Privacy Notice On The Protection And Processing Of Personal Data
Effective Date: 26.08.2026
Last Updated: 26.08.2026
Version: 1
This is an English translation provided for convenience only. In the event of any discrepancy between this translation and the Turkish original, the Turkish text prevails.
1. Data Controller
Pursuant to Law No. 6698 on the Protection of Personal Data (the "KVKK"), your personal data is processed by SAME YAZILIM VE DANIŞMANLIK ANONİM ŞİRKETİ ("SameUp" or the "Company"), acting in the capacity of data controller, within the scope described below.
| Field | Details |
|---|---|
| Trade name | SAME YAZILIM VE DANIŞMANLIK ANONİM ŞİRKETİ |
| Address | Kazlıçeşme Mah. 245. Sk. No: 5 Zeytinburnu / İstanbul, Türkiye |
| MERSİS / Tax No | 7420983795 (Tax No) |
| Registered electronic mail (KEP) | [email protected] |
| [email protected] | |
| Website | sameup.co |
2. Scope of This Privacy Notice
This Privacy Notice covers the processing of personal data relating to visitors to the Site, persons submitting contact or proposal requests, newsletter and content subscribers, natural-person representatives of customers and business partners, and candidates applying for a position at SameUp. The scope of processing varies according to the nature of the relationship between the data subject and SameUp.
For detailed information on processing carried out through cookies and similar technologies, please review the "Cookie Policy and Cookie Privacy Notice" published on the Site. This Privacy Notice is not an explicit consent form or a commercial electronic message consent form. Where explicit consent or commercial electronic message consent is required, the necessary declarations are obtained separately.
3. Processing Activities by Data Subject Category
3.1. Site Visitors
| Categories of personal data | Purposes of processing | Legal bases |
|---|---|---|
| Transaction security data: IP address, cookie or session identifier, device, browser and operating system information, connection and security logs · Usage data: pages visited, date and duration of visit, traffic source, click and navigation activity · Preference and marketing data: language, display and cookie preferences; where explicit consent has been given, analytics and advertising identifiers | Operating the Site; ensuring information and network security; detecting technical errors, misuse and unauthorised access; recording user preferences; where explicit consent exists, analysing Site usage and performance, improving content, and carrying out marketing and advertising activities | For the operation and security of the Site and services requested by the user, KVKK Art. 5(2)(c) and/or Art. 5(2)(f), depending on the specific processing activity · For non-essential analytics, preference and marketing cookies, explicit consent under KVKK Art. 5(1) |
3.2. Persons Submitting Contact or Proposal Requests
| Categories of personal data | Purposes of processing | Legal bases |
|---|---|---|
| Identity data: first name, surname · Contact data: e-mail address, telephone number · Professional information: employer, title and role · Request and customer transaction data: subject of the request, proposal, pricing, correspondence and meeting records; other information submitted by the data subject for the assessment of the request | Receiving and responding to requests, questions and complaints; communicating with the data subject, identifying needs; providing information about SameUp's services; preparing proposals; conducting pre-contractual processes; ensuring the security of correspondence and transactions; protecting rights in the event of a dispute | For a contract envisaged with the natural person submitting the request, KVKK Art. 5(2)(c) · For representatives acting on behalf of a legal entity and for corporate communication processes, KVKK Art. 5(2)(f) · For records necessary for the establishment, exercise or protection of a right, KVKK Art. 5(2)(e) |
In the free-text fields of contact and proposal forms, please do not share personal data unrelated to your request, and in particular do not share special categories of personal data such as health or biometric data.
3.3. Newsletter and Content Subscribers
| Categories of personal data | Purposes of processing | Legal bases |
|---|---|---|
| Contact data: first name, surname and e-mail address · Marketing data: subscription and opt-out records; depending on the technical features of the system used, message open, link click and interaction records | Sending newsletters, announcements and content; managing subscription and opt-out preferences; ensuring delivery security; and, where explicit consent has been given, measuring delivery and interaction performance | For the data subject's newsletter request and the delivery process, explicit consent under KVKK Art. 5(1) and/or KVKK Art. 5(2)(c), depending on the specific processing activity · For retaining opt-out records and fulfilling legal obligations, KVKK Art. 5(2)(ç) and Art. 5(2)(e) |
Where commercial electronic messages are to be sent, the required consent is separately obtained in accordance with Law No. 6563 on the Regulation of Electronic Commerce and related legislation. Explicit consent under the KVKK and commercial electronic message consent are separate legal acts.
