Protection of Personal Data — Privacy Notice

1Identity of the Data Controller

This Privacy Notice has been prepared pursuant to Article 10 of KVKK No. 6698 by Bink Teknoloji Sanayi Ticaret Limited Şirketi (the “Company”, “We”), the owner of the Collobr brand, in its capacity as data controller.

Contact: [email protected] — Address: Sahabiye Mah. Ahmet Paşa Cad. Kalender İş Mrk. No:41/602 Kocasinan, Kayseri

2Categories of Personal Data Processed

When you visit our website, fill in an application form, request a demo, sign up for Collobr or use our services, the Company processes the following categories of personal data:

• Identity Information: first name, last name, Turkish national ID number (when needed for e-documents / e-signature), title.
• Contact Information: email address, phone number, full address, company name.
• Account & Authentication: username, password (hashed), Google OAuth ID, session information.
• Company & Financial Information: tax number, tax office, IBAN, invoice records, customer/supplier lists.
• Transaction Security: IP address, browser type, login time, cookie identifiers, usage logs.
• Marketing: newsletter subscription status, campaign participation, survey responses (only with explicit consent).
• Messaging & Content: the content of emails you send and receive through CollobrMail (solely for the purpose of providing the service to you; not read by our employees).

3Purposes of Processing Personal Data

Your personal data is processed for the following purposes and on the basis of the legal grounds set out in Articles 5 and 6 of the KVKK:

• Establishment and performance of the service agreement; account opening, authentication, billing.
• Management of customer relations and technical support processes.
• Fulfillment of legal obligations (Tax Procedure Law No. 213 (VUK), e-document legislation, Turkish Commercial Code No. 6102 (TTK), etc.).
• Information security processes, detection and prevention of misuse (fraud detection).
• Anonymous/anonymized analytics to improve the service.
• If you have given consent: product updates, newsletter, campaign notifications.

4Legal Grounds

Your personal data may be processed on the basis of one or more of the following legal grounds under KVKK Art. 5/2:

• Processing is necessary for the establishment and performance of a contract (Art. 5/2-c).
• Processing is necessary for the data controller to fulfill its legal obligation (Art. 5/2-ç).
• Processing is necessary for the establishment, exercise or protection of a right (Art. 5/2-e).
• Processing is necessary for the legitimate interests of the data controller (Art. 5/2-f) — e.g. security logs, fraud prevention.
• Your explicit consent (Art. 5/1) — e.g. newsletter, marketing, cookie preferences.

5Transfers

Under KVKK Art. 8 and Art. 9, your personal data is transferred only to the following parties and only to the extent required by the purpose of processing:

• Within Turkey: Competent public authorities and institutions (tax authority, the Revenue Administration (GİB), courts), bank/POS providers (for payment transactions), e-document integrators.
• Abroad: delivery of website traffic and file storage (Cloudflare, Inc.), email delivery (Resend, Inc. — EU/Ireland sending region), AI features (OpenAI — US); if used, sign-in with Google, Apple and LinkedIn, Google Calendar and mobile notifications (Google), and the WhatsApp integration (Meta).

We keep data transferred abroad to the minimum the respective service requires. For questions about transfers, write to [email protected].

6Method of Collection

Personal data is collected through our website (forms, applications, cookies), your interactions within the Collobr application, email correspondence, phone calls and physical documents.

7Your Rights Under Article 11 of the KVKK

To exercise the following rights, you may submit a written application to [email protected]:

• To learn whether your personal data is being processed.
• If it has been processed, to request information about it.
• To learn the purpose of processing and whether it is used in accordance with that purpose.
• To know the third parties in Turkey or abroad to whom it has been transferred.
• To request the correction of incomplete or inaccurate data.
• To request the deletion or destruction of the data under KVKK Art. 7.
• To request that the correction, deletion or destruction be notified to the third parties to whom the data has been transferred.
• To object to an outcome against you resulting from analysis carried out exclusively through automated systems.
• To claim compensation for damage if you suffer damage due to unlawful processing.

Your applications are answered within 30 days in accordance with the KVK Board’s “Communiqué on the Procedures and Principles of Applications to the Data Controller”.

8Retention Period

Your personal data is retained for as long as the purpose of processing requires and until the minimum retention periods set out in the relevant legislation (for example, 5 years under VUK Art. 253 and 10 years under TTK Art. 82) have expired. Once the period has expired, it is deleted, destroyed or anonymized.

9Security Measures

Under KVKK Art. 12, the Company applies the following technical and administrative measures to ensure the security of your data:

• Application and database hosted in Turkey (Izmir).
• TLS 1.3 encryption in transit.
• Role-based permission management; option to sign in with an electronic signature.
• Two-step verification (authenticator app) option.
• Regular automatic backups.
• Processes for detecting data breaches and notifying the KVK Board within 72 hours.

10Updates

This Privacy Notice may be updated when necessary. In the event of a material change, a notification is sent to your registered email address. The current version is always available on this page.

Contact: [email protected] — contact page