Personal Data Protection Law (KVKK) Information Notice
This information notice has been prepared by ALLKA Otomasyon Sanayi ve Ticaret Limited Şirketi, as the data controller, under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
1. Identity of the Data Controller
- Trade name: ALLKA Otomasyon Sanayi ve Ticaret Limited Şirketi
- Address: Tekke Mah. Mektep Cad. No:46 Asel Apt. D:10, Orhangazi / Bursa 16800, Türkiye
- Field of activity: Software development — corporate websites, e-commerce systems, mobile apps, custom software and AI assistants
- Contact: info@allka.com.tr · +90 224 334 00 99
- Website: allka.com.tr
- VERBİS registry no.: 15958958
2. Categories of Personal Data Processed
2.1 Identity data
- Name and surname
- Company name / trade name (for corporate customers)
2.2 Contact data
- E-mail address
- Phone number
- Postal / delivery address
2.3 Order and transaction data
- Information about purchased products and services
- Order number, order date and amount
- Billing and delivery information
- Payment method type (card numbers are not stored)
2.4 Customer transaction data
- Messages and requests sent through the contact form
- Technical support and service request information
2.5 Transaction security data
- IP address, browser type and session information
- Website usage logs
2.6 Marketing data
- Commercial electronic message preferences, where explicit consent has been given
2.7 WhatsApp communication data
- When you write to our WhatsApp Business line: your phone number and WhatsApp profile name
- The content of your messages (text; if you send a voice note, photo or document, the fact that you sent it)
- The times your messages are sent and read
3. Purposes of Processing
- Carrying out order and sales processes
- Establishing and performing contracts
- Invoicing and accounting
- Managing shipping and delivery
- Customer service and technical support
- Answering contact form messages
- Answering the information, quotation and support requests you send us on WhatsApp
- AI-assisted reply drafts: a draft reply to your WhatsApp message may be prepared by an AI model running on our company's own server. A draft is sent to you only after an authorised member of our staff has read and approved it; no reply is sent automatically and no decision about you is based solely on automated processing. For complaints, legal matters or unclear requests no draft is prepared and your message goes directly to an authorised person.
- Fulfilling legal obligations (tax law, commercial bookkeeping, etc.)
- Ensuring website security and preventing unauthorised access
- Where explicit consent has been given: information, campaigns and promotions about our products and services
- Statistical analysis and improving service quality
4. Method and Legal Grounds of Collection
4.1 Methods
- Electronic means: the contact form, order form and registration on our website
- Cookies and similar technologies: automatically, during website visits
- Phone and e-mail: through direct contact
- WhatsApp: through the WhatsApp Business Platform of WhatsApp LLC (Meta group), when you write to us
4.2 Legal grounds
- Establishment or performance of a contract (Art. 5/2-c): carrying out orders and deliveries; answering quotation and service requests received on WhatsApp
- Legal obligation (Art. 5/2-ç): obligations under tax and commercial law
- Legitimate interest (Art. 5/2-f): website security, statistical analysis, keeping a record of customer communication and service quality
- Explicit consent (Art. 5/1): marketing and promotional activities
5. Transfer of Personal Data
Your personal data is not sold or rented to third parties. Subject to legal obligations, it may be transferred to the following recipients under Articles 8 and 9 of the KVKK:
- Shipping and logistics companies: name, surname and delivery address, to deliver orders.
- Payment service providers: to carry out secure payments (we do not store card numbers).
- Accounting and financial advisory services: for legal invoicing and accounting obligations.
- Authorised public institutions: where required by law.
- Technical infrastructure and hosting providers: to operate the website; bound by confidentiality. Our servers are in Hetzner Online GmbH's data centre in Germany.
- WhatsApp LLC, USA (WhatsApp Business Platform, Meta group): your WhatsApp messages are carried over WhatsApp's infrastructure; WhatsApp processes them as a data processor.
- Our WhatsApp message relay server (Hetzner Online GmbH, Germany): messages arriving from Meta are encrypted so that only our company's key can open them, kept for at most 7 days and deleted as soon as they reach our company system; the hosting provider cannot read their content.
Transfers abroad: transfers through WhatsApp LLC (USA) and Hetzner Online GmbH (Germany) are transfers abroad under Article 9 of the KVKK. The transfer to WhatsApp is made under WhatsApp's Data Transfer Addendum, which incorporates the standard contract clauses of the Personal Data Protection Board. For Hetzner the standard contract process is being carried out. This notice will be updated once notification of the contracts to the Authority is complete.
6. Retention Periods
- Order and invoice records: 10 years (Tax Procedure Law and Turkish Commercial Code)
- Contact form messages: 3 years from the end of the communication
- Website access logs: 2 years
- Marketing preferences: deleted immediately when consent is withdrawn
- WhatsApp message content: 30 days
- WhatsApp reply drafts: 90 days
- WhatsApp conversation records (direction, time and message id only; no text and no plain phone number): 90 days
- Encrypted message relay boxes (relay server): at most 7 days
7. Rights of the Data Subject (KVKK Article 11)
- To learn whether your personal data is processed
- To request information if it has been processed
- To learn the purpose of processing
- To know the third parties to whom it is transferred
- To request correction of incomplete or inaccurate data
- To request deletion under Article 7 of the KVKK
- To request that corrections or deletions be notified to third parties
- To object to results against you arising solely from automated processing
- To claim compensation for damage caused by unlawful processing
8. How to Apply
To exercise your rights, e-mail info@allka.com.tr with the subject "KVKK Application", or apply in writing with a wet-signed petition to our company address. Applications are answered within 30 days at the latest, after identity verification. If your application is rejected or the answer is insufficient, you may complain to the Personal Data Protection Board.
You can exercise your rights for WhatsApp data in the same way; on request your WhatsApp messages, reply drafts and conversation records are deleted from our systems. For Meta's own copy, please use WhatsApp's own settings. To speak with a person on our WhatsApp line, simply say so; your request is forwarded directly to an authorised member of staff.
9. Changes and Updates
This notice may be updated in line with changes in legislation or in our business processes.
Effective date: 1 January 2025 · Last updated: 7 October 2026 (WhatsApp channel)
