your request.
• If you consent to analytics cookies, statistically measuring the use of the site and portal.

4. Legal Grounds

Your personal data is processed on the basis of the following legal grounds set out in KVKK Art. 5 and Art. 6:

• It being expressly provided for by law (KVKK Art. 5/2-a).
• It being directly related to the establishment or performance of a contract (KVKK Art. 5/2-c).
• It being necessary for the data controller to fulfill its legal obligation (KVKK Art. 5/2-ç).
• It being mandatory for the establishment, exercise or protection of a right (KVKK Art. 5/2-e).
• Legitimate interest, provided that it does not harm the fundamental rights and freedoms of the data subject (KVKK Art. 5/2-f).
• The existence of your explicit consent (KVKK Art. 5/1) — for analytics (performance) cookies. You may withdraw your consent at any time from your cookie preferences.
• The existence of your explicit consent (KVKK Art. 6/3-a and Art. 9/6-a) — for reading documents containing health data with AI and for transfer abroad for AI: explicit consent text. In a disability application, the legal basis (power of attorney, consent) for processing the client's health data rests with the user making the application.
• Your approval under Law No. 6563 for commercial electronic messages: commercial message approval text.

Explicit consent and commercial message approvals are optional, are obtained separately from the privacy notice and may be withdrawn at any time in the portal from the My Account → My Information → Permissions section.

5. Data Transfer

Your personal data may be shared with the following parties in line with the purposes stated above:

• Business partners: Experts and specialists with whom we work to provide calculation services.
• Domestic suppliers: Hosting (servers in Türkiye), payment institution (Türkiye İş Bankası; card details are transmitted to the bank only for payment), e-archive / e-invoice private integrator (billing information), SMS and e-mail service providers (verification codes and notifications), oHeyet for disability applications (application and health information).
• Google LLC (Google Analytics): Only if you consent to analytics cookies, the usage (measurement) data stated above. Google signals and ad personalization are turned off.
• Google LLC (reCAPTCHA): On login and registration forms, only when necessary, to prevent abuse; IP address and browser information.
• Google LLC and Apple Inc. (sign-in with Google / Apple): If you choose to sign in this way, for verifying your identity; your name and e-mail address are obtained from the provider.
• AI providers (Anthropic PBC, Google LLC, OpenAI): Only with your explicit consent and when you use the AI features, document text whose personal identifiers have been redacted on your computer.
• Recipients you designate: When you share a report, persons who have the sharing link or receive the e-mail can see the content of the report.
• Authorized public institutions: Courts, prosecutors' offices and tax offices within the framework of legal obligations.
• Legal advisors: Lawyers in legal disputes.

Transfer abroad (KVKK Art. 9): Google Analytics measurement data only with your consent to analytics cookies, and the redacted document text sent to AI providers only with your explicit consent, are processed abroad (USA). reCAPTCHA and sign-in with Google / Apple connect directly from your browser to the provider when you use these services. Fonts are loaded from the site's own server; Google Fonts is not used. Other than these, your personal data is not transferred abroad; if such a transfer becomes necessary, this text will be updated in advance.

6. Retention Period

Your personal data is retained for the period required by the purposes of processing, taking into account the maximum periods provided for in the relevant legislation:

• Membership data: For the duration of the membership. When you permanently delete your account, your identity and contact information, your reports and the documents you uploaded are deleted.
• Invoice, order and payment records: 10 years (Turkish Commercial Code Art. 82 and Tax Procedure Law Art. 253); they are retained for this period even if you delete your account.
• Transaction security data: 2 years (Law No. 5651).
• Cookie data: Between 1 day – 2 years depending on type.
• Calculation files: 1 year after the service.
• Calculation form drafts: Information you enter in a calculation form and leave without calculating is stored encrypted so that you can continue where you left off; it is deleted 30 days after the last change or when you save the calculation. You may delete the draft at any time.
• Calculation data and reports: Until you delete them or your membership ends; thereafter together with the membership data.
• One-time login codes: Valid for a few minutes; not stored in plain form.
• Report sharing links: Become invalid when the period you select (1–90 days) expires or when you cancel the link.
• Google Analytics data: For the retention period set in Google Analytics (maximum 14 months).
• Contract, approval and withdrawal records: 10 years (statute of limitations and Turkish Commercial Code Art. 82); they are retained for this period even if you delete your account.
• Permission records (commercial message approval, explicit consent and its withdrawal): 3 years from the end of the permission (for purposes of proof).
• Text sent to AI: Not stored at Tazminat.com; at the provider, for the short period set out in the provider's terms.
• Trial version records: The verified telephone and e-mail hash are retained for 2 years, even if your account is deleted, so that the trial entitlement is used only once.

7. Your Rights under KVKK Art. 11

Pursuant to Article 11 of KVKK, you have the following rights:

• To learn whether your personal data is being processed.
• If it has been processed, to request information about this.
• To learn the purpose of processing and whether the data is being used in accordance with that purpose.
• To know the third parties to whom it has been transferred domestically or abroad.
• To request correction if it has been processed incompletely or incorrectly.
• To request its deletion or destruction within the framework of KVKK Art. 7.
• To request that correction/deletion operations be notified to the third parties to whom it has been transferred.
• To object to the occurrence of a result to your detriment due to analysis exclusively by automated systems.
• To request compensation for damage if you suffer damage due to unlawful processing.

You may yourself deactivate your account in the portal from the My Account → Close account section (your data is not deleted and the account can be reopened) or delete it permanently. In permanent deletion, invoice and payment records and transaction security records that have a statutory retention period are retained for that period.

8. Application Channels

To exercise the rights stated above, you may submit your application through the following channels:

Your application must contain the minimum information specified in the relevant KVKK communiqué (identity information, subject of the request). Your application is answered free of charge within 30 days at the latest. However, if the operation requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.