KVKK Privacy Notice

الإصدار 2 · تاريخ السريان: ٢٧ سبتمبر ٢٠٢٦

هذه ترجمة؛ وعند التعارض يُعتمد النص التركي.

Version 2 · Effective date: 27 September 2026

This notice is provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains the personal data that Noniux, the provider of EVOS, processes on its own behalf and for its own purposes.

1. Data controller

Legal name: Noniux ("Noniux")
E-mail: info@noniux.com

Other business details are provided by e-mail on request.

2. What this notice covers and what it does not

This notice covers processing for which Noniux is the data controller:

visitors of the evos.noniux.com website,
prospective customers who contact us via WhatsApp or e-mail,
representatives and billing contacts of customer companies that buy EVOS,
Noniux platform administrator accounts,
login and security records of EVOS users,
subscription and payment records.

This notice does not cover the data that customer companies enter into their own EVOS workspace. For data about visitors, buyer delegation members, participants, institutional contacts, employees and other persons that a customer company records in EVOS, the data controller is that customer company. For that data, Noniux is only a data processor acting on the customer's instructions, under the Data Processing Agreement. The obligation to inform you about that data, and any request you make about it, belongs to the customer company. If such a request reaches Noniux, we forward it to the relevant customer company without delay.

3. Personal data we process

3.1 Website visitors

Transaction security data: IP address, browser and device information, the requested page and the time of the request. These records may arise technically at the server and network layer; they are used only for security and troubleshooting and are kept under the general rule in section 7.
Preference data: the language cookie written to your browser when you choose a language. Details: Privacy and Cookie Policy.

What you type into the assistant: questions you type into the EVOS assistant on the website. They are sent to the AI service provider to generate an answer and are not stored by Noniux.

The website has no forms, advertising, analytics or tracking tools.

3.2 Prospective customers

When you start a WhatsApp conversation through the links on the website, or send us an e-mail:

Identity: first name, last name.
Contact: phone number, e-mail address.
Customer transaction: company name, your position, message content, meeting notes, the offer made to you.

3.3 Customer company representatives and billing contacts

Identity: first name, last name; where required for invoicing, Turkish identity number (tax number for companies).
Contact: e-mail address, mobile phone, billing address, city, postal code.
Customer transaction: company name, chosen plan, subscription period and status, payment links.
Legal transaction: which version of which legal document you accepted, when and at which step; the IP address and browser information at the time of acceptance.
Account routing: the match between an EVOS user's e-mail address and their company (used to find the right company when you sign in at a single address).

3.4 Noniux platform administrators

Identity and contact: first name, last name, e-mail address.
Transaction security: a one-way hash of the password, the two-factor authentication secret (stored encrypted), last sign-in time, sign-in attempts and a log of administrative actions (including IP address).

Transaction security: the e-mail address used in a sign-in attempt, the result and reason of the attempt, IP address, browser information, time, user and company identifiers; whether two-factor authentication is enabled.
Session: the user identifier, company, role, name and e-mail carried in the session cookie.

3.6 Subscription and payment records

Finance: amount, currency, payment status and date, subscription period, the payment institution's reference codes.

Your card details never reach Noniux. Card details are entered directly into iyzico's form on the payment page and are processed by iyzico.

Noniux does not process special categories of personal data in the processing covered by this notice.

4. Purposes and legal grounds

Each purpose relies on one of the legal grounds in KVKK Article 5(2):

Responding to your enquiry, preparing an offer, concluding the contract: directly related to concluding a contract (Art. 5(2)(c)).
Opening the account, providing the service, running the subscription and payment, providing support, routing users to the right company: performance of the contract (Art. 5(2)(c)).
Issuing invoices, keeping accounting and tax records, responding to authorised authorities: compliance with a legal obligation (Art. 5(2)(ç)).
Ensuring data security (login lockout, two-factor authentication, session management, audit log): the data security obligation in KVKK Article 12 (Art. 5(2)(ç)) and our legitimate interest in preventing misuse of the service (Art. 5(2)(f)).
Keeping records of legal acceptances, payments and administrative actions: establishing, exercising or protecting a right in a possible dispute (Art. 5(2)(e)).
Keeping the website secure and working, remembering the language you chose: our legitimate interest (Art. 5(2)(f)); the language cookie is only written when you choose a language.
Answering your questions about the product with the EVOS assistant and preventing misuse of the assistant: our legitimate interest (Art. 5(2)(f)); using the assistant is optional.

The processing covered by this notice does not rely on explicit consent. If commercial electronic messages need to be sent to prospective customers, they are sent only after obtaining the approval required by Law No. 6563 and the related legislation and, where required, after registration in the Message Management System (İYS).

