Privacy Policy

1. Introduction

This Privacy Policy (the “Policy”) sets out the principles and procedures regarding the personal data processed during the use of the karakod.io website (the “Website”) operated by HLL Karakod Yazılım Geliştirme Eğitim ve Teknoloji Danışmanlığı Limited Şirketi (hereinafter briefly referred to as “Karakod” or the “Company”), operating within Ankara University Technopolis, and during the use of the artificial intelligence, blockchain technologies, and software solutions offered by Karakod.

As Karakod, we are not merely a software provider but a technology partner that has adopted the “Privacy by Design” principle. With this awareness, we regard full compliance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the related secondary regulations, as well as international data protection standards (GDPR, etc.), as part of our corporate culture.

2. Who We Are

The details of our Company, which holds the title of “Data Controller” under the KVKK, are as follows:

3. Our Commitment and Approach

The privacy, integrity, and security of the data you share while visiting our website or benefiting from the artificial intelligence, blockchain technologies, and all other software solutions we offer are our priority. Karakod has built its technological infrastructure within the framework of the highest cybersecurity standards.

With this Policy, we aim to provide transparent information about the purposes for which your personal data are processed, to whom they may be transferred, our collection methods, and the rights you hold as a data subject.

4. Distinction Between Visitors and Users

The scope of the information we collect and our processing purposes vary depending on the nature of your interaction with the Website:

• Visitor: Users who visit the website solely for informational purposes without signing in (limited technical data and cookies).
• User/Customer: Persons who license Karakod software solutions, request a demo, or subscribe to our newsletter (identity, contact, and transaction security data).

5. Categories of Personal Data Processed and Collection Methods

Within the scope of providing the Website and its artificial intelligence, blockchain technologies, and all other software services, Karakod collects the following data either directly from you (through forms) or through automated methods (cookies and server logs):

5.1. Data Provided Directly by the User

These data categories cover the data submitted to us during account creation, demo requests, or the completion of contact forms:

• Identity Information: Name, surname, Turkish ID number (where legally required), signature (in corporate authorization processes).
• Contact Information: E-mail address, phone number, corporate address, LinkedIn profile, or social media usernames.
• Professional Experience Data: Information about the institution/company you work for, title, area of expertise (for the personalization of services and corporate licensing processes).
• Request and Complaint Management: Feedback, support requests, and business-specific technical or legal details — shared at your own discretion — that you provide through the channels you use to reach us (e-mail, live support, etc.).

5.2. Technical Data Collected Through Automated Methods

During your use of the Website, the following data are automatically recorded by our systems for the purposes of improving the experience, establishing cybersecurity, and analysis:

• Transaction Security and Device Information: IP address, device type (PC/Mobile), operating system and version, browser type and language settings, screen resolution, network type, time zone settings, and device identifiers (UUID).
• Usage and Interaction Data: Your navigation activity on the Website (clickstream), pages visited, links clicked, time spent on pages, search queries, and error logs (log records).
• Location Data: Approximate location information derived from your IP address (at city/country level). Your device's GPS-based precise location data are not processed unless you give your explicit consent.

5.3. Cross-Device Matching

If you sign in from more than one device (for example, both a mobile phone and a desktop computer), your profile information may be analyzed to identify your interaction across devices, in order to ensure service continuity and carry out security verifications.

Important: Distinction Between Data Controller and Data Processor

This Policy covers only the data of Website visitors and of individuals who communicate directly with our Company. With respect to the personal data uploaded to or processed within the relevant platform by our corporate customers who license Karakod's artificial intelligence, blockchain technologies, and other software solutions (SaaS) within the scope of their own operations;

• The Corporate Customer holds the title of "Data Controller,"
• Karakod holds the title of "Data Processor."

The processing procedures for such data uploaded to the Karakod infrastructure by our customers fall outside the scope of this Policy and are subject to the provisions of the "User Agreement" concluded between the parties and the "Data Processing Agreement" (DPA), which forms an integral part of that agreement. Karakod undertakes to process such data solely in accordance with the Customer's instructions and within the limits of the agreement.

6. Data Categories, Processing Purposes, and Legal Grounds

As Karakod, we process your personal data based on the legal grounds set out in Article 5 of the KVKK and for the limited purposes stated below.

6.1. Data of Corporate Customer / Business Partner Representatives and Employees

These are data belonging to the representatives of our legal entity customers or business partners within the scope of our corporate collaborations.

• Data Processed: Name and surname, Turkish ID/Foreign ID/Passport number, signature circulars, power of attorney details, MERSİS number.
• Processing Purposes: Management of contract processes, verification of signing authority, notification obligations to official authorities, risk management, and ensuring business continuity.
• Legal Grounds: Establishment or performance of a contract (KVKK Art. 5/2-c), legal obligation of the data controller (Art. 5/2-ç), and legitimate interest (Art. 5/2-f).

6.2. Contact and Operational Data

These are data processed in order to communicate with you effectively and to deliver our services.

