Privacy and protection of personal data

Last updated: 22 October 2026

1. Purpose and Scope

As Devsfield Yazılım Teknolojileri A.Ş. and its affiliate DevsGate Yazılım Ltd., we are aware of how important privacy, information security and the protection of personal data are for our clients, business partners, employees and website visitors.

We are committed to conducting our activities in line with transparency, honesty, accountability, fair conduct and internationally recognized ethical principles . In our software development and technology services we consider respect for human rights, responsible use of technology, confidentiality of information and protection of personal data among our core principles. In our business relationships we rely on open communication, acting with awareness of our responsibilities and building long-term relationships of trust with our clients.

This Privacy Policy explains our general approach to protecting the confidentiality of information within the scope of our websites, corporate communication channels and software development services.

This policy does not replace the Personal Data Notice (KVKK), which contains the detailed legal information on the processing of personal data.

2. Information We May Process

Depending on the nature of our activities and your relationship with us, the following categories of information may be processed:

Identity and contact information

First name, last name, corporate email address, phone number, job title and company details.

Business and project information

Project requirements, technical documentation, business correspondence, support requests and information covered by contracts.

Technical information

Technical records that may be required to support the operation, security and performance of websites and systems.

Recruitment information

CV, professional experience, education and contact details submitted as part of a job application.

Client data

Data provided by the client or generated within the scope of the service, depending on the functions of the software developed or operated.

We process only the information that is necessary to achieve the relevant purpose. Sensitive or special categories of personal data are not collected unless necessary. Where they must be processed, the applicable legal conditions and additional security measures are assessed separately.

3. Purposes of Use

Information may be used for the following purposes, to the extent required by the relevant service and relationship:

• Providing software development, maintenance, support and consulting services.
• Responding to client requests and running projects.
• Concluding contracts and fulfilling contractual obligations.
• Supporting information security, system integrity and service continuity.
• Evaluating and improving the performance of our websites and services.
• Running recruitment and human resources processes.
• Fulfilling legal obligations and protecting our legal rights.

Personal data is processed only for specific and legitimate purposes. The appropriate legal basis for each processing activity is determined within the framework of the applicable legislation.

4. Information Security and Confidentiality

We follow a risk-based information security approach to protect the confidentiality, integrity and availability of information.

Depending on the scope and technical requirements of the service, the following security measures may be applied:

• User authentication and access authorization controls.
• Multi-factor authentication and limiting access rights to what the role requires.
• Secure communication protocols and appropriate encryption methods.
• Access controls for source code and development environments.
• Software testing, code reviews and vulnerability assessment.
• Monitoring and logging security events and responding when necessary.
• Confidentiality, information security and personal data awareness activities for employees.

The scope of security measures is determined according to the relevant system, service, risks and contractual obligations. We are aware that absolute security cannot be guaranteed for data transmission over the internet or for any information system.

5. Client Data and Software Development

We handle our clients' data only for providing the relevant service, fulfilling contractual obligations and the purposes agreed upon.

Depending on project requirements:

• Access to client data is limited to what the role and authorization require.
• Synthetic or appropriately anonymized data is preferred in development and testing processes where possible.
• Access to production data is limited to the extent the service requires.
• Retention, return and deletion of client data are carried out according to the relevant contract and legal provisions.

Whether our companies act as data controller or data processor within a given service is determined by the actual nature of the activity and the contracts.

6. AI-Assisted Development Tools

When AI-assisted tools are used in software development processes, we take confidentiality and information security requirements into account.

The use of these tools in client projects depends on the client's required approval and the applicable contract terms.

Where their use is appropriate:

• Enterprise terms of use and data protection features are evaluated.
• Before client data, personal data, credentials and confidential information are shared with any tool, the required permissions and security conditions are checked.
• Code generated with AI assistance is not exempt from the review and testing requirements of the software development process.

The use of AI-assisted tools does not by itself mean that client data may be used to train the models behind those tools.

7. Sharing of Information

Personal data and other confidential information may be shared with the following groups of recipients where necessary and where an appropriate legal basis exists:

• Cloud, hosting, email, software development and other technology service providers required to deliver the service.
• Business partners and subcontractors authorized within the scope of the relevant service.
• Public authorities, regulators and judicial bodies legally authorized to request information.
• Other parties with whom sharing is required to fulfil contractual or legal obligations.

The scope of sharing is limited to the information that is necessