Purpose and scope of this notice
We, İnurdemirel Dijital Pazarlama Ve Yazılım Hizmetleri Ticaret Limited Şirketi (“İnurdemirel”, the “Company” or “we”), have prepared this KVKK Privacy Notice in order to fulfil our obligation to inform pursuant to Article 10 of Personal Data Protection Law No. 6698 (“KVKK” or the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
This notice covers the personal data processed through the inurdemirel.com domain and all its subpages (the “Site”), the free SEO tools and the gift wheel on the Site, and the client panel www.inurdemirel.com/panel (the “Panel”). Data processed in the communication you establish with us by telephone, e-mail, WhatsApp or the appointment calendar are also within its scope.
This notice covers the following persons:
- Site visitors and users of the free tools,
- Participants in the gift wheel (whether or not they are members),
- Potential customers who request an analysis, a quote or an appointment,
- Panel users and our customers,
- Employees, authorised persons and representatives who contact us on behalf of a company,
- Data subjects who apply to us under KVKK.
KVKK protects only data belonging to natural persons; information belonging to legal persons (for example, a company’s trade name) is not considered personal data. However, the name, e-mail and telephone details of persons who contact us on behalf of a company are personal data and fall within the scope of this notice.
We process your personal data in accordance with the general principles in KVKK Article 4: lawfulness and compliance with the rule of good faith; being accurate and, where necessary, up to date; specified, explicit and legitimate purposes; processing that is relevant, limited and proportionate to the purpose; retention for as long as necessary.
This notice is for information purposes; reading or approving it is not a condition of any transaction. Separate texts and separate consent steps are used for processing based on your explicit consent (see section 07). The notice is written in clear, explicit and plain language; we recommend that you read the whole notice to learn fully about your rights and our data processing processes.
Another company’s panel: If you receive services through a panel offered by a reseller or agency under its own domain (a “tenant panel”), that company is the data controller for your data in that panel; we act only as a data processor providing the infrastructure. In that case, you need to exercise your rights primarily against that company; details are in section 09.
Definitions
- KVKK
- Personal Data Protection Law No. 6698.
- Site
- The inurdemirel.com domain and all subpages connected to this domain.
- Panel
- The www.inurdemirel.com/panel client panel, where orders, support requests, balance and reports are managed.
- Free tools
- The SEO Checker, Google Rank Checker, Keyword Analysis, Backlink Checker, DA PA Checker, AI Visibility Checker, Schema Checker and llms.txt Generator tools on the Site.
- Personal data
- Any information relating to an identified or identifiable natural person.
- Data subject
- The natural person whose personal data are processed.
- Processing of personal data
- Any operation performed on personal data, wholly or partly by automated means, or by non-automated means provided that they form part of a data recording system; obtaining, recording, storing, altering, transferring, classifying and preventing the use of personal data are examples.
- Data controller
- The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
- Data processor
- The natural or legal person who processes personal data on behalf of the data controller on the basis of the authority granted by the data controller.
- Explicit consent
- Consent relating to a specific matter, based on information and expressed of free will.
- Hash
- A digest of a piece of data, transformed irreversibly; the raw data cannot be obtained from the hash, but because the same data produce the same hash, it allows repeated use to be recognised.
- Anonymisation
- Rendering personal data such that they can in no way be associated with an identified or identifiable natural person, even when matched with other data.
- Board / Authority
- Personal Data Protection Board / Personal Data Protection Authority.
Data controller and contact details
- Data controller
- İnurdemirel Dijital Pazarlama Ve Yazılım Hizmetleri Ticaret Limited Şirketi
- Tax and registry details
- Mithatpaşa Tax Office, 4781161820; MERSIS number: 0478116182000001; Trade registry number: 498128
- Address
- Meşrutiyet Mah. Konur Sok. Özsoy İş Hanı No: 25/13, 06420 Çankaya/Ankara
- Our group company
- Shofix OÜ, Narva mnt 5, Tallinn, Estonia; Estonian trade registry code: 17321116; VAT number: EE102999190. A separate company established in Estonia that has a partnership tie with our Company
- Telephone
- 0850 840 41 74
- work@inurdemirel.com
- Websites
- inurdemirel.com and www.inurdemirel.com/panel
As our Company is a data controller resident in Türkiye, it is not required to appoint a data controller representative. Our other identifying details are available on the Legal Information page.
