Effective Date:
1. IDENTITY OF THE DATA CONTROLLER
Pursuant to the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by the company identified below, acting as the data controller:
XPLORE WORK YAZILIM TİCARET LİMİTED ŞİRKETİ
Address: Güvenevler Mah. 1928 Sok. Ekinci Global İş Merkezi Sit. Floor: 14 No: 5/25 Yenişehir, Mersin / Türkiye
Email: support@xplorework.com
Xplore Work aims to carry out its personal data processing activities in accordance with the KVKK, applicable secondary legislation, and other applicable data protection regulations.
2. PERSONAL DATA PROCESSED
Depending on how you use the Platform, your membership status, company verification processes, and the services you use, the following categories of personal data may be processed.
2.1. Identity and Contact Information
- Name and surname
- Company or business name
- Tax identification number
- Commercial activity or business activity code information
- Email address
- Phone number
- Address information
- Authorized representative information
2.2. Company and Official Document Information
As part of company and user verification processes, the following documents and information contained within such documents may be processed:
- Tax certificates
- Producer or business activity certificates
- Trade registry records
- Business and operating licenses
- Authorization documents
- Other official documents submitted for company verification purposes
Submitted documents may be processed for the purposes of verifying the company and/or its authorized representative, ensuring Platform security, and fulfilling legal obligations.
2.3. Account, Transaction, and Usage Data
- IP address
- Device information
- Operating system information
- Session and login records
- Platform transaction records
- Messaging and communication content
- Listing creation, publication, and history information
- Interaction and usage records within the Platform
- Security and error logs
Such data may be processed for the purposes of operating the Platform, maintaining security, improving services, preventing misuse, and resolving technical issues.
2.4. Financial and Subscription Information
The following financial and subscription information may be processed:
- Subscription plan
- Subscription status
- Billing information
- Payment status
- Transaction and purchase records
Where payment card information is not processed directly by Xplore Work, such information is processed by the relevant payment service provider or app store under its own data processing terms.
Xplore Work may access only the limited payment and transaction information necessary to manage subscriptions and payment transactions.
2.5. Location Data
Depending on the features of the Platform, the following location information may be processed:
- Company or business location
- Branch and headquarters locations
- Location information used for map-based display
- Other location information provided by the user through the Platform
Where access to the device’s precise location is required, the necessary permission will be requested through the relevant operating system or device.
3. PURPOSES OF PROCESSING PERSONAL DATA
Your personal data may be processed for the following purposes:
- Establishing and managing Platform membership
- Verifying user and company accounts
- Conducting company verification processes
- Processing subscription and payment transactions
- Providing listing creation and publication services
- Providing commercial matching and communication services
- Operating and improving Platform features
- Ensuring Platform security
- Preventing unauthorized access, fraud, and misuse
- Detecting and investigating suspicious or unlawful activities
- Managing user support requests
- Identifying and resolving technical issues
- Conducting compliance processes relating to international trade, sanctions, and export control regulations
- Responding to lawful requests from authorized public institutions and authorities
- Fulfilling legal obligations
- Establishing, exercising, or protecting legal rights
- Managing and resolving existing or potential legal disputes
4. METHOD OF COLLECTION OF PERSONAL DATA
Your personal data may be collected by wholly or partially automated means or by non-automated means provided that such processing forms part of a data recording system.
Personal data may, in particular, be collected through the following channels:
- Registration and account creation on the Platform
- Creation of user or company profiles
- Uploading official documents to the Platform
- Creation of listings, messages, and other content
- Transaction, security, and log records automatically generated during use of the Platform
- Subscription and payment processes
- User support and communication requests
- Company verification procedures
- Other information directly provided by the user through the Platform
5. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
Your personal data may be processed on the basis of the legal grounds specified under Article 5 of the KVKK and, where applicable, other relevant provisions, depending on the relevant processing activity.
These legal grounds include, in particular:
- Processing being directly related to the establishment or performance of a contract
- Processing being necessary for the data controller to fulfill its legal obligations
- Processing being necessary for the establishment, exercise, or protection of a legal right
- Processing being necessary for the legitimate interests of the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject
- Processing being expressly provided for by law
- Processing of personal data made public by the data subject, in accordance with the data subject’s intention in making such data public
- Explicit consent of the data subject where explicit consent is legally required
Where processing is based on explicit consent, the data subject has the right to withdraw such consent in accordance with applicable legislation.