5. How we collect data

Directly from you: WhatsApp and e-mail conversations, company onboarding, the billing information form, the sign-in screen, legal acceptance steps.
Automatically: sign-in attempts, IP address and browser information by the server; your preferences through cookies.
From the customer company: the first administrator's details given at onboarding; e-mail addresses of users added by the company administrator.
From the payment institution: the payment result and reference codes reported by iyzico.

6. Transfers of personal data

Personal data may be transferred, limited to the purposes above, to the following recipient groups:

Hosting: Hetzner Online GmbH. The application, databases, files and backups run and are stored in Hetzner Online GmbH's data centres in the European Union.
Payment institution: iyzico (Türkiye). For subscriptions and payments, the name, surname, e-mail, phone, identity/tax number, billing address, IP address and amount are sent. iyzico is a separate data controller for its own processing under payment services legislation.
AI service provider (chosen by Noniux; e.g. Ollama): questions typed into the EVOS assistant, only to generate an answer.
Communication services: Meta's WhatsApp service when you start a WhatsApp conversation; the e-mail service provider Noniux uses, for e-mail correspondence.
Accountant and invoicing service providers: for invoicing and accounting records.
Legal advisers and auditors: to protect rights and for audits.
Authorised public institutions: where legally required.

Transfers abroad. Under KVKK Article 9, as amended by Law No. 7499, personal data may be transferred abroad if the Board has issued an adequacy decision for the destination; failing that, if an appropriate safeguard such as the standard contract announced by the Board is in place; and failing both, only on an incidental basis in the cases listed in the law. Your data is transferred abroad because of the hosting, communication and (where a cloud service is used) AI services. These transfers are made under KVKK Article 9 by concluding the standard contract announced by the Board; the standard contract is notified to the Authority within five business days of completion of the signatures.

Our source code and software images are kept on GitHub; they contain no personal data.

7. Retention periods

Personal data is kept for the period required by the relevant legislation or by the purpose of processing, and is then deleted, destroyed or anonymised (KVKK Article 7).

Invoice and payment records: 10 years (Tax Procedure Law and Turkish Commercial Code).
Legal acceptance records: for the duration of the contractual relationship and afterwards for the period set by the relevant legislation for possible disputes.
Login and security records, platform administration log: for as long as required for data security and possible disputes.
Prospective customer correspondence: for as long as required to respond to your enquiry and for the offer and contract process; if a contract is concluded, for the duration of the contractual relationship.
Backups: databases are backed up every night; backups are deleted automatically after 14 days.

8. Data security

Main measures under KVKK Article 12:

Each customer company's data is kept in a separate database.
Passwords are stored as one-way hashes.
Repeated failed sign-ins trigger a temporary lock per account and per IP address.
Two-factor authentication is optional for users and mandatory for Noniux platform administrators.
Two-factor secrets, identity numbers and integration keys are encrypted with AES-256-GCM.
Sensitive actions and administrator actions are written to an audit log.
Session cookies cannot be read by browser scripts and are sent only over secure connections.
Card details are neither collected nor stored.
Databases are backed up daily and every backup is verified.

9. Your rights

Under KVKK Article 11, you may apply to Noniux to:

learn whether your personal data is processed,
request information if it has been processed,
learn the purpose of processing and whether it is used accordingly,
know the third parties in Türkiye or abroad to whom it is transferred,
request correction if it is incomplete or inaccurate,
request deletion or destruction under the conditions of KVKK Article 7,
request that corrections, deletions and destructions be notified to the third parties to whom the data was transferred,
object to a result against you arising exclusively from analysis by automated systems,
claim compensation if you suffer damage from unlawful processing.

10. How to apply

You may send your request by e-mail to info@noniux.com, or by the other methods listed in the Communiqué on the Procedures and Principles of Application to the Data Controller:

by e-mail to info@noniux.com, preferably from the e-mail address you previously gave Noniux and that is registered in our system,
signed with a secure electronic signature or mobile signature, to info@noniux.com,
in writing with a wet signature, by post; if you request the postal address at info@noniux.com, it will be sent to you by e-mail.

Noniux may ask for additional information to the extent necessary to verify that the request comes from you.

Your request should include your name and surname, your signature for written requests, your Turkish identity number (for foreign nationals, nationality and passport or identity number), your address for notifications, your e-mail and phone if any, and the subject of your request.

We will conclude your request as soon as possible and at the latest within 30 days, free of charge. If the action requires an additional cost, a fee may be charged according to the Board's tariff. If your request is rejected, the answer is insufficient, or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your request.

Requests about your data in a customer company's EVOS workspace must be sent to that company (see section 2).

When this notice is updated, the new version is published on this page; earlier versions are kept.

In case of conflict, the Turkish version prevails.