Methods of collecting personal data
We collect your personal data electronically, wholly or partly by automated means or by non-automated means as part of a data recording system, through the following channels:
- Information you share directly: the free analysis and contact forms on the Site; the queries you enter in the free tools and the e-mail address you provide for a report; the gift wheel; the membership, order, balance top-up, Google Rank Tracking and support screens in the Panel; what you send us by e-mail, telephone and WhatsApp; the information you enter in the appointment calendar.
- Information generated automatically: traffic logs kept by the server when you visit the Site and the Panel; transaction logs in the Panel; cookie and local storage records kept in your browser; hashes generated from your IP address and the general characteristics of your browser in the free tools and the gift wheel.
- Information from third parties: banks that send us the result of your payment and, for card payments, the payment institutions Revolut (the account of our group company Shofix OÜ) and PayTR; Cloudflare, which sends the result of the bot verification; if you use the “Sign in with Google” option, the first name, last name, e-mail address and account ID sent by Google; if you work with us on behalf of a company, your contact details sent by the company you work for.
Personal data processed, purposes of processing and legal bases
In the tables below, we show separately, for each data category, the purpose of processing and the legal basis under KVKK Article 5 on which that purpose relies. We do not ask for your explicit consent for processing that relies on a legal basis such as the establishment or performance of a contract, a legal obligation or legitimate interest.
Site, free tools and communication channels
| Data category and source | Purpose of processing | Legal basis |
|---|---|---|
| Free analysis form: full name, e-mail, telephone, website address, up to 3 competitor sites, budget range, goal, notes and the service areas you select | Assessing your request; preparing a free preliminary analysis and a quote for requests found suitable; contacting you about this request | Being directly related to the establishment of a contract, Article 5(2)(c) |
| Contact form: full name, e-mail, telephone and message; if you have given consent to commercial messages, the channels you consented to and the time of consent | Answering your question or request | Article 5(2)(c) if the request relates to the purchase of a service or to your existing contract; Article 5(2)(f) for other requests |
| Telephone, e-mail and WhatsApp communication initiated by you: full name, telephone, e-mail, WhatsApp profile name, content of the correspondence | Answering your questions; conducting the quote and service processes | Article 5(2)(c) for contract-related requests; Article 5(2)(f) for others |
| Appointment calendar (Cal.com): full name, e-mail, date and time of the meeting; IP address and browser information when the calendar loads | Scheduling and holding the meeting you request | Article 5(2)(c); loading the calendar on the page depends on the explicit consent you give to “Functional” cookies, Article 5(1) |
| Free tools (SEO Checker, Google Rank Checker, Keyword Analysis, Backlink Checker, AI Visibility Checker, Schema Checker, llms.txt Generator): the address, domain, keyword, competitor domain, sector and questions you query; hashes of your IP address, your IP block and the general characteristics of your browser (the raw IP address is not recorded); your e-mail address and the verification record when you request the report by e-mail or verify for the usage entitlement; your account number if you are a member; the result of the bot verification | Answering the query; preparing and sending the report; counting the free usage entitlement; preventing misuse and automated requests | Article 5(2)(c) for providing the tool you request; our legitimate interest in preventing misuse, Article 5(2)(f) |
| DA PA Checker: the domain or page address you query; your IP address | Answering your query; short-term request limiting per IP address | Article 5(2)(c); Article 5(2)(f) |
| Gift wheel (non-member participant): hashes of your IP address, your IP block, your browser characteristics and your device identifier (the raw IP is not recorded); device cookie (inur_hc); the result of the bot verification; the prize you win and the reservation date; your e-mail address when linking the prize to your account | Enabling your participation in the wheel; applying the participation limit per person and per device; linking the prize to your account; preventing misuse | Establishment and performance of the Campaign Terms, Article 5(2)(c); our legitimate interest in preventing misuse, Article 5(2)(f) |
| Server and traffic logs: IP address, date and time of access, page accessed, browser and device information | Information security; detecting misuse and attacks; meeting the lawful requests of competent authorities | Article 5(2)(f) for security; Article 5(2)(a) and Article 5(2)(ç) for requests of authorities and obligations under Law No. 5651 |
| Cookie preference record (inur_consent): your category preferences, the time of the preference, the policy version and a random consent ID; kept only in your browser | Complying with your cookie preferences | Article 5(2)(f); our legal obligation to run optional cookies only with your consent, Article 5(2)(ç) |
| Language preference (ind_lang) | Displaying the pages in the language you choose | Article 5(2)(f) |
| Tool history and preferences stored in the browser (dp-rows, ar-gecmis-…, ar-eposta, inur_nf); kept only in your browser | Showing your previous queries and the announcements you have read again; not asking for e-mail verification again | The explicit consent you give to “Functional” cookies, Article 5(1) |
| Analytics and advertising measurements (only if you have allowed Analytics or Marketing cookies): online identifiers, pages visited, interaction and conversion events, browser and device information, approximate location, IP address | Measuring the use of the Site and the Panel (Google Analytics 4); measuring advertising effectiveness and showing personalised ads (Google Ads, Meta Pixel) | Your explicit consent, Article 5(1) |
| Commercial electronic messages: full name, e-mail, telephone, consent and opt-out records | Sending campaign and promotional messages; keeping the consent and opt-out records in the Message Management System (İYS) | Your explicit consent (Article 5(1)) and your approval under Article 6 of Law No. 6563; for recipients who are merchants or tradespeople, Article 5(2)(f), subject to a written balancing assessment; Article 5(2)(ç) for İYS records |
Information sent in the free tools and Google Rank Tracking: The domain, keyword and questions you query in these tools are sent to the data providers listed in section 11 to obtain the results. As a rule, this information is not personal data; information that identifies you (name, e-mail, IP address) is not sent to these providers. We ask you not to enter personal data in the tools and in AI questions; Google Rank Tracking does not accept a question containing personal data.