3.4. Representatives of Customers and Business Partners
| Categories of personal data | Purposes of processing | Legal bases |
|---|---|---|
| Identity and contact data; title, role, signature and authorisation details; customer transaction data; proposal, contract, project and service records; invoice, payment and financial information; electronic correspondence and meeting records; legal proceedings and dispute records | Establishing and managing customer, supplier and business partner relationships; carrying out contract, project and service processes; verifying authorised persons; conducting proposal, order, delivery, invoicing, payment and accounting processes; information security; audit and reporting; fulfilling legal and financial obligations; establishing and protecting rights | For transactions directly related to the conclusion or performance of a contract, KVKK Art. 5(2)(c) · For obligations under tax, commercial and other legislation, KVKK Art. 5(2)(a) and Art. 5(2)(ç) · For managing the corporate relationship and its security, KVKK Art. 5(2)(f) · For disputes and legal proceedings, KVKK Art. 5(2)(e) |
3.5. Job Applicants
| Categories of personal data | Purposes of processing | Legal bases |
|---|---|---|
| Identity and contact data; education, professional experience, language, certification and competency information contained in the CV; application and interview records; reference information; photographs and other information submitted at the candidate's discretion | Receiving and assessing job applications; communicating with the candidate; assessing the fit of education, experience and competencies with the position; conducting interview and recruitment processes; retaining application records and evidence relating to potential disputes | For processes aimed at the conclusion of an employment contract, KVKK Art. 5(2)(c) · For managing the recruitment process, KVKK Art. 5(2)(f) · For the establishment, exercise or protection of rights in potential disputes, KVKK Art. 5(2)(e) |
SameUp does not request special categories of personal data from candidates unless necessary for recruitment. Please do not include in your CV or application attachments any special categories of personal data unrelated to the assessment of the position, such as health, biometric data, religion, sect, association or trade union membership, or criminal convictions. Special categories of personal data may only be processed where an appropriate processing condition set out in Article 6 of the KVKK exists and the necessary technical and administrative measures have been taken.
4. Methods and Sources of Collection
Your personal data may be obtained directly from you, from the organisation you represent or work for, or from corporate sources lawfully made public. Data is collected through forms on the Site, cookies and similar technologies, e-mail correspondence, telephone and online meetings, social media channels, CVs and application documents, records created within the scope of contracts and commercial relationships, and other written and electronic media, by wholly or partly automated means or by non-automated means provided that it forms part of a data filing system.
Where publicly disclosed contact information is used, processing is carried out in connection with, and limited to, the purpose for which the data subject made the information public.
5. Transfer of Personal Data
Your personal data may be transferred to the following recipient groups, limited to the purposes described above and in accordance with the conditions set out in Article 8 of the KVKK:
| Recipient group | Purposes of transfer |
|---|---|
| Providers of IT infrastructure, hosting, cloud, data backup, e-mail, communication, CRM, security and support services | Operating information systems, data storage and backup, communication, customer relationship management, technical support and ensuring information security |
| Providers of analytics, cookie management, advertising and marketing services | Where the required legal basis exists, measuring Site usage, managing preferences and carrying out marketing activities |
| Law firms, certified public accountants, independent auditors and other professional advisers | Legal support, accounting, tax, audit, reporting and protection of rights |
| Banks and payment service providers | Carrying out payment, collection, refund and financial transactions |
| Competent public authorities and judicial and administrative bodies | Fulfilling statutory obligations and responding to duly made official requests |
| Customers, suppliers and business partners | Carrying out contract, project, service, delivery and cooperation processes; communicating with the relevant representatives |
Where personal data is transferred to a data controller or data processor located abroad, or is made accessible from abroad by such persons, the transfer is carried out in accordance with Article 9 of the KVKK and the relevant secondary legislation. Prior to the transfer, in addition to the existence of one of the processing conditions set out in Article 5 or, where applicable, Article 6 of the KVKK for the relevant data, an applicable mechanism is established from among an adequacy decision, appropriate safeguards, or the exceptional transfer situations provided for under the Law.
