Data Security and Transfers from Türkiye — FAQ

CIQRA OÜ · Version 1.1 · Last updated: 30 October 2026 · English reference translation of the Turkish Veri Güvenliği ve Aktarım SSS.

This page answers the questions businesses in Türkiye ask most often. We state separately what exists today and what is not yet complete.

Where is my data?

Your store's data is held on Microsoft Azure in Germany (Frankfurt — Germany West Central), with database backups also in Germany (Germany North). Search runs in CIQRA's own Azure environment in Germany. When you use AI features, requests are processed in the EU Data Zone: text in Germany, image generation in Sweden (Sweden Central). The small service that redirects a store's bare domain to its www address is also in Sweden.

Some providers are outside the EU or may access data from outside it: Cloudflare (global content delivery and security network; visitor IP addresses and request data pass through it), Stripe (CIQRA Pay payments; EU and US) and Reklam5 in Türkiye, which operates CIQRA's business email (support correspondence). Full list: Subprocessor List.

Is there a transfer abroad? Is it lawful under KVKK?

Yes, there is a transfer. Processing a Turkish store's Shopper data on servers in Germany is a transfer abroad under KVKK Art. 9. The servers being in the EU does not change that.

KVKK does not prohibit transfers abroad; it makes them subject to safeguards. The Personal Data Protection Board has not issued an adequacy decision for any country. For an ongoing service relationship, the route is the Board's standard contract, signed and notified to the Authority within 5 business days. Since 1 September 2024 explicit consent alone cannot be relied on for regular transfers; it is for incidental transfers.

Status today:

	Status
Data processing agreement (GDPR Art. 28, English)	In place, accepted at signup
Turkish Data Processing Agreement (with KVKK Art. 12 and Art. 9 provisions)	Prepared, awaiting publication
Board standard contract (controller to processor)	Not yet signed — the signing process is below
Notification to the Authority	Not yet made — CIQRA will notify within 5 business days of signature
CIQRA's VERBİS registration and representative in Türkiye	Not yet in place; CIQRA has determined that the obligation has arisen
EU Standard Contractual Clauses for recipients outside the EU	In place (Subprocessor List)

GDPR protection is real, but it does not replace KVKK Art. 9; the two regimes are met separately.

How is the standard contract signed?

CIQRA uses the Board's Standard Contract 2 (controller to processor) without changes. Only the fields the official text leaves to the parties and the annexes are completed: your details, the categories of data transferred, the technical and organisational measures and the sub-processors.
It is signed by your authorised signatories with a wet-ink or secure electronic signature. A click-through acceptance is not used for this contract.
CIQRA notifies the Authority within 5 business days of the last signature and sends you the notification date.
If the parties, the sub-processors or the content change, the contract is updated and notified again.
If you are registered in VERBİS, you update your own registry entry.

To start: info@ciqra.com (subject: "Standard contract").

What happens if there is a breach?

CIQRA notifies you without undue delay and within 72 hours of becoming aware of a breach affecting your store's data, in Turkish and under the headings of the Board's breach form.
As controller, you notify the Board within 72 hours of becoming aware, and the affected people as soon as reasonably possible (Board Decision 2019/10).
For breaches affecting CIQRA's own data (for example merchant accounts), CIQRA notifies the Board itself for individuals in Türkiye.
Security reports: security@ciqra.com.

Can I delete or export data?

Shopper data requests: in the dashboard, on a Shopper's page under "Personal data", you can export the Shopper's data (a JSON file and a readable report) or request erasure. Erasure runs after a waiting period, so a mistaken or fraudulent request can be stopped, and the Shopper is told by email; in financial records the person is removed and the transaction is kept for the legal period (10 years). Every request appears under "Data requests". You can also instruct us at info@ciqra.com.
Retention: contact form submissions can be kept for 6, 12, 24 or 36 months, and identity and IBAN-type numbers in forms can be masked (off by default). Some new deletion rules are being switched on in stages; until then data is kept longer, never deleted earlier.
When your subscription ends: you can export your data for 30 days. The data is then kept with restricted access and deleted 2 years after the store closes; financial records are kept for 10 years. On your written instruction it is deleted earlier. The 2-year deletion rule runs in reporting mode today: data is kept, not deleted.
Backups: kept for up to 35 days, then overwritten.

What security measures are in place?

Each store's data is separated in the database by row-level security, and automated isolation tests run before every release; TLS in transit, encryption at rest and per-tenant keys in Azure Key Vault; multi-factor authentication for privileged access; card numbers stay with Stripe (PCI DSS SAQ A). CIQRA does not hold an ISO 27001 or SOC 2 certificate, and we do not claim one.

What do I need to do towards my own Shoppers?

You are the controller: publish an information notice, collect separate approval for commercial messages and record it in İYS, answer requests within 30 days, assess your VERBİS obligation and write your own retention and destruction policy. CIQRA provides ready Turkish templates for your store — an e-commerce information notice, a cookie text, a commercial message consent text and a checkout notice line. Ask for them at info@ciqra.com.

Sources

KVKK — Transfers abroad: kvkk.gov.tr/Icerik/2053
Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, Official Gazette 10 July 2024, No. 32598 (Art. 4, 7, 14)
Standard Contract 2 official text: kvkk.gov.tr/Icerik/7931 · Notification module: standartsozlesme.kvkk.gov.tr
Board Decision 2019/10 of 24 January 2019 (breach notification): kvkk.gov.tr/Icerik/5362
CIQRA: Data Processing Agreement, Subprocessor List, Data Retention and Breach Notification, Türkiye Market Terms