Commercial electronic messages and service notifications: Under Article 6 of Law No. 6563, commercial electronic messages may be sent to recipients who are merchants or tradespeople without obtaining prior approval. If we make use of this option, we use only the addresses of businesses that are publicly available or notified to us in a corporate capacity, and we carry out an İYS check and a written balancing assessment before sending. You can stop the messages free of charge at any time with the opt-out option in each message. Order, payment, period, report, invoice and support notifications are not commercial electronic messages; they are sent within the scope of the performance of the contract.
Client panel (www.inurdemirel.com/panel)
| Data category and source | Purpose of processing | Legal basis |
|---|---|---|
| Account and contact details: full name, e-mail, telephone, address and account password (the password is stored irreversibly) | Creating and managing the account; authentication; establishment and performance of the contract | Article 5(2)(c) |
| E-mail and telephone verification: verification code, time of sending and time of verification | Confirming that the account belongs to you and that the contact details are correct | Article 5(2)(c); Article 5(2)(f) for account security |
| Sign in with Google: the first name, last name, e-mail address and account ID in your Google account | Creating your account and signing in to your account | Article 5(2)(c) |
| Account security records: session and device ID, sign-in time, IP address | Preventing unauthorised access to your account | Article 5(2)(f) |
| Panel transaction logs: registration, profile changes, cart operations, payment steps, discount and gift wheel operations, support and account closure requests, and their times | Proving orders and the transactions in your account; detecting errors and misuse; customer support | Article 5(2)(c); Article 5(2)(e); Article 5(2)(f) |
| Billing details: full name, address, Turkish identity number where necessary; if you are a taxpayer, trade name, tax office and tax number; invoice type (individual or corporate) | Issuing invoices; determining the contract applicable to the order (Distance Sales Contract or Commercial Service Agreement); accounting and tax records | Article 5(2)(c); Article 5(2)(a) and Article 5(2)(ç) under Tax Procedure Law No. 213 (VUK) and Turkish Commercial Code No. 6102 (TTK) |
| Order and transaction details: the packages and services selected, period and commitment term details, amount, discount applied, payment method and status, the bank transfer (havale/EFT) receipt and the “I have sent the payment” notification, order stages, withdrawal period and start postponement requests. You enter your card details on the secure payment page of the payment institution (Revolut or PayTR); your card details are not stored by us | Receiving the order; preparing and delivering the service; tracking the payment and period collections; record-keeping and proof obligations arising from consumer legislation; protecting rights in disputes | Article 5(2)(c); Article 5(2)(ç) under Law No. 6502 on Consumer Protection and the Distance Contracts Regulation; Article 5(2)(e) |
| Balance: amounts topped up, balance movements and orders paid with the balance | Topping up the balance and using it in orders; accounting records | Article 5(2)(c); Article 5(2)(ç) |
| Discounts and campaigns: the coupon, gift wheel prize and loyalty discount you use; wheel participation entitlement and prize records; your number of orders in the loyalty program | Applying discounts in accordance with the Campaign Terms; monitoring per-person limits and misuse | Article 5(2)(c); Article 5(2)(f) |
| Approval and contract records: the ID and version of the approved text and the digest value of its unalterable copy, the date and time of approval, IP address, browser information, interface language; if you have given consent to commercial messages, the channel and contact address | Proving approvals; record-keeping obligations under Law No. 6502, the Distance Contracts Regulation and Law No. 6563 | Article 5(2)(ç); Article 5(2)(e) |
| Information sent to the payment institution (Revolut or PayTR) for card payments: full name, e-mail, telephone, billing address, IP address, order contents and amount | Receiving the card payment; payment security and refunds | Article 5(2)(c) |
| Service notifications: e-mail, telephone and notification content | Order, payment, period, report, invoice and support notifications | Article 5(2)(c) |
| Support requests: subject, correspondence, attachments and their dates | Answering your requests; performance of the service; quality monitoring; proof | Article 5(2)(c); Article 5(2)(f); Article 5(2)(e) |
