KVKK Privacy Notice (Turkey)
Text revision: July 2026 (not a legal approval)
This notice is issued under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the related communiquĂŠ on the fulfilment of the disclosure obligation. It explains why personal data is processed in LuniOps, on which legal ground, and which rights you have. LuniOps is an operations platform for wholesale distribution and field sales. The company using the platform (the "Customer Company") is the data controller for the data it enters about its own customers, staff, orders and invoices; for that data LuniOps acts as a data processor on the Customer Company's behalf. For data about your LuniOps account, authentication, billing and support requests, LuniOps is the data controller.
1. Identity of the data controller
For account, authentication, subscription and support data, the controller is the operator of LuniOps, whose trade name, address and contact details are published on the Legal Notice (Impressum) page. For the customer, staff, order, delivery and invoice data a Customer Company uploads to the platform, that Customer Company is the controller. If you are an employee or a customer of a Customer Company, address requests about such data to that company first.
2. Categories of personal data processed
⢠Identity and contact data: name, e-mail address, phone number, your role within the company. ⢠Account and authorisation data: user id, role, accessible modules, approval status, invitation records. ⢠Transaction security data: sign-in records, IP address, device and browser information, session and security logs, audit records. ⢠Customer transaction data: order, delivery, delivery-note, invoice, collection and account-ledger records. ⢠Location data: only for teams using the field and delivery modules, and only with your explicit consent; it can be switched off at device level. ⢠Financial data: subscription, payment-provider references and invoice details. Card details are never stored by LuniOps; they are processed by the payment provider. ⢠Request and complaint data: support records, feedback, contact-form content. No special categories of personal data (KVKK art. 6) are intended to be collected. Please do not enter special-category data into free-text fields.
3. Purposes of processing
⢠Providing and running the service: creating the account and the company workspace, defining roles and permissions. ⢠Running operations: tracking orders, picking, dispatch, delivery and returns. ⢠Financial and commercial obligations: issuing invoices and delivery notes, tracking collections, meeting statutory bookkeeping and retention duties. ⢠Information security: preventing unauthorised access, detecting misuse, maintaining an audit trail. ⢠Communication: service notifications, answering support requests, incident and maintenance announcements. ⢠Legal processes: resolving disputes, responding to requests from competent authorities. ⢠Improvement: understanding product usage, where consent-based analytics is used.
4. Legal grounds for processing (KVKK art. 5)
⢠Directly related to the conclusion or performance of a contract (art. 5/2-c): opening your account, running orders and deliveries, maintaining the subscription. ⢠Compliance with a legal obligation (art. 5/2-ç): issuing and retaining invoices and commercial documents, obligations under tax legislation. ⢠Legitimate interest, provided it does not harm your fundamental rights and freedoms (art. 5/2-f): system security, prevention of misuse, keeping audit records, maintaining service quality. ⢠Establishment, exercise or protection of a right (art. 5/2-e): producing evidence in the event of a dispute. ⢠Explicit consent (art. 5/1): for optional processing only â optional analytics cookies, commercial electronic messages and optional location features.
5. Transfer of personal data
Your personal data may be transferred, limited to the purposes above, to the following groups of recipients: ⢠The Customer Company you work for or buy from, and the users it has authorised. ⢠Cloud infrastructure and hosting providers. ⢠Payment and subscription providers (in relation to the subscription only). ⢠E-mail and notification delivery providers. ⢠E-document (e-Fatura / e-ArĹiv) integrators and accountants, only where the relevant Customer Company uses that service. ⢠Professional advisers such as lawyers and auditors, and public authorities where legally required. The current sub-processor list is published in the Privacy Policy and updated when it changes.
6. Transfers abroad
The platform infrastructure and some service providers may be located outside Turkey. In that case the transfer is based on a valid transfer mechanism under the KVKK provisions on transfers abroad (art. 9) â an adequacy decision announced by the Board, an undertaking, a standard contract, or explicit consent. You may request information about the regions where data is hosted and the transfer mechanisms used.
7. Method of collection
Personal data is collected electronically, by automated or partly automated means: when you enter it yourself through the web application, the iOS application or the customer portal; when the company you work for invites you or creates your record; when you contact us by e-mail or support channels; and through system records generated while you use the platform.
8. Retention periods
Personal data is retained for as long as necessary for the purpose it was processed for, and in any case for the limitation and retention periods prescribed by applicable legislation. ⢠Account and profile data: while your account is active; deleted or anonymised within a reasonable wind-down period after closure. ⢠Invoices, delivery notes and commercial books: retained for the statutory period under the Turkish Commercial Code and tax legislation, and cannot be deleted before that period expires. ⢠Security and audit records: retained for a limited period for information-security purposes. ⢠Consent-based records: until consent is withdrawn; the related processing stops upon withdrawal. Once the period expires, data is deleted, destroyed or anonymised.
9. Your rights as a data subject (KVKK art. 11)
Under Article 11 of the Law you have the right to: a) learn whether your personal data is processed, b) request information if it has been processed, c) learn the purpose of processing and whether the data is used in line with that purpose, ç) know the third parties in Turkey or abroad to whom it has been transferred, d) request correction if it is incomplete or inaccurate, e) request erasure or destruction under the conditions set out in the Law, f) request that actions taken under (d) and (e) be notified to third parties to whom the data was transferred, g) object to a result to your detriment arising from analysis solely by automated systems, Ä) claim compensation for damage arising from unlawful processing. For the operational data of the company you work for, address such requests to that company first; LuniOps assists it in the capacity of processor.
10. How to submit a request
You may submit requests concerning your rights, in line with the communiquĂŠ on the procedures for applying to a data controller, together with information verifying your identity, to the e-mail address published on the Legal Notice page or through the secure contact form on the platform. If you have an account, you can export a copy of your data and raise an erasure request from your account privacy page. Your request is concluded free of charge within thirty days at the latest, depending on its nature; where it entails an additional cost, the fee in the tariff set by the Board may be charged. If your request is rejected, the response is found insufficient, or no answer is given in time, you retain the right to lodge a complaint with the Personal Data Protection Board.
11. Processing that requires explicit consent
The following are based solely on explicit consent given separately and freely: ⢠Non-essential analytics and measurement cookies, ⢠Commercial electronic messages (marketing e-mail, SMS or calls); for recipients in Turkey these are managed in line with the Ä°leti YĂśnetim Sistemi (Ä°YS) framework, ⢠Optional location-tracking features for field and delivery teams. You may withdraw your consent at any time. Withdrawal does not make processing carried out before that point unlawful, and it does not stop processing based on performance of the contract, security, or statutory retention obligations. Manage cookie preferences via the âCookie settingsâ link in the footer, and other optional consents from your account privacy page.
12. Changes
This notice may be updated in line with changes in legislation or in the service. The current version is always published on this page; registered users are additionally informed of material changes.