Privacy Notice (KVKK)

This notice is provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and the related Communiqué on the duty to inform, by the data controller operating the ImmanityWeb platform (“ImmanityWeb”, “we”).

You can reach the data controller and exercise your rights through the channels listed under “How to apply”.

This notice covers the personal data of people who visit the immanityweb.com website, write to us through the contact form or live support, complete the purchase and setup steps, or sign in to the management panel or the ImmanityApp and ImmanityDesk business apps.

For data collected from visitors and customers on websites that businesses build with ImmanityWeb (such as reservations, orders, memberships and inquiries), the business concerned is the data controller. ImmanityWeb acts as a data processor for that data, on the business's behalf and on its instructions. Information about that data is given in the business's own notices, and you should first exercise your rights with that business.

Identity: first and last name; the title or role of the business representative who signs an agreement.

Contact: e-mail address, phone number, business name, business and billing address.

Customer transactions: the chosen plan, template and modules, subscription and invoice records, support requests, contact form and live support conversations.

Finance: payment amount, status and the transaction reference issued by the payment provider. Card numbers and security codes are processed only by the payment provider; we never see or store them.

Transaction security: account identifier, session data, sign-in times, IP address, browser and device information, two-step verification records, audit records of actions taken in the panel, and agreement acceptance records (who accepted, when, from which IP address). We do not store your password in plain text.

Device (business app): device model and the device name you set, the push notification token needed to send notifications, and the app version. The camera is used only to scan the pairing QR code; images are not recorded or sent to our servers. Location, contacts, microphone and photo library data are not accessed.

Images and content: images you upload and text you write in the panel. Location and device metadata (EXIF) in images is stripped on the server.

Marketing: your consent to commercial electronic messages, only if you have given it. We do not ask for special categories of personal data (such as health or biometric data); please do not share them in forms or support conversations.

Data is collected electronically, by fully or partly automated means, through the forms on our website, the live support window, the purchase and setup pages, the management panel, the business apps, support correspondence by e-mail and notifications from payment providers.

Entering into and performing the subscription agreement; providing the website, panel and apps, setup, billing and support: KVKK Art. 5(2)(c) (necessary for the conclusion or performance of a contract).

Replying to questions you send through the contact form or live support: KVKK Art. 5(2)(c) (pre-contractual steps) and Art. 5(2)(f) (legitimate interest).

Obligations under tax, commercial and e-commerce legislation, record-keeping duties under Law No. 5651 and requests from competent authorities: KVKK Art. 5(2)(ç) (legal obligation).

Account and system security, preventing abuse, fraud, spam and automated (bot) traffic, monitoring availability and fixing errors: KVKK Art. 5(2)(f) (legitimate interest, provided your fundamental rights and freedoms are not harmed).

Keeping agreement acceptance and audit records as evidence in a possible dispute: KVKK Art. 5(2)(e) (establishing, exercising or defending a right).

Commercial electronic messages such as campaigns and product news: only with your explicit consent under KVKK Art. 5(1). You can withdraw your consent at any time. Invoice, security and service notices are not marketing messages.

When you choose to generate text or images with AI in the panel, your request and the relevant content of your business (such as the business name and product or service details) are sent to the AI service provider solely to produce the response. Questions asked in the live support window on our website are processed the same way; please do not type personal data into that window.

Within Türkiye: to competent public authorities and courts (as required by law), to the payment provider in Türkiye (PayTR) and to the people who provide our accounting services, in line with Article 8 of the KVKK.

Outside Türkiye: we use providers established abroad for the technical infrastructure of the service. Cloudflare (content delivery, attack and bot protection, file storage, routing of incoming e-mail, image generation), Google (account authentication and notifications through Firebase, AI features through Gemini), e-mail delivery providers (Resend, Mailjet, Brevo) and Stripe for payments made from abroad.

International transfers are made in line with Article 9 of the KVKK, either by putting in place an appropriate safeguard such as the standard contractual clauses announced by the Board, or on one of the exceptional grounds in Article 9(6), in particular where the transfer is necessary to perform our contract with you.

Your personal data is never sold or shared with third parties for advertising.

Account, business and agreement acceptance records are kept for as long as the subscription is active; after it ends they are permanently deleted at the end of the export window announced in the panel and by e-mail.

Invoice and accounting records are kept for the period required by tax and commercial law (up to 10 years).

Sign-in, access and action audit records are kept for 2 years, logs of e-mail notifications we sent for about 13 months, and raw notification payloads from payment providers for 6 months.

Contact form and live support conversations are kept for as long as your request requires. Backups are kept for up to 12 months; deleted data drops out of backups at the end of that period.

Data whose retention period has expired is deleted, destroyed or anonymised in accordance with the Turkish regulation on the deletion, destruction or anonymisation of personal data.

You have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of processing and whether it is used accordingly; and to know the third parties in Türkiye or abroad to whom it is transferred.

You can ask for your data to be corrected if it is incomplete or inaccurate, to be deleted or destroyed under the conditions of Article 7 of the KVKK, and for these actions to be notified to third parties to whom the data was transferred.

You can object to an outcome against you that arises from analysing your data exclusively through automated systems, and claim compensation if you suffer damage because of unlawful processing.

Panel users can also download the business's records from the “Data export” page in the panel.

You can send your request in writing to [email protected] (if possible from the e-mail address registered with us), together with information that lets us verify your identity, in line with the Communiqué on the procedures for applying to the data controller.

Requests are concluded free of charge within 30 days at the latest, depending on their nature; if the action involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your request is rejected, you find our reply insufficient or we do not reply in time, you can file a complaint with the Board.