| Service-related information: your websites, keywords and competitors, backlink links, social media account names, start month, approved advertising budget, your order notes, your sector and the reports prepared for you | Performing and reporting the service you purchase in accordance with your request. For content services, the domain, keywords and language information of the order may be sent to the AI service provider (OpenAI) to prepare a content draft; your name and contact details are not sent | Article 5(2)(c) |
| Google Rank Tracking: tracked domains, keywords, competitor domains, location and device selections, AI questions, measurement results, alerts and reports; additional recipient e-mail addresses to which you want reports to be sent, and their verification records; if you choose Telegram notifications, the Telegram connection details | Providing the rank tracking service that you purchase or try or that is assigned to you as a gift | Article 5(2)(c). You must enter additional recipient addresses with the recipient’s knowledge; the report is sent after the recipient address is verified |
| R10 username (if requested in the order) | Matching your order with your R10 membership | Article 5(2)(c) |
| Site access details: WordPress admin panel address, administrator username and password; hosting, cPanel and FTP details | Implementing the service you purchase on your site | Article 5(2)(c) |
| Answer to “How did you hear about us?” (optional) | Measuring our promotional channels | Article 5(2)(f) |
| Referral source (only if you have allowed Marketing cookies): the source you came from, campaign and ad click ID, referring site and landing page | Recording which promotional channel your account came from | Your explicit consent, Article 5(1) |
| Account closure: your request, the time of the request and IP address; the identity and billing summary that must be retained when the account is closed | Fulfilling the request; setting aside the records that must be retained by law | Article 5(2)(c); Article 5(2)(ç); Article 5(2)(e) |
| KVKK applications: identity and contact details, content of the request and our responses | Assessing, answering and proving your application | Article 5(2)(ç) (KVKK Article 13) |
IP address and traffic logs: The IP address is personal data, and we protect these logs as personal data. We do not use these logs to recognise you, monitor your behaviour or create a profile; we process them only for security and to meet the lawful requests of competent authorities.
Mandatory fields: Fields marked as mandatory are necessary for us to answer your request or to establish and perform the contract. If you do not share this information, we may not be able to fulfil the relevant request. You are not obliged to fill in optional fields.
Special categories of personal data: We do not request the data listed in KVKK Article 6 (race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, biometric and genetic data). If such data are sent on your own initiative, they are processed only to the extent required by your request and under the conditions in Article 6 of the Law, and are destroyed if they are not necessary. We ask you not to share such data in your forms, messages and support requests.
Automated decision-making: No decision producing legal consequences for you is taken based solely on an analysis carried out by automated systems. Misuse limits are applied automatically in the free tools and the gift wheel; for this reason, if you believe that a participation has been rejected, you can apply to us.
Personal data on customer sites
Within the scope of the service, we may access your site, your admin panel or your hosting account; in that case, it may be possible for us to access personal data belonging to the members, customers or visitors of your site. You are the data controller of these data; we access these data as a data processor, only to the extent required by the service and in line with your instructions.
We do not use these data for our own purposes; we do not share them with anyone other than our auxiliary persons, our subcontractors and our group company Shofix OÜ, who are bound by the same confidentiality and security obligations, to the extent required by the service. The obligations of the parties regarding these data are governed by the Distance Sales Contract for consumers and by the Commercial Service Agreement for other buyers.
We recommend that you share your access details over a secure channel, if possible create a separate user account only for this work, and change your passwords after the service ends.
Processing based on explicit consent
We rely on your explicit consent only for the following processing:
- Functional, Analytics and Marketing cookies and similar browser storage technologies (Cookie Policy),
- Sending commercial electronic messages (Commercial Electronic Message Consent); the exception in section 05 for recipients who are merchants or tradespeople is reserved.