6. TRANSFER OF PERSONAL DATA
Your personal data may be transferred, to the extent necessary for the relevant processing purposes and in accordance with the conditions set forth under Articles 8 and 9 of the KVKK, to the following recipients or categories of recipients:
- Authorized public institutions and authorities
- Courts and other competent judicial or administrative authorities
- Financial advisors and financial consultants
- Legal advisors and attorneys
- Payment service providers and relevant app store service providers
- Logistics integration service providers
- Cloud computing and hosting service providers
- Technical infrastructure, security, analytics, and software service providers
- Other data processors and service providers engaged for the operation of the Platform
Personal data transfers are carried out only to the extent necessary for the relevant processing purpose and in accordance with applicable legislation.
6.1. CROSS-BORDER TRANSFERS OF PERSONAL DATA
Xplore Work may use technology and infrastructure providers located outside Türkiye or providers that deliver services through servers located outside Türkiye in connection with the operation of the Platform.
As Google Firebase and other necessary technical infrastructure services may be used in connection with the Platform, certain personal data may be processed, stored, or transferred to data centers located outside Türkiye.
Cross-border transfers of personal data are carried out in accordance with Article 9 of the KVKK and the relevant secondary legislation.
Depending on the nature of the transfer, the mechanisms provided under the KVKK may include:
- The existence of an adequacy decision issued by the Turkish Personal Data Protection Board in relation to the relevant country, one or more sectors within that country, or an international organization
- Where no adequacy decision exists, implementation of one of the appropriate safeguards provided under the KVKK
- Where appropriate, use of standard contracts published by the Turkish Personal Data Protection Board
- Where applicable, use of binding corporate rules or other appropriate safeguard mechanisms
- Where neither an adequacy decision nor appropriate safeguards are available, reliance on the exceptional transfer circumstances provided under the KVKK only where the statutory requirements for such transfer are satisfied
Xplore Work implements processes aimed at maintaining the technical, administrative, and contractual safeguards required by applicable legislation for the protection of personal data transferred abroad.
7. RETENTION PERIOD OF PERSONAL DATA
Your personal data is retained for as long as necessary for the relevant processing purpose and in accordance with statutory retention periods prescribed under applicable legislation.
In determining retention periods, the following may be taken into consideration:
- The period during which the user account remains active
- The duration of the relevant service or subscription relationship
- Statutory retention obligations
- Obligations arising from tax, commercial, and accounting legislation
- Periods necessary for the establishment, exercise, or protection of legal rights
- Applicable limitation periods relating to existing or potential legal disputes
When the reasons requiring the processing of personal data cease to exist and the applicable statutory retention periods expire, personal data is deleted, destroyed, or anonymized in accordance with the KVKK and applicable legislation.
8. PERSONAL DATA SECURITY
Xplore Work implements processes aimed at taking appropriate technical and administrative measures to prevent unlawful processing of personal data, prevent unlawful access to personal data, and ensure the secure storage of personal data.
Depending on the circumstances, such measures may include:
- Authorization and access controls
- User authentication mechanisms
- System and security logging
- Restriction of data access privileges
- Technical security measures
- Restriction of access to authorized personnel
- Data security procedures
- Implementation of necessary data protection obligations with service providers
Access to official documents submitted for company verification purposes is intended to be limited to personnel who are authorized to access such documents within the scope of their duties.
9. YOUR RIGHTS UNDER THE KVKK
Pursuant to Article 11 of the KVKK, data subjects whose personal data is processed have the right to apply to the data controller and:
- Learn whether their personal data is being processed
- Request information if their personal data has been processed
- Learn the purpose of processing their personal data and whether such data is being used in accordance with that purpose
- Know the third parties to whom their personal data has been transferred, whether within Türkiye or abroad
- Request correction of personal data where it has been processed incompletely or inaccurately
- Request deletion or destruction of personal data under the conditions set forth in Article 7 of the KVKK
- Request notification to third parties to whom personal data has been transferred of any correction, deletion, or destruction carried out in relation to such personal data
- Object to any result arising against the data subject as a result of the analysis of processed personal data exclusively through automated systems
- Claim compensation for damages suffered as a result of unlawful processing of personal data
10. APPLICATION PROCEDURE
You may submit requests concerning your rights under the KVKK to Xplore Work in accordance with Article 13 of the KVKK and the procedures and methods prescribed under applicable legislation.
Requests may be submitted using the following contact information:
XPLORE WORK YAZILIM TİCARET LİMİTED ŞİRKETİ
Address: Güvenevler Mah. 1928 Sok. Ekinci Global İş Merkezi Sit. Floor: 14 No: 5/25 Yenişehir, Mersin / Türkiye
Email: support@xplorework.com
Depending on the nature of the application, additional information or documentation may be requested for the purpose of verifying your identity.
Applications will be reviewed and concluded within the time periods prescribed under the KVKK and applicable legislation.