Personal Data Notice (KVKK)

Updated: 28 September 2026

This notice under Türkiye’s Personal Data Protection Law No. 6698 covers Tonozz visitors, individual and corporate account holders and representatives, advertisers and people contacting us. The data controller is TONOZZ TEKNOLOJİ ANONİM ŞİRKETİ. Address: Yalı Mahallesi, Hamam Sokak, Yalı Apt. Blok No:12/6 Maltepe, İSTANBUL. Email: info@tonozz.com. Registered electronic mail (KEP): tonozz@hs01.kep.tr. Further official details appear under Company Information.

1. Data and collection methods

Data is collected electronically through registration and profile forms, listing text and images, corporate document uploads, the contact form, email correspondence, account/listing actions and browser requests, and where relevant through written applications. Processing may be automated or manual as part of a filing system.

Categories include name, email, telephone and country code; account and login information; identification number and date of birth in profile updates; business name, tax details, address, representation and verification documents; listing text, images, location and professional information; enquiries; IP address, browser details, action times, change history, security logs and cookie preferences. Company information is personal data to the extent it relates to an identifiable individual.

Do not include unnecessary sensitive personal data in listings or support messages. Mask irrelevant fields in documents where appropriate. Identification number and date of birth fields do not mean that official identity verification takes place.

2. Purposes and legal grounds

Identity, contact, account and listing data necessary for account creation, login/password services and publication is processed for establishing or performing a contract (Article 5(2)(c)). Additional profile identity details are processed to distinguish the account holder; data unrelated or unnecessary to that purpose should not be requested.

Records needed to assess corporate authority and documents, maintain security, prevent abuse and investigate errors are processed for legitimate interests, provided fundamental rights are not infringed (Article 5(2)(f)). Article 5(2)(c) may also apply where necessary to information about individuals who are parties to the contract.

Support relies on contract performance (Article 5(2)(c)) or the legitimate interest in answering enquiries (Article 5(2)(f)), depending on the request. Protecting rights and handling disputes relies on Article 5(2)(e); official requests and statutory duties rely on Article 5(2)(ç), limited to the relevant obligation. No unlimited legal ground is asserted for every item of data.

Optional analytics and advertising cookies rely on explicit consent (Article 5(1)). Refusal does not prevent account or listing services. Contract acceptance, privacy information and marketing consent are separate. Permission for commercial messages must be obtained separately where required.

3. Recipients and purposes of disclosure

Names/business names, images, location, descriptions and the contact details provided in published listings are visible to visitors and may be seen by search engines. Corporate verification documents are not published as listing content.

To the extent needed for the service, data may be shared with hosting provider Güzelhost, email provider Google Workspace and authorised technical support providers; and with competent authorities and legal advisers where necessary for a legal obligation or to protect rights. reCAPTCHA on the contact form and external font/CDN resources may receive IP addresses and browser data. If selected, Google Analytics and Google Ads process data for measurement and advertising.

4. Overseas services

Google Workspace, reCAPTCHA, optional Google measurement/advertising services and some external resources may involve processing abroad. Article 9 requires an applicable processing condition together with the necessary transfer mechanism, such as an applicable adequacy decision or appropriate safeguards. Merely reading this notice or choosing cookies does not automatically legalise regular overseas transfers. You may request information about destination countries, recipients and the safeguards applied to our services through our contact channels.

5. Retention, erasure and backups

Data is kept for the period required by applicable legislation or, where no period is prescribed, only for as long as its processing purpose requires. Account/listing records, support correspondence, security logs and dispute documents are assessed separately according to purpose, applicable obligations and the need to protect rights. There is no single retention period for all data.

When processing grounds cease, data must be erased, destroyed or anonymised as required by law. Backup copies are included; backups do not justify indefinite retention. This notice does not promise a fixed backup cycle or an implemented automatic deletion process. Pausing a listing changes visibility only; account closure and erasure requests are assessed separately.

6. Your rights and requests

You may ask whether your data is processed and request details, purposes, whether use matches those purposes and domestic/overseas recipients. You may request correction, erasure or destruction where conditions are met and notification of those actions to recipients. You may also challenge an adverse result based exclusively on automated analysis and claim compensation for damage caused by unlawful processing.

Send a written request to our address, use our KEP address, secure electronic/mobile signature, or email info@tonozz.com from an address previously supplied to us and registered in our system. Include your name, legally required identification information, notification address, other contact details if available, your request and relevant documents; written requests must be signed. Only necessary verification information is requested. Notarial submission is not the only route.

Requests are answered as soon as their nature permits and within 30 days. If processing requires additional costs, the tariff determined by the Board may apply. Statutory rights to complain to the Personal Data Protection Board and pursue other remedies remain available subject to their legal conditions. Cookie choices can be changed at any time in the footer.

7. Sign in with Google

Google sign-in is optional; registration and sign-in with an email address and password remain available. If you choose Google, your Google-verified name, email address and unique Google account ID are processed to create your Tonozz account, securely connect an existing account and start a session. We do not request your Google password, Gmail messages, contacts or Drive files. If the Google-verified @gmail.com address matches an existing account, the accounts are connected without asking for the Tonozz password. Other email addresses require the Tonozz password to confirm ownership on the first connection. New members provide a phone number and separately accept the relevant account agreement. We do not save the Google profile picture as your account image.

Google Identity Services provides the Google button on sign-in and registration pages; your browser connects to Google servers on these pages. Google may process your IP address, browser information and technical data relating to its own session. This service is separate from Google Workspace email and optional analytics/advertising tools; analytics or advertising consent does not accept an account agreement. Data for account creation, session management and account security is processed to establish/perform the service and protect its security, subject to applicable conditions in Article 5 of the KVKK. Google services may involve overseas processing; the necessary transfer mechanism and related rights are addressed under the Personal Data Notice (KVKK).