Giving explicit consent is optional and is not a condition of any service; not giving consent does not prevent you from using the Site, obtaining a quote or purchasing a service. You can withdraw the consent you have given at any time, by a means as easy as the one by which you gave it; withdrawal does not affect the lawfulness of processing carried out up to that date.
Cookies and browser storage
On your first visit to the Site, a notice asking for your cookie preferences is shown. The “Reject” and “Accept All” buttons are presented side by side, in the same style and size. Strictly necessary cookies are always active; the Functional, Analytics and Marketing categories are off by default and run only if you turn them on. Scrolling the page or closing the notice does not count as consent. If your browser sends a Global Privacy Control (GPC) signal, the Marketing category is deemed rejected.
Your preferences are stored in the “inur_consent” cookie for 12 months; when this period expires or the version of the Cookie Policy changes, you are asked for your preference again. You can change your preferences via the “Cookie Preferences” link at the bottom of every page. All cookies and local storage records used are listed, with their purposes and durations, in the Cookie Policy.
Tenant panels (reseller and agency panels)
Our Panel infrastructure is also used by resellers and agencies (“tenant”) that serve their own customers under their own domain and brand. If you have opened an account in a tenant’s panel:
- The tenant is the data controller of your account, order, payment and support data in that panel; the privacy notice, the contracts and the contact details are in the tenant’s panel.
- We process these data on behalf of the tenant, only to operate the infrastructure and in accordance with the Tenant Terms of Use and Data Processing, in our capacity as a data processor; we do not use them for our own purposes.
- You need to exercise your KVKK rights against the tenant. We forward applications that reach us to the relevant tenant without delay.
Transfer of personal data within Türkiye
Pursuant to KVKK Article 8, we transfer your personal data only to the recipients below, limited to the stated purpose and in a proportionate manner. Recipients abroad are shown in section 11.
| Recipient group | Purpose of transfer | Legal basis |
|---|---|---|
| Competent public institutions and organisations, judicial and administrative authorities | Providing information and documents upon the request of legally authorised authorities | Article 5(2)(a) and Article 5(2)(ç) |
| Lawyers and legal advisers | Exercising our rights of claim and defence in legal disputes | Article 5(2)(e) |
| Financial advisers and auditors | Accounting, tax and audit obligations | Article 5(2)(ç) |
| Business partners carrying out part of the service (software, graphic design, content and technical team) | Performance of the service you purchase; only the data required by the work are shared | Article 5(2)(c) |
| Hosting and server service providers | Operating the Site and Panel infrastructure; storing the data securely | Article 5(2)(c) and Article 5(2)(f) |
| SMS service provider (Netgsm) | Sending telephone verification codes and service notifications and, if you have given consent, commercial messages | Article 5(2)(c); Article 5(1) for commercial messages |
| E-invoice and accounting service provider (Paraşüt) | Issuing the invoice | Article 5(2)(ç) |
| Banks (bank transfer, havale/EFT), Revolut and PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. | Receiving payments and making refunds | Article 5(2)(c) |
| Message Management System (İYS) | Keeping commercial electronic message consent and opt-out records | Article 5(2)(ç) |
Our hosting, SMS and e-invoice providers and the business partners carrying out part of the service on our behalf act as data processors, only in line with our instructions. Competent authorities, lawyers, financial advisers, banks, Revolut, PayTR and İYS process the data as separate data controllers within the framework of their own legal obligations. Your personal data are not sold and are not rented to third parties for advertising purposes.
Transfer of personal data abroad
Our group company Shofix OÜ and some of our service providers are located outside Türkiye. In the table below, we show which data go to which recipient and for what purpose. For transparency, we also list the providers to which information that does not qualify as personal data, such as domain, keyword and question, is sent.
