Data Protection Notice

1. Identity of the data controller

For the purposes of Turkish Personal Data Protection Law No. 6698 (the "Law"), the data controller is İLGİSOFT BİLİŞİM VE DANIŞMANLIK HİZMETLERİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ, which operates the website at https://ilgierp.com and the cloud-based enterprise resource planning (ERP) service provided under the ilgiERP brand.

This notice is issued to discharge our disclosure obligation under Article 10 of the Law.

• Registered name: İLGİSOFT BİLİŞİM VE DANIŞMANLIK HİZMETLERİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ
• Address: SİLAHTAR MAHALLESİ ÇORLU YERLEŞKESİ OFİS NO:TGB12 BELDE/BUCAK SİNAN DEDE MEVKİİ ÇERKEZKÖY YOLU 3.KM. NAMIK KEMAL ÜNİVERSİTESİ ÇORLU MÜHENDİSLİK FAKÜLTESİ ÇORLU/TEKİRDAĞ/Türkiye
• MERSIS number: 0471040056700015
• Telephone: +90 282 673 56 83
• Email: info@ilgierp.com
• Registered electronic mail (KEP) address: ilgisoft@hs01.kep.tr
• For data protection requests: kvkk@ilgierp.com

2. Two distinct roles: controller and processor

The capacity in which we process personal data depends on whose data it is. This is the most important part of this notice, because it determines both who you should address a request to and how far our own obligations reach.

• We act as controller when you visit our website, submit a demo request or a partner application, contact us, or use the service on behalf of a subscribing organisation. We determine the purposes and means of processing that data, and this notice covers exactly those cases.
• We act as processor for the customer, supplier and personnel data that a subscribing organisation (the tenant) uploads to the ERP. For that data the tenant is the controller: the tenant sets the purpose and the scope, and we host and process it solely on the tenant's instructions.
• The duty to inform data subjects about tenant-uploaded data, and to answer their requests, rests with the tenant. Please direct such requests to that organisation first; where they reach us instead, we pass them on to the tenant.
• Even where we act as processor, Article 12 of the Law makes us jointly responsible with the tenant for putting data security measures in place.

3. Categories of personal data processed

As controller, we process the following categories of personal data:

• Identity: name, surname, role and job title; and, if you choose to provide it in the demo request form, your Turkish national identity number.
• Contact: email address, telephone number, company name, postal address, and country, province and district.
• Customer transaction: the content of demo requests, contact form messages and partner applications, the modules you express interest in, support requests and our replies.
• Transaction security: IP address, browser and device information, access and session records, error and performance logs, and the irreversible hash of your account password.
• Financial: billing entity, tax office and tax identification number, subscription plan and payment status. Your card details never reach us; the payment page belongs to a licensed payment institution.
• Marketing: your consent to commercial electronic messages and your communication preferences.

4. Purposes of processing

• Assessing demo and quotation requests, responding to you, and providing a trial environment.
• Assessing partner applications and running the partnership process.
• Establishing the subscription relationship, creating your account and delivering the service.
• Running invoicing and collection processes.
• Handling support requests, resolving faults and keeping the service running.
• Securing our systems and the service, and detecting unauthorised access and abuse.
• Meeting our legal obligations, in particular under tax, commercial and accounting legislation, and responding to requests from competent authorities.
• Establishing, exercising and defending our rights in the event of a dispute.
• Sending commercial electronic messages where you have given explicit consent.

5. Legal grounds

The processing described above rests on the following grounds set out in Article 5 of the Law:

• Necessity for the conclusion or performance of a contract (Art. 5/2-c): demo and quotation processes, entering into the subscription, opening an account, delivering the service, invoicing and support.
• Compliance with a legal obligation (Art. 5/2-ç): record-keeping and retention duties arising from tax, commercial and accounting legislation, and responses to competent authorities.
• Establishment, exercise or protection of a right (Art. 5/2-e): retaining records that may be needed in a dispute.
• Legitimate interest (Art. 5/2-f), provided it does not harm your fundamental rights and freedoms: securing our systems, detecting abuse, keeping system logs, and remembering your language and theme preference.
• Explicit consent (Art. 5/1): taken only for sending commercial electronic messages. If we start using any non-essential cookie or similar technology, we will ask for your explicit consent for that as well. You may withdraw consent at any time.

