Privacy Policy & Data Protection Notice

This is a courtesy English translation. In case of any discrepancy, the Turkish version prevails as it is governed by Turkish law (Law No. 6698 on the Protection of Personal Data, “KVKK”).

1. Data Controller

Pursuant to the Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data is processed by SUB IQ YAZILIM ÇÖZÜMLERİ TİCARET LİMİTED ŞİRKETİ (the “Company”, “validrelay”) in its capacity as data controller, within the scope described below.

Address: SİLAHTARAĞA MAH. ÜNİVERSİTE 1. SK. NO:13/1 İÇ KAPI NO : Z16 ÇORLU TEKİRDAĞ
Central Registration System (MERSIS) No: 0781108676200001
Registered e-mail (KEP): subiqyazilim@hs06.kep.tr
E-mail: info@subiq.com.tr
Phone: 444 85 39

2. Personal Data Processed

The following data categories may be processed in the course of your use of our platform:

• Identity and contact data: first name, last name, e-mail, phone.
• Company/customer data: company title, tax number, tax office, address.
• Account and usage data: username, password (stored cryptographically), session and transaction logs.
• Marketing attribution data (sign-up source): when you sign up, the campaign tags in the link through which you first reached our website (UTM source, medium, campaign, term, content), the address of the referring website (domain and page path only, without query parameters) and the first page you opened on our website.
• Payment data: payment transactions are carried out by the licensed payment institution iyzico; your card details are not stored by the Company.
• Transaction security data: IP address, log records.
• Website usage data (only if you accept analytics cookies): online identifiers (cookie IDs), pages visited, traffic source, browser and device information, approximate location derived from the IP address.
• Cookie consent records: a random consent ID, your cookie choices, the cookie policy version, date and time, a truncated browser identifier and a one-way, keyed hash of your IP address (for IPv6, of its first 64 bits only; the IP address itself is not stored).
• Free tool usage records (e.g. the EUDAMED XML Validator): the tool name, the validation result (valid/invalid, number and categories of errors), the schema version, the duration, the date and time, and a one-way, keyed hash of your IP address that changes every day (the IP address itself is not stored). The content of the file you validate is never written to disk, a database or logs.

3. Purposes of Processing

• Establishment and performance of the service agreement,
• Membership and account management,
• Measuring the effectiveness of our promotional and communication channels and improving our services (sign-up source analysis),
• Execution of billing and payment processes,
• Fulfilment of legal obligations (tax, regulatory, UTS/EUDAMED notifications),
• Provision of customer support services,
• Protection of information security and system integrity,
• Measuring and improving the use of our website with analytics cookies (only with your explicit consent),
• Preventing abuse of our free tools (usage limits) and measuring their use in aggregate only (daily runs and unique users),
• Recording your cookie choices and proving the consent you have given.

4. Legal Grounds for Processing

Your personal data is processed under Article 5 of the KVKK on the grounds that it is directly related to the establishment or performance of a contract, the fulfilment of a legal obligation, the establishment and protection of a right, and the legitimate interests of the data controller; and, where necessary, based on your explicit consent.

Marketing attribution data (sign-up source) is processed on the basis of our legitimate interest in improving our services and promotional activities (KVKK Art. 5(2)(f)); it is stored together with your account record and used in aggregate (statistical) evaluations. On our marketing website this information is held only temporarily in your browser's memory and is passed on by being added to the sign-up link; no cookie or similar record is written to your device for this purpose. It is not used for profiling, automated decision-making or sharing with third parties.

Free tool usage records are processed on the basis of our legitimate interest in providing our tools securely and without interruption and in improving them (KVKK Art. 5(2)(f)). Because the IP hash added to the record also incorporates the date, it differs every day, and records from different days are not linked to each other. The hash is used only to prevent abuse and to count daily unique users in aggregate (statistical) form; it is not assessed per person, is not used for profiling or marketing, and no cookie is written to your device for this purpose.

Processing through analytics cookies is based solely on your explicit consent (KVKK Art. 5(1)); giving consent is optional and you may withdraw it at any time. Cookie consent records are kept to comply with our legal obligation and to establish, exercise or protect a right (KVKK Art. 5(2)(ç) and (e)). We do not intend to process special categories of personal data (KVKK Art. 6).

5. Transfer of Personal Data

Your personal data may, only to the extent limited to the purpose and where necessary, be shared with:

• The payment service provider (iyzico Ödeme Hizmetleri A.Ş.),
• Cloud infrastructure and hosting service providers,
• The analytics provider Google LLC and its affiliates (only if you accept analytics cookies),
• Video providers (Google LLC for YouTube, Vimeo.com, Inc. for Vimeo) (only if you choose to load an embedded video on a page),
• Authorised public institutions (TİTCK, European Commission EUDAMED, tax offices),
• Legally authorised authorities,

within the framework of Articles 8 and 9 of the KVKK.

Some of our service providers may have servers outside Türkiye. In that case, your personal data is transferred abroad only in accordance with the mechanisms set out in KVKK Art. 9 (an adequacy decision, appropriate safeguards such as the standard contracts announced by the Personal Data Protection Board or, where these cannot be applied, the conditions for occasional transfers under Art. 9(6)).

6. Retention Period

Your personal data is retained for the period required by the processing purpose and for the statutory retention periods stipulated in the relevant legislation (e.g. under tax legislation); at the end of these periods it is deleted, destroyed or anonymised. Cookie durations are stated in the Cookie Policy; cookie consent records are kept for at most 3 years. The IP hash in free tool usage records is deleted after 30 days and the rest of the record is kept as non-identifying statistics; the counters kept for usage limits expire automatically after at most 26 hours.

7. Data Security

The Company takes appropriate technical and administrative measures — including encryption in transit and at rest, access control and regular security audits — to prevent the unlawful processing of and access to your personal data.

8. Cookies

Our website uses strictly necessary cookies (application session and remembering your cookie choice) and, only with your explicit consent, analytics cookies (Google Analytics). No Google script (Google Tag Manager or gtag.js) is loaded before you accept analytics cookies, or if you do not; the marketing choice on its own loads no script and only passes the advertising consent signals to a tag loaded with your analytics consent. Embedded videos (e.g. the webinar recording) are only loaded, in the provider’s privacy mode, when you click “Load video”. Which cookies we use, for what purpose and for how long, the legal grounds and international transfers are described in our Cookie Policy. You can change your choice or withdraw your consent at any time via the “Cookie preferences” link at the bottom of every page; blocking strictly necessary cookies in your browser may cause some functions not to work.

9. Rights of the Data Subject (KVKK Art. 11)

As a data subject, you have the right to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of processing and whether it is used in line with that purpose, to know the third parties to whom it has been transferred domestically or abroad, to request its correction if incompletely/incorrectly processed, to request its deletion/destruction under KVKK Art. 7 and the notification of these operations to the third parties to whom it was transferred, to object to a result against you arising from analysis exclusively by automated systems, and to claim compensation for damages arising from unlawful processing.

You may submit your requests in writing to our address, to our registered e-mail (KEP) address (subiqyazilim@hs06.kep.tr) or from the e-mail address registered in our systems to info@subiq.com.tr, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application will be concluded within 30 days at the latest. If your application is rejected, you find the response insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board under KVKK Art. 14.

10. Amendments

This Privacy Policy may be updated when necessary. The current text is published on this page and its effective date is stated above.