| Recipient | Location | Information sent | Purpose | Legal basis (KVKK Article 5) |
|---|---|---|---|---|
| Shofix OÜ (our group company) | Tallinn, Estonia | Customer, order, support and communication data to the extent necessary to carry out the service; for orders paid by card, full name or trade name, e-mail, telephone, billing address, tax details, order contents, amount and payment result | Carrying out and reporting the service; customer support; collecting and invoicing orders paid by card | Article 5(2)(c); Article 5(2)(ç) for invoicing |
| Revolut (payment account of our group company Shofix OÜ) | European Union | Full name, e-mail, billing address, IP address, order amount and payment result; you yourself enter the card details on the payment institution’s page | Card payment and refund | Article 5(2)(c) |
| Merit Aktiva | Estonia | Full name or trade name, billing address, tax details, invoice items and amount | Issuing Shofix OÜ invoices and Estonian accounting records | Article 5(2)(ç) |
| Serper (google.serper.dev) | Abroad | Domain, keyword, location and device selection (no personal data are sent) | Google Rank Checker, map ranking and Google Rank Tracking measurements | Article 5(2)(c) |
| DataForSEO | Abroad | Keyword, domain, competitor domain (no personal data are sent) | Keyword Analysis, Backlink Checker; Google Rank Tracking volume, suggestions and backup measurement | Article 5(2)(c) |
| Moz | Abroad | Queried address (no personal data are sent) | DA PA Checker | Article 5(2)(c) |
| Google (PageSpeed Insights) | Abroad | Queried page address (no personal data are sent) | SEO Checker | Article 5(2)(c) |
| OpenAI, Google (Gemini), Anthropic | Abroad | Questions, brand and domain, sector; for content services, the domain, keywords and language information of the order (no name or contact details are sent) | AI Visibility Checker, SEO Checker evaluation, Google Rank Tracking AI answer tracking, draft of the ordered content | Article 5(2)(c) |
| Cloudflare (Turnstile) | Abroad | IP address, browser and device signals | Bot verification in the free tools and the gift wheel | Article 5(2)(f) |
| BunnyCDN | Abroad | IP address and request information (content delivery network logs) | Delivering Site and Panel content quickly and securely | Article 5(2)(f) |
| Resend | Abroad | E-mail address and the content of the report/verification e-mail | Sending verification code and report e-mails in the free tools | Article 5(2)(c) |
| Twilio | Abroad | Telephone number and message content | Sending verification and service SMS messages to foreign telephone numbers | Article 5(2)(c) |
| Google (Sign in with Google) | Abroad | Google account ID and e-mail address | Authentication when you use the “Sign in with Google” option | Article 5(2)(c) |
| Telegram | Abroad | In Google Rank Tracking notifications, the Telegram connection details and notification content; in internal notifications to our team, order and support details and the customer’s name, e-mail address and telephone number | Sending notifications when you choose Telegram notifications; informing our team of order and support processes | Article 5(2)(c); Article 5(2)(f) |
| Google (Google Analytics 4, Google Tag Manager, Google Ads) | Abroad | Online identifiers, pages visited, interaction and conversion events, device information and IP address | Only when you allow Analytics or Marketing cookies: usage measurement, advertising measurement and personalised advertising | Your explicit consent, Article 5(1) |
| Meta (Meta Pixel) | Abroad | Online identifiers, pages visited, conversion events, device information and IP address | Only when you allow Marketing cookies: measurement of Facebook and Instagram ads and personalised advertising | Your explicit consent, Article 5(1) |
| Cal.com (app.cal.eu) | European Union | Full name, e-mail, appointment date and time, IP address and browser information | Scheduling the meeting you request | Article 5(2)(c); Article 5(1) for loading the calendar |
| WhatsApp (Meta) | Abroad | Telephone number, profile name and message content | Conducting the correspondence initiated by you | Article 5(2)(c) or Article 5(2)(f) |
Card payments and Shofix OÜ: As a rule, card payments are received through our group company Shofix OÜ (Estonia, registry code 17321116), and the invoices for these orders are issued by Shofix OÜ from Estonia. The service, the party to the contract and our obligations towards you do not change. For these orders, Shofix OÜ is a separate data controller with respect to your payment and invoice data, within the framework of its own obligations.
Basis of transfers: We take as our principle that transfers abroad involving personal data are carried out in accordance with KVKK Article 9, as amended by Law No. 7499, and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. When the standard contract announced by the Board is signed for a recipient, it is notified to the Authority within 5 business days of signature and this table is updated. We may rely on the exceptions in KVKK Article 9(6) only for non-regular, one-off (incidental) transfers; if your explicit consent is required, the recipient, the purpose and the possible risks specific to that transfer are notified to you separately.
WhatsApp and the appointment calendar are optional; you can also send the same request by telephone, e-mail or the contact form. WhatsApp/Meta and Google are separate data controllers with respect to the processing they carry out for their own purposes. Google and Meta tools are loaded only when you allow the relevant cookie category; you can withdraw your permission via the “Cookie Preferences” link at the bottom of every page.