• Data Processed: E-mail address, mobile/work phone, corporate address, country/city of residence, workplace title.
• Processing Purposes: Sales of goods/services and after-sales support processes, execution of finance and accounting operations, customer satisfaction activities.
• Legal Grounds: Establishment or performance of a contract (Art. 5/2-c) and our legitimate interests, provided that fundamental rights are not harmed (Art. 5/2-f).

6.3. Legal Transaction and Compliance Data

Given that Karakod is a platform concerned with artificial intelligence, blockchain technology, and other software, these data are of critical importance for regulatory compliance and the management of potential disputes.

• Data Processed: Application records within the artificial intelligence, blockchain technology, and all other software.
• Processing Purposes: Follow-up of legal affairs, provision of information to authorized institutions and organizations (BTK, KVKK Authority, judicial authorities, etc.), auditing of regulatory compliance processes.
• Legal Grounds: Processing being necessary for the establishment, exercise, or protection of a right (Art. 5/2-e) and legal obligation (Art. 5/2-ç).

6.4. Data Collected via Third Parties and Social Networks

When you choose to sign in to the Website via social networks (Google, LinkedIn, etc.);

• Your publicly available profile information, username, and access tokens shared through the relevant third party's platform are transferred to our system.
• Important Note: The scope of these data is limited to the permissions you have granted in the privacy settings of the relevant social network platform. Karakod cannot be held responsible for the data collection policies of these platforms.

6.5. Information Obtained from Other Sources and Publicly Available Data

Limited data may be collected through advertisers, business partners, or publicly available sources (Trade Registry Gazette, LinkedIn, etc.) for the purposes of improving our services, performing corporate identity verification, and preventing fraud.

7. Purposes of Processing Personal Data

Karakod processes the personal data it collects along the fundamental axes stated below, in order to ensure the sustainability of the artificial intelligence, blockchain technologies, and all other software solutions it offers, to fulfill its legal obligations, and to optimize the user experience:

7.1. Operational Processes and Service Delivery

• Service Performance: Operating the Website and Karakod's blockchain and artificial intelligence technologies and all other software solutions with full functionality, and managing membership and licensing processes.
• Support and Communication: Responding to your technical support requests, delivering service updates, system notifications, and user guides.
• Personalization: Ensuring that the Website content is presented in the most suitable and effective way for you and the technical characteristics of your device.

7.2. Security and Risk Management

• System Security: Protecting the Website and user data against cyberattacks, unauthorized access, and fraud.
• Audit and Compliance: Carrying out regulatory compliance activities, keeping records to serve as evidence in legal disputes, and responding to information requests from official authorities.

7.3. Business Development and Analytics

• Usage Analysis: Analyzing how you use the Website through your devices with anonymized or aggregated data, in order to improve product features and develop new modules.
• Efficiency Measurement: Monitoring the performance of the services provided and building business strategies based on user segmentation.

7.4. Marketing and Advertising Activities

• Personalized Content: Provided that you have given your consent in accordance with the applicable legislation, delivering newsletters, special offers, and industry developments that may interest you.
• Advertising Optimization: Displaying promotions and advertisements that may interest you, based on your experience on the Website.

8. Data Retention Periods and Destruction

Karakod retains your personal data for the period required by the processing purposes or within the legal periods stipulated by the applicable legislation (statutes of limitations, etc.).

• Account Information: Retained for as long as your membership relationship continues. If you close your account, the data are deleted, destroyed, or anonymized in the first destruction period following the expiry of the periods required by our legal obligations (e.g., Law No. 5651 or the Tax Procedure Law).
• Technical Note: The complete removal of information from backups and cached systems may take additional time due to system security protocols.

9. Rights of the Data Subject and Application Procedure

Pursuant to Article 11 of the KVKK, you have rights such as learning whether your personal data are being processed, requesting information if they have been processed, requesting the correction of incomplete or inaccurate processing, and requesting deletion.

You may submit your requests to our Company through the following methods, in accordance with the Communiqué on the Principles and Procedures for Applications to the Data Controller:

• Written Application: By delivering a wet-signed petition, together with documents verifying your identity, in person or through a notary to our Company headquarters at "Bahçelievler Mah. Doktor Cevdet Kara Cad. E Blok No: 35e İç Kapı No: B22 Gölbaşı / ANKARA."
• Electronic Application: By sending your request to info@karakod.net using the e-mail address you have previously provided to our Company and which is registered in our system. (If you are writing from an address other than your registered e-mail, the use of a secure electronic signature or mobile signature is mandatory under the Communiqué.)

Your requests will be concluded free of charge as soon as possible depending on their nature and at the latest within thirty (30) days. However, if the process requires an additional cost, the fee set out in the tariff determined by the Turkish Personal Data Protection Board may be applied.

10. Policy Updates

Karakod may update this Privacy Policy at any time in line with evolving technological conditions, newly offered services, or changing regulatory requirements. Updates take effect as soon as they are published on the Website. We recommend that our users periodically check the "Last Updated" date.