B2 Yazılım — Personal Data Processing (Privacy) Notice

1. Data Controller

Pursuant to the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed, in the capacity of data controller, by B2 Yazılım Anonim Şirketi ("Company", "we") within the scope explained below.

• Trade name: B2 Yazılım Anonim Şirketi
• MERSİS No.: 0127 0380 7670 0012
• Trade Registry No.: 872302
• Tax No. / Office: 1270380767 / Avcılar
• Address: İstanbul Üniversitesi Avcılar Yerleşkesi, Argem Binası, K:1 No:104, Avcılar / İstanbul
• Registered e-mail (KEP): [email protected]
• Phone: 0850 885 05 04
• E-mail: [email protected]
• Applications / contact: You may submit your requests under the KVKK via [email protected], via our

registered e-mail address (KEP) ([email protected]), or in writing to our head-office address.

• VERBİS (Data Controllers' Registry) registration: As our Company does not fall within the thresholds (annual

employee count / annual financial balance sheet) that trigger a VERBİS registration obligation, it is not registered with VERBİS. Should the obligation arise, registration will be carried out.

2. Personal Data Processed

b2yazilim.com is a corporate website that presents B2 Yazılım's products and services. Only the minimum data necessary for us to be able to contact you and fulfil your request is processed through the site:

Data not processed: Turkish Republic identity number, passport, home/work address and tax/financial information are neither requested nor stored. Your phone number is confirmed by a one-time SMS code (OTP) solely to verify the person submitting the form; the OTP code is kept as an irreversible hash (SHA-256) and the raw code is not stored.

3. Purposes of Processing and Legal Grounds

Phone/e-mail verification (OTP) does not create any commercial-message or marketing consent. Marketing consent is obtained solely with your separate and explicit approval, is recorded in the İYS, and may be withdrawn at any time.

4. Retention Periods

• Contact/demo/support/application form records: for the period necessary to conclude the request; thereafter they

are retained taking into account the maximum litigation/statute-of-limitations periods in the relevant legislation, and are deleted/anonymised at the end of that period.

• Job application/résumé: deleted/anonymised following the application process and a reasonable evaluation period

(may be retained for future evaluation with your explicit consent).

• Phone-verification (OTP) records: kept short-term for verification purposes; after verification the code hash loses

its function.

• Commercial-message consent records: in accordance with the relevant legislation and İYS requirements; consent

history is retained for evidentiary purposes.

• Commercial/financial transaction records (where the service is provided for a fee): invoices and financial

documents are retained for 5 years pursuant to VUK (Tax Procedure Law) Art. 253, and records in the nature of commercial books/documents for 10 years pursuant to TTK (Turkish Commercial Code) Art. 82.

Data is held on servers of a domestic hosting provider located in Türkiye (İstanbul).

5. Transfer Abroad

For the site to function and the service to be provided, your data is processed only through the following service providers, to the extent required by the service:

• SMS delivery (phone verification): SMS Origin infrastructure (Türkiye). Only your phone number is processed so

that the verification code can be delivered. No transfer abroad is involved.

• Commercial message / İYS: via the Message Management System (İYS) (Türkiye) and SMS/call infrastructure; your

consent record is processed into the İYS.

• Web analytics (only with your explicit consent): Google Analytics 4 (Google LLC — USA) and Microsoft Clarity

(Microsoft — USA). These tools operate only if you give cookie consent; if you do not consent, no analytics cookie is loaded and no transfer abroad takes place in this context.

• Content delivery / security (CDN): Cloudflare, Inc. (USA) — for site security and acceleration, all traffic

technically passes through the Cloudflare network. This transfer is carried out on the basis of an appropriate safeguard (the standard contract of the Personal Data Protection Board) pursuant to KVKK Art. 9.

• E-mail notification: Form notifications are delivered via Uzman Posta (a domestic provider — Türkiye); no

transfer abroad is involved in this context.

6. Method of Collecting Personal Data

Your personal data is collected electronically through the contact, demo-request, support and job-application forms on our website, the phone-verification process and (if you consent) cookies.

7. Your Rights (KVKK Art. 11)

In relation to your personal data, you have the right to: learn whether it is being processed, request information, request its correction/deletion, object to the processing, and request compensation for damage.

• Withdrawing commercial-message consent: via the opt-out link at the bottom of each commercial message, through the

İYS, or via [email protected].

• Deletion/anonymisation of your data: you may request this through the application channels below.

You may submit your requests via [email protected], via our KEP address [email protected], or in writing to our head-office address (İstanbul Üniversitesi Avcılar Yerleşkesi, Argem Binası, K:1 No:104, Avcılar / İstanbul). Applications are concluded within the maximum period set out in the legislation.

8. Cookies

Our website uses two types of cookies:

• Strictly necessary cookies: required for the site to operate, for security and for your language/session

preference; these do not require consent.

• Analytics/marketing cookies: for visit statistics and improving the usage experience (Google Analytics 4,

Microsoft Clarity). These cookies are loaded only when you consent via the cookie notice; if you do not consent, they do not operate.

You may change your cookie preferences at any time from the cookie-notice panel on the site. For details, see the Cookie Policy.

Version: 1.0 · This notice may be updated; material changes will be announced on our website.