Retention periods
We retain your personal data for as long as required by the purpose of processing and provided for in the legislation; when the period expires or the conditions for processing cease to exist, your data are erased, destroyed or anonymised.
| Record | Retention period |
|---|---|
| Analysis requests, communication, appointment and correspondence records that do not turn into a contract | 2 years from the date the request is concluded |
| Panel account, order, contract and support records | During the contractual relationship and for 10 years from its end (TTK Article 82; TBK Article 146); excluding site access details |
| Invoice, accounting and balance movement records | 10 years (TTK Article 82; VUK Article 253) |
| Panel account password | As long as the account remains open; deleted when the account is closed |
| When the account is closed | An account with no order or payment is deleted. An account with an order or payment is anonymised; the order, invoice, payment and contract records and the identity and billing summary are retained for the 10-year period above, without access for you or to your account |
| Site access details (WordPress, hosting, cPanel, FTP) | Only for the duration of the service; when the service ends, deleted or masked in correspondence |
| Account security session records | 90 days after the session expires or is closed |
| Panel transaction logs | 2 years; the IP addresses in them are masked after 1 year |
| IP address in the account closure request | Masked after 1 year; the request record remains for the purpose of proof |
| Google Rank Tracking measurement history and projects | For the duration of the service, measurement history for at most 400 days; 90 days after the end of the period, deleted if the service is not renewed. Alerts 180 days. Deleted projects are permanently deleted after 30 days. Sharing links are valid for 30 days |
| Free tool query records (hashes, e-mail domain, queried domain, account number if you are a member) | 30 days |
| Free tool result cache (not associated with your identity) | At most 30 days |
| Google Rank Checker queries | 30 days if you are not a member; 400 days if you are a member |
| Tool e-mail verification records | 90 days |
| Tool reports | Summary 400 days; the full result of a report with a sharing link 30 days after the sharing ends |
| Misuse warnings and blocking decisions | Warnings 120 days; expired blocking decisions 400 days |
| Usage counters | Those containing personal data 400 days; aggregate counters not containing personal data 2 years |
| IP address in DA PA Checker queries | Not written to a permanent record; query record 30 days |
| Gift wheel: a non-member participant’s prize reservation not linked to an account, and the hashes | 90 days |
| Gift wheel: prizes won and used | The prize is valid for 10 days; a used prize 10 years together with the order record |
| Server and traffic logs | 1 year |
| Approval records (including IP address and browser information) and commercial electronic message consent and opt-out records | 10 years from the transaction date; the commercial message consent record additionally 3 years from the date the consent ends (Article 13(2) of the Regulation on Commercial Communication and Commercial Electronic Messages); whichever period expires later. Closing your account does not shorten these periods |
| KVKK applications and our responses | 10 years from the date the application is concluded |
| Cookie preference record (inur_consent) | 12 months |
| Gift wheel device cookie (inur_hc) | 400 days |
| Verified e-mail cookie (arac_eposta) | 30 days |
| Preference and history records kept in the browser (ind_lang, dp-rows, ar-gecmis-…, ar-eposta, inur_nf) | Only on your device; until you withdraw your “Functional” permission or delete them yourself (ind_lang until you delete it yourself) |
| Referral source record (with Marketing permission) | In your browser for at most 30 days; in the panel together with your account, until you withdraw your Marketing permission or close your account |
| Records of erasure, destruction and anonymisation operations | At least 3 years |
If there is a dispute, investigation or legal request, the relevant data may be retained until that process is concluded and to the extent necessary (Article 5(2)(e)).
Erasure, destruction and anonymisation
When the conditions for processing cease to exist, we erase, destroy or anonymise your personal data on our own initiative or upon your request, in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data and the Board’s decisions.
- Erasure
- Rendering personal data inaccessible and non-reusable in any way for the relevant users.
- Destruction
- Rendering personal data inaccessible, irretrievable and non-reusable by anyone in any way.
- Anonymisation
- Rendering personal data such that they cannot be associated with anyone, even when matched with other data.
As the data controller, we choose the appropriate method and, upon your request, notify you of it together with the reasons. If all of the conditions for processing have ceased to exist, we conclude your request free of charge within 30 days at the latest; if your data have previously been transferred to third parties, we also inform them and ensure that they take the necessary action. If not all of the conditions for processing have ceased to exist, your request may be rejected with the reasons explained. All destruction operations are recorded, and these records are retained for at least 3 years.