6. How we collect personal data

We collect your personal data through the following channels, by wholly or partly automated means:

• The demo request, contact and partner application forms on our website.
• Emails you send us and requests you make by telephone.
• Records generated automatically in our systems while you use the service.
• Cookies and browser local storage — described in detail in our Cookie Policy.
• Information and documents you provide during subscription and billing.

7. Recipients of personal data and the purpose of each transfer

We do not sell your personal data. We share only what is necessary, and only with the parties needed to deliver the service:

These transfers are made under Article 8 of the Law, relying on the legal grounds set out above.

• Our cloud infrastructure provider — to obtain hosting, backup and logging services.
• The payment institution — solely so that subscription payments can be collected; card data goes to them directly and never reaches us.
• Email and messaging infrastructure providers — so that notifications and correspondence can be delivered.
• Competent public authorities — only where legally required and limited to the scope of the request.

8. Transfers abroad

Our cloud infrastructure and some of our communication providers may be located outside Türkiye, in which case your personal data is transferred abroad.

Such transfers are made under Article 9 of the Law: on the basis of an adequacy decision published by the Turkish Personal Data Protection Board where one exists, and otherwise on one of the appropriate safeguards listed in the Law. You may ask us at kvkk@ilgierp.com which providers are used, in which country data is hosted, and which basis a transfer relies on.

9. Retention and erasure

We do not keep personal data once the purpose of processing has ceased. Data that legislation requires to be kept for a defined period — commercial books, invoices and accounting records, for example — is retained for that period and for that purpose only.

When a subscription ends, tenant data is deleted after the reasonable period allowed for data export. Data whose retention period has expired is erased, destroyed or anonymised in accordance with Article 7 of the Law and the Regulation on Erasure, Destruction or Anonymisation of Personal Data.

10. Your rights under Article 11 of the Law

By applying to us as controller, you may exercise the following rights:

• To learn whether your personal data is processed.
• To request information about it where it has been processed.
• To learn the purpose of processing and whether the data is used in line with that purpose.
• To know the third parties, in Türkiye or abroad, to whom your data is transferred.
• To request rectification where your data is incomplete or inaccurate.
• To request erasure or destruction of your data within the conditions of Article 7 of the Law.
• To request that rectification, erasure and destruction be notified to the third parties to whom your data was transferred.
• To object to an outcome to your detriment that arises from analysis of your data solely by automated systems.
• To claim compensation for damage suffered because your data was processed unlawfully.

11. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit a request in any of the following ways: a signed written application to SİLAHTAR MAHALLESİ ÇORLU YERLEŞKESİ OFİS NO:TGB12 BELDE/BUCAK SİNAN DEDE MEVKİİ ÇERKEZKÖY YOLU 3.KM. NAMIK KEMAL ÜNİVERSİTESİ ÇORLU MÜHENDİSLİK FAKÜLTESİ ÇORLU/TEKİRDAĞ/Türkiye; an application to our registered electronic mail address ilgisoft@hs01.kep.tr; an application signed with a secure electronic signature or mobile signature; or an application to kvkk@ilgierp.com sent from an email address you previously notified to us and that is registered in our systems.

Your application must state your name and surname (with your signature if it is in writing), your Turkish national identity number — or, for foreign nationals, your nationality, passport number or identity number if any — your residential or business address for service, your email address, telephone number if any, and the subject of your request. Attaching supporting information and documents helps us resolve it faster.

We conclude applications as quickly as the nature of the request allows, and in any event within thirty days of receiving it. We reply in writing or electronically.

Applications are handled free of charge as a rule. Where responding entails an additional cost, we may charge the fee set in the tariff determined by the Turkish Personal Data Protection Board.

If your application is rejected, if you find our reply insufficient, or if we fail to reply in time, you may lodge a complaint with the Turkish Personal Data Protection Board within thirty days of learning of our reply and in any event within sixty days of the date of your application.

If you want your account and data deleted, follow the steps on our data deletion page or write to kvkk@ilgierp.com.

12. Updates

We may update this notice as legislation or our service changes. The version in force is always published at https://ilgierp.com; the update date at the top of the page tells you which version you are reading.