SameUp may obtain IT infrastructure, hosting, data backup, e-mail and office applications, customer relationship management, analytics, advertising and marketing services from providers located abroad. In this context, your personal data may be transferred abroad or made accessible from abroad by such providers, limited to the purposes described above.
To request detailed information on the providers to which transfers are made, the categories of data transferred, the recipient countries and the mechanism relied upon for each transfer, you may contact the Company using the methods set out in Section 7 of this Privacy Notice.
For provider-level and cookie-level details of transfers carried out through cookies, please review the Cookie Policy published on the Site.
6. Retention and Disposal of Personal Data
Your personal data is retained taking into account the period necessary for the purpose of processing, the retention periods prescribed by applicable legislation, the continuation of the contract and business relationship, and applicable limitation and prescription periods. Where more than one retention criterion applies, the longest period necessary for the fulfilment of legal obligations and the protection of rights applies.
Once the purpose of processing and the legal grounds requiring retention cease to exist, personal data is deleted, destroyed or anonymised in accordance with Article 7 of the KVKK and the relevant secondary legislation. Cookie retention periods are shown in the cookie declaration table in the Cookie Policy.
7. Your Rights as a Data Subject and How to Apply
You may submit requests relating to your rights set out in Article 11 of the KVKK to SameUp in accordance with Article 13 of the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller.
Pursuant to Article 11 of the KVKK, by applying to the Company you have the right to: I. learn whether your personal data is processed, II. request information if it has been processed, III. learn the purpose of processing and whether the data is used in accordance with that purpose, IV. know the third parties to whom the data is transferred in Türkiye or abroad, V. request rectification if the data has been processed incompletely or inaccurately, VI. request erasure or destruction within the conditions set out in Article 7 of the KVKK, VII. request that the actions taken under paragraphs (V) and (VI) be notified to third parties to whom the data has been transferred, VIII. object to a result to your detriment arising from analysis carried out exclusively by automated systems, and IX. claim compensation for damage suffered as a result of unlawful processing.
To make your application easier, you may use the "Data Subject Application Form" published on the Site. Use of this form is not mandatory; applications containing the mandatory elements set out in the Communiqué are also taken into consideration.
You may submit your application by one of the following methods:
In writing: in person, by post or through a notary public, to the address Kazlıçeşme Mah. 245. Sk. No: 5 Zeytinburnu / İstanbul, Türkiye, enclosing documents evidencing your identity,
By registered electronic mail (KEP): to [email protected],
Using a secure electronic signature or mobile signature: to [email protected],
Using the electronic mail address you have previously notified to the Company and which is registered in our systems: to [email protected],
Through software or an application developed for application purposes, if available.
Your application must include your first name and surname; your signature in the case of written applications; your Turkish Republic identity number for Turkish citizens, or your nationality and passport number or identity number, if any, for foreign nationals; your address for service; your e-mail address and contact details for notification, if any; the subject of your request; and information and documents supporting your request. SameUp may request additional identity-verification information, proportionate to the nature of the request, in order to conclude the application securely. Where the application is made, or the response is received, through an authorised representative, a document evidencing the authority to represent (power of attorney, letter of consent, etc.) must be submitted.
Your application will be concluded as soon as possible and in any event within 30 days, free of charge as a rule, depending on the nature of your request. Where the process entails an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.
If your application is rejected, the response you receive is found insufficient, or no response is provided within the applicable period, you may lodge a complaint with the Personal Data Protection Board within 30 days from the date you learn of the response and in any event within 60 days from the date of application.
8. Updates
This Privacy Notice may be updated in line with changes in legislation, decisions of the Personal Data Protection Board, or changes in SameUp's personal data processing operations. The current text is published on the Site; the effective date and last update date are shown at the beginning of the text.