Your rights under KVKK
Pursuant to KVKK Article 11, by applying to us you have the right to:
- Learn whether your personal data are processed,
- Request information about it if they have been processed,
- Learn the purpose of processing and whether the data are used in accordance with their purpose,
- Know the third parties in Türkiye or abroad to whom your data are transferred,
- Request their correction if they have been processed incompletely or incorrectly,
- Request their erasure or destruction within the framework of the conditions in KVKK Article 7,
- Request that correction, erasure or destruction operations be notified to the third parties to whom the data have been transferred,
- Object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems,
- Request compensation for the damage if you suffer damage due to unlawful processing
Where processing is based on your explicit consent, you can withdraw your consent at any time: for cookies, you can use the “Cookie Preferences” link at the bottom of every page; for commercial messages, the free opt-out option in each message; or the application methods below.
Method of application
Pursuant to the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can submit your application in Turkish by one of the methods below. For a ready-made template, you can use the Data Subject Application Form; using the form is not mandatory.
- In writing: You can hand-deliver your application bearing your wet signature to Meşrutiyet Mah. Konur Sok. Özsoy İş Hanı No: 25/13, 06420 Çankaya/Ankara, or send it by registered mail with return receipt or through a notary public.
- With a secure electronic signature or mobile signature: you can send your signed application to work@inurdemirel.com.
- From your registered e-mail address: you can send it to work@inurdemirel.com from the e-mail address you have previously notified to us and that is registered in our system (for example, the address in your Panel membership).
Your application must contain your first name, last name and, for a written application, your signature; your Turkish identity number (if you are a foreign national, your nationality, your passport number or, if any, your identity number); your residential or business address for notification purposes; if any, your e-mail address, telephone and fax number for notification purposes; and the clear and understandable subject of your request. You need to attach the documents relating to your request and, if you are applying on behalf of someone else, to submit your document of authority (for example, a power of attorney).
To prevent your data from being disclosed to unauthorised persons, we may request additional information in order to verify your identity. The application date is, for written applications, the date on which the application is served on us, and for the other methods, the date on which it reaches us.
Conclusion of applications
We conclude your application free of charge as soon as possible according to the nature of the request and within 30 days at the latest (KVKK Article 13). If your request is accepted, it is fulfilled; if it is rejected, the reasons are explained. We send our response in writing or electronically, preferably to the e-mail address you stated in your application. Our response contains the details of the data controller, the identity and contact details of the applicant, the subject of your request and our explanations.
Complaint to the Personal Data Protection Board
If your application is rejected, if you find our response insufficient or if we do not respond to your application in time, you can lodge a complaint with the Board within 30 days from the date you learn of our response and in any case within 60 days from the application date (KVKK Article 14). You must have applied to us before lodging a complaint with the Board. Your right to resort to judicial remedies and to claim compensation under the general provisions in the event of a violation of your personality rights is reserved.
Data security and data breach notification
Pursuant to KVKK Article 12, we take technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of your personal data and unlawful access to these data and to ensure their safekeeping. In this context, we limit access by authorisation, store passwords irreversibly, use hashes instead of raw IP addresses in the free tools and the gift wheel, apply two-step verification to administrator accounts, carry out the necessary audits with respect to our personnel and delete site access details when the service ends. Where data are processed by another person on our behalf, we are jointly responsible with that person for taking these measures.
If, despite all measures, your processed personal data are obtained by others through unlawful means, we notify the Board of the breach no later than 72 hours from the moment we learn of it, pursuant to KVKK Article 12(5) and the Board’s decision dated January 24, 2019 and numbered 2019/10, and, after identifying the affected data subjects, we also notify you as soon as possible.
Entry into force, updates and copyright
Version: 2.1. Effective date: October 24, 2026. Last updated: October 24, 2026.
We may update this notice in line with changes in legislation, Board decisions or changes in our data processing activities. You can access the current version on this page; you can access a copy of the version you accepted during an order or registration from your client panel. If a new processing purpose is added, we will inform you before starting processing for that purpose.
This notice has been prepared in accordance with KVKK (Law No. 6698) and the secondary legislation; in the event of a conflict between the notice and the legislation, the provisions of the legislation apply. The Turkish version prevails; versions in other languages are for information purposes.
The original arrangement and wording of this notice are protected under Law No. 5846 on Intellectual and Artistic Works; provisions taken from legislation are outside this protection. Unauthorised copying and reproduction of it are subject to the provisions on legal and criminal liability in the Law.
Related texts:
KVKK Privacy Notice · Version 2.1 ·
