Your personal data is processed by the following organization acting as the data controller: Name: [ŞİRKET ADI] Address: [ŞİRKET ADRESİ] MERSİS No: [MERSİS NO] KEP Address: [KEP ADRESİ] Data Controller / Contact: [VERİ SORUMLUSU]

The following categories of personal data may be processed within the Service:

• Identity data: first name, last name. • Contact data: email address, phone (if any). • Customer/account data: organization information, user role and permissions. • Transaction security / log data: IP address, session and login records, audit logs, device/browser information. • Usage data: actions, preferences and interactions within the Service.

As the Service is a test management tool, the test content entered by the Customer is, as a rule, not expected to contain personal data; where it does, such data is processed as Customer Data in accordance with the Customer's instructions.

Your personal data is processed for the following purposes:

• Providing the Service, account creation and authentication. • Performing the contract and quote, billing and customer relationship management. • Ensuring information security, preventing misuse and fraud, and keeping audit records. • Improving the Service, troubleshooting and technical support. • Fulfilling legal obligations and responding to competent authorities.

Your personal data is processed based on the following legal grounds under KVKK Art.5 and Art.6 and GDPR Art.6:

• Processing is necessary for the conclusion or performance of a contract (KVKK Art.5/2-c; GDPR Art.6/1-b). • Processing is necessary for the legitimate interests of the data controller — information security, prevention of misuse, improvement of the Service (KVKK Art.5/2-f; GDPR Art.6/1-f). • Establishment, exercise or protection of a right and compliance with a legal obligation (KVKK Art.5/2-e and ç; GDPR Art.6/1-c). • Where necessary, your explicit consent (KVKK Art.5/1; GDPR Art.6/1-a) — e.g. non-essential cookies/analytics.

Your personal data may be transferred, limited to the purposes above, in accordance with KVKK Art.8 and Art.9.

• Domestic transfer: to legally authorized public institutions and authorized private-law persons within the scope of legal obligations. • Sub-processors: suppliers such as hosting and email delivery providers used to provide the Service. Sub-processors process data only under our instructions and subject to contractual confidentiality/security obligations.

• Cross-border transfer: where a sub-processor located abroad is used, the transfer is carried out in accordance with the conditions required by KVKK (explicit consent or the appropriate safeguards under KVKK Art.9).

• On-premise deployment: in this model, Customer Data remains within the Customer's own infrastructure and is not transferred to third parties by the Provider.

Your personal data is retained for the period required by the purpose of processing and for the limitation/retention periods stipulated in the relevant legislation.

Account and customer data are kept for the duration of the contractual relationship; log and transaction security records are kept for the period required by the relevant legislation. Upon expiry of these periods, data is deleted, destroyed or anonymized.

Appropriate technical and administrative measures are applied to protect your personal data:

• Encryption in transit and for sensitive fields (e.g. TLS and AES-256). • Role-based access control (RBAC) and the principle of least privilege. • Tenant-level data isolation in the multi-tenant architecture. • Audit logging, access and change monitoring. • Regular backups and periodic review of access permissions.

Under KVKK Art.11 and the GDPR, you have the following rights regarding your personal data:

• To learn whether your personal data is processed and to access it (right of access). • To request rectification of incomplete or inaccurate data (rectification). • To request erasure/destruction when the grounds for processing no longer exist (erasure/right to be forgotten). • To request your data in a structured, machine-readable format (portability). • To object to processing and to exercise your rights against automated decisions (objection). • To request restriction of processing and to withdraw any explicit consent given.

To exercise the rights above, you may submit your requests through the following channels: Email: [email protected] KEP: [KEP ADRESİ] Address: [ŞİRKET ADRESİ]

Your applications are concluded within the period stipulated in KVKK and the relevant secondary legislation (as a rule, within thirty days at the latest). Depending on the nature of the request, identity verification may be required.

The Service uses essential cookies for session management and security. For detailed information about cookies, please review our Cookie Policy.

The Service does not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. AI-assisted features (e.g. test generation) are auxiliary, and final control remains with the user.

This Privacy Policy and KVKK Disclosure Statement may be updated from time to time. The current text is always published on this page; material changes may also be announced separately.

For the effective date, please see the "Last updated" information at the bottom of the page.