KVKK Disclosure Notice

This English text is an informational translation. The legally binding version is the Turkish original published at /tr/aydinlatma-metni. References are to Turkish legislation and have not been replaced with EU/GDPR provisions.

Last updated: [Effective date: to be completed by client]

This notice has been prepared by CN Denetim ve SMMM A.Ş. in its capacity as data controller, pursuant to Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation.

1. Data Controller

Company name	CN Denetim ve SMMM A.Ş.
Address	Şenlikköy Mh. Harman Sk. No:42/A D:5, Florya / Küçükçekmece / İstanbul
E-mail	info@cndenetim.com.tr
Telephone	[Telephone: to be completed by client]
KEP address (registered electronic mail)	[KEP address: to be completed by client]
VERBİS registration number	[VERBİS registration number: to be completed by client]

2. Who Does This Notice Cover?

• Our clients and their authorised representatives,
• The employees of our clients whose data is transferred to us for payroll, social security and personnel processes,
• Prospective clients and those requesting a quotation,
• Our suppliers and business partners,
• Visitors to our website and those completing the contact form,
• Newsletter subscribers,
• Job applicants.

3. Personal Data Processed

Data subject group	Data processed
Website visitor	IP address, browser and device information, pages visited and time of visit (log records), strictly necessary cookie records
Contact form user	Full name, e-mail, telephone, company name, service of interest, message content, IP address, record of KVKK consent
Newsletter subscriber	E-mail address, language preference, IP address, subscription date
Client and client representative	Identity and contact details, tax identification number, circular of signature and authority details, accounting and financial records, tax return data, bank/IBAN details, contract and invoice details
Client employee (payroll / social security service)	Identity details, social security registration number, salary and premium details, employment entry/exit declarations, leave and timesheet records
Supplier / business partner	Identity and contact details of the authorised person, contract and payment details
Job applicant	CV content, education and professional experience details, contact details, references if any

4. Purposes of Processing

• Providing independent audit, certified public accountancy, bookkeeping, tax and incentive advisory services,
• Preparing and monitoring applications for R&D / design centres, technoparks and support programmes,
• Establishing and performing contractual processes and issuing quotations,
• Submitting tax returns, notifications and reports to the competent authorities,
• Managing finance, accounting and collection processes,
• Responding to requests, questions and complaints received through the contact form and by e-mail,
• Sending newsletters on the basis of explicit consent,
• Operating the website securely and without interruption and managing information security processes,
• Managing human resources and job applicant evaluation processes,
• Fulfilling statutory retention, disclosure and notification obligations.

5. Method of Collection

Your personal data is collected through the contact and newsletter forms on our website, e-mail, telephone, postal and KEP correspondence, face-to-face meetings, signed contracts and powers of attorney, documents and files submitted by you or by our client, and the log records automatically kept by our website; by partly automated, fully automated and non-automated means.

6. Legal Grounds

Your data is processed on the following grounds set out in Article 5 of the KVKK:

• Art. 5/2-a — Expressly provided for by law: Transactions under Tax Procedure Law No. 213 (VUK), Law No. 3568 on Certified Public Accountancy (SMMM) and Sworn-in Certified Public Accountancy (YMM), Turkish Commercial Code No. 6102 (TTK), Law No. 5510, Law No. 5549 and KGK regulations.
• Art. 5/2-c — Conclusion or performance of a contract: Preparation and performance of service agreements and invoicing.
• Art. 5/2-ç — Fulfilment of a legal obligation: Filing of tax returns and notifications, customer identification, retention obligations.
• Art. 5/2-e — Establishment, exercise or protection of a right: Retention of records that serve as evidence in disputes.
• Art. 5/2-f — Legitimate interest: Information security, business continuity and service quality; website log records.
• Art. 5/1 — Explicit consent: Only for newsletter subscription and consent-based commercial electronic messages.

Data you submit through the contact form is processed in order to respond to your request and, depending on the nature of that request, on the grounds of pre-contractual process and legitimate interest.

7. Transfer of Personal Data

In accordance with Articles 8 and 9 of the KVKK and only to the extent necessary, your personal data may be transferred to:

• Authorised public institutions and bodies such as the Revenue Administration (GİB), the Social Security Institution (SGK), the Ministry of Trade, KGK, MASAK, TÜBİTAK, KOSGEB, the Ministry of Industry and Technology and technopark management companies,
• Judicial and administrative authorities upon request,
• Legal, IT, hosting, e-mail and archiving service providers engaged to deliver the service (acting as data processors, under confidentiality and data processing agreements).

Your data is not shared with, sold or rented to third parties for marketing purposes.

Cross-border transfer: Depending on the server location of the hosting and e-mail infrastructure in use, transfer abroad may occur. The relevant service providers and countries will be stated explicitly in this section once clarified as [Service providers and countries involved in cross-border transfers: to be completed by client]; any transfer will be made only where the conditions of Article 9 of the KVKK are met.

8. Retention Periods

Your data is retained for the period required by the purpose of processing and for the minimum statutory retention periods (5 years for tax and accounting records, 10 years for commercial books and documents and for independent audit files, 2 years for contact form records, 2 years for log records and 1 year for job applications); at the end of those periods it is erased, destroyed or anonymised.

9. Your Rights and How to Apply

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of processing, to know the third parties to whom it has been transferred, to request rectification where it is incomplete or inaccurate, to request erasure or destruction where the conditions are met, to request that these operations be notified to the third parties concerned, to object to an adverse outcome arising exclusively from automated analysis, and to claim compensation for damage caused by unlawful processing.

You may submit your requests by wet-signed petition to Şenlikköy Mh. Harman Sk. No:42/A D:5, Florya / Küçükçekmece / İstanbul, by secure electronic signature or mobile signature to [KEP address: to be completed by client], or from the e-mail address registered in our system to info@cndenetim.com.tr. Applications are concluded free of charge within thirty days at the latest.

For further details you may review our Personal Data Protection Policy (KVKK).