Legal
KVKK Privacy Notice
Last updated: 2 November 2026
Draft: this text is not final until it has been reviewed by a lawyer.
Note for the legal review
DRAFT. This text must not be published before a lawyer reviews it. The Turkish version is the reference text. Fill in the company name, address, trade-registry (MERSİS) and tax details, the registered email (KEP) address, the names and locations of the hosting and email providers, the retention period for server logs, and the legal basis for transfers abroad (KVKK Art. 9); also settle, together with the licence and data processing agreements, that product data stays on the clinics' own servers and what our role is when we connect for support. For the demo and partner forms (section 11): the forms' consent box (“I have read the notice and agree …”) bundles the notice with consent, while section 11 names Art. 5/2-c and 5/2-f as the legal bases, so decide whether it should be a separate explicit consent or only an acknowledgement; the server that runs the forms and the info@ mailbox is a Hostinger VPS, so name its data-centre country and the Art. 9 basis; and set the dates until which closed demo logins stay in the demo clinic's user list, activity log and backups.
As Avlu Soft (the “Company”), we explain under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) how we process the personal data of people who visit our website (avlusoft.com) and contact us with a demo, offer or information request.
1. Data controller
Avlu Soft, İstanbul, Türkiye. Email: info@avlusoft.com.
2. Scope of this notice
This notice covers website visitors and clinic representatives who contact us.
It does not cover the patient data of our client clinics. That data stays on each clinic's own server and the clinic is the data controller; when we connect for support, we act under the data processing agreement signed with the clinic.
3. Personal data we process
- Identity: first name and surname.
- Contact: phone (WhatsApp) number, email address.
- Professional: the clinic you work for, its team size and the app you are interested in.
- Request: the content of your message and your preferred meeting time.
- Security: technical logs of the server that delivers the site (IP address, browser details, time of access).
4. Purposes
- To answer your demo, offer and information requests and to schedule meetings.
- To hold pre-contract discussions and prepare offers.
- To keep the website secure and prevent misuse.
- To meet our legal obligations and respond to requests from competent authorities.
5. Legal bases
We process your personal data on the legal bases in KVKK Art. 5/2-c (directly related to entering into a contract), Art. 5/2-ç (compliance with our legal obligations) and Art. 5/2-f (our legitimate interest, provided it does not harm your fundamental rights and freedoms, for example site security).
6. Transfers
We do not sell your personal data or share it with third parties for marketing.
Because the site loads fonts from Google Fonts, your IP address and browser details are sent to Google LLC (abroad).
Your data may be transferred only to the website's hosting provider and our email provider, to the extent the service requires, and to competent public authorities where the law requires it.
If you choose to write to us on WhatsApp, your message is processed on servers abroad by Meta Platforms, which provides the WhatsApp service. These transfers abroad (Google and Meta) rely on [standard contract / occasional transfer — to be confirmed by counsel] under KVKK Art. 9. If you prefer no transfer abroad, you can reach us by email.
7. How we collect data
We collect your data partly by automated means: through the demo and partner forms on this site, which send your details to our own server (section 11); through the email messages (or, once our WhatsApp number is published, the WhatsApp messages) that a form prepares in your browser when sending from the page is not possible and that you send; and through messages you write to us directly. Server logs are collected by automated means.
8. Retention
Demo and offer requests are kept for up to 2 years after our last contact; server logs for up to 90 days. If a contract is signed, the periods in the applicable law apply. When the period ends, the data is erased, destroyed or anonymised.
9. Your rights (KVKK Art. 11)
By applying to us, you have the right to:
- learn whether your personal data is processed;
- request information about it if it is;
- learn the purpose of processing and whether the data is used for that purpose;
- know the third parties in Türkiye or abroad to whom it is transferred;
- ask for it to be corrected if it is incomplete or wrong;
- ask for it to be erased or destroyed under the conditions of KVKK Art. 7;
- ask for corrections, erasure or destruction to be notified to the third parties who received the data;
- object to a result against you that arises solely from automated analysis;
- claim compensation if you suffer damage from unlawful processing.
10. How to apply
You can send your request in writing to info@avlusoft.com or to İstanbul, Türkiye. We answer free of charge within 30 days at the latest, in line with the Communiqué on the Procedures and Principles of Applications to the Data Controller. If the request causes an additional cost, the fee set by the Personal Data Protection Board may apply.
11. Demo and partner requests sent with the forms on this site
This section applies when you send the demo form (Demo page) or the partner form (Partner programme page) from this site. For these requests it takes precedence over the sections above where they differ.
What we keep: what you write in the form (your name; your clinic, or your company and role; your email address; your phone or WhatsApp number; your country and city; the app you are interested in, your team size and a time that suits you; how you know clinics), the language of the page, that you ticked the KVKK box, and the time. For a demo request we also create a personal login to our demo clinic, which runs on fictional data only: its user name is your email address, and its password is sent only to you by email; we do not keep it. We do not keep your IP address with the request: we use it only for a short time, in memory, to limit repeated requests.
Why: to email you your demo login or the partner programme summary, to answer your request and arrange a call, and to prevent misuse of the forms. Legal bases: KVKK Art. 5/2-c (steps taken at your request before a contract) and Art. 5/2-f (our legitimate interest in preventing misuse).
Where: on our own server, which runs the forms of this site and our demo [provider and data-centre location to be added before launch]. The emails go from that server to your email provider; a copy of each request reaches our mailbox at info@avlusoft.com [mailbox provider and its location to be added before launch].
How long: each request is kept for 12 months and then anonymised: your name, your clinic or company, your email address, your phone number and what you wrote are removed; the date, the app, the team size, the language of the page and the internal number and status of your demo login remain. Your demo login is deactivated 14 days after we send it (a new request opens it again for 14 days). A deactivated login is not erased: its user name (your email address) stays in the demo clinic's user list until [date to be set before launch], or until you ask us to remove it, and in the demo clinic's activity log and backups until [date to be set before launch]. Once a year we go through our mailbox and delete by hand the copies of requests that are more than 12 months old.
Your rights in section 9 apply. To learn what we hold about you, to have your request erased, or to have your demo login closed earlier or its email address removed from the demo clinic's user list, write to info@avlusoft.com.
Questions: info@avlusoft.com