KVKK Information Notice for CIQRA Customers (Merchants)
CIQRA OÜ · Version 1.1 · Last updated: 30 October 2026 · English reference translation of the Turkish KVKK Aydınlatma Metni; for individuals in Türkiye the Turkish text governs.
This notice is given under Article 10 of Türkiye's Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles of the Duty to Inform. It informs the representatives and staff of businesses that use or want to use CIQRA, and people who contact CIQRA, about the personal data CIQRA processes as data controller.
For the personal data of your Shoppers, you are the data controller and CIQRA is your data processor (see the Turkish Data Processing Agreement). You publish the information notice for your Shoppers yourself; CIQRA provides a template.
1. Data controller
CIQRA OÜ, a private limited company registered in Estonia, registry code 16465907, Veskiposti tn 2, 10138 Tallinn, Harju maakond, Estonia · info@ciqra.com
CIQRA is the seller and invoicing party of every CIQRA subscription, including those of customers in Türkiye. REKLAM BEŞ TANITIM VE BİLİŞİM HİZMETLERİ DANIŞMANLIK TURİZM SAN. TİC. LTD. ŞTİ. ("Reklam5") is a service provider that operates the Microsoft 365 tenant hosting CIQRA's business email; it does not sell or invoice on CIQRA's behalf and is not CIQRA's data controller representative.
2. Personal data we process
Identity and account data (name, business name, role, username, password in hashed form); contact data (email, telephone, address, country); verification data (business registration, beneficial owners, identity verification carried out by Stripe, tax identification number); subscription and transaction data (plan, invoices, platform fees, payments — full card numbers never reach CIQRA); usage and device data (logs, IP address, device and browser data, pages visited, feature use, cookie identifiers); support correspondence; marketing preferences; security events; and contract acceptance records (which version of which document you accepted and when, the user who accepted and, where it could be verified, the IP address). We do not intend to process special categories of personal data.
3. Purposes and legal grounds (KVKK Art. 5)
| Purpose | Legal ground |
|---|---|
| Providing the service; opening and managing your account | establishment or performance of a contract (Art. 5(2)(c)) |
| Billing, platform fees and payments | performance of a contract; legal obligation (Art. 5(2)(ç)) |
| Identity and business verification, fraud prevention | legal obligation; legitimate interest (Art. 5(2)(f)) |
| Information security, abuse prevention, logging and backups | legitimate interest; legal obligation |
| Support and service notices | performance of a contract; legitimate interest |
| Proof of contract acceptance | establishment, exercise or protection of a right (Art. 5(2)(e)); legitimate interest |
| Product improvement, using aggregated data where possible | legitimate interest |
| Sending you commercial electronic messages | explicit consent (Art. 5(1)) and approval under Law No. 6563, collected with a separate, optional box |
| Non-essential cookies | explicit consent; see the Cookie Policy |
| Disputes and legal compliance | legal obligation; establishment, exercise or protection of a right |
Processing needed to provide the service is never made conditional on consent; refusing consent does not affect your subscription.
4. Method of collection
Through the signup and subscription screens, the dashboard, the API, email and support channels and cookies; electronically, by automated and partly automated means.
5. Recipients
Our service providers — Microsoft Azure (hosting, Germany), Azure Communication Services (email, EU), Microsoft Azure AI Foundry (AI features, EU Data Zone in Germany and Sweden), Cloudflare (content delivery and security; global network, US parent), Google reCAPTCHA (form security), Openprovider (registration of domains bought through CIQRA, Netherlands) and Reklam5 (operator of CIQRA's business email, Türkiye); Stripe (payments, verification and payouts, largely as an independent controller; EU and US); advertising and analytics platforms only with your consent; and competent authorities, auditors and advisers where the law requires. Full list: Subprocessor List.
6. Transfers abroad
Because the CIQRA platform is hosted in the European Union (Microsoft Azure, Germany), processing data provided from Türkiye is a transfer abroad within the meaning of KVKK Art. 9. For data it processes as controller, CIQRA applies the conditions of Art. 9: an adequacy decision of the Personal Data Protection Board; failing that, an appropriate safeguard, principally the standard contract announced by the Board; failing that, one of the incidental cases in Art. 9(6). Within the EU, transfers to recipients outside the EEA are made under the EU Standard Contractual Clauses.
7. Retention
Account and store settings: for the life of the account, deleted 2 years after the store is closed; CIQRA's own accounting records: at least 7 years from the end of the financial year; security and audit logs: 2 years; application and delivery logs: 12 months; marketing consent records: while the consent is valid (a withdrawal record is kept as proof); contract acceptance records: for the contractual relationship and the limitation period after it; CIQRA's backups: up to 35 days. Details: Data Retention and Breach Notification Policy.
8. Your rights under KVKK Art. 11
To learn whether your personal data is processed; to request information about it; to learn the purpose and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction; to request erasure or destruction under the conditions of KVKK; to request that corrections and erasures be notified to those third parties; to object to an adverse result arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
9. How to apply
Use the KVKK request form or write to info@ciqra.com, or by post to the address above, stating your identity and request. Requests are answered free of charge within 30 days under the Communiqué on the Procedures and Principles of Application to the Data Controller; where the action has an additional cost, the Board's tariff may apply. If your request is rejected, you find the answer insufficient or no answer is given in time, you may complain to the Personal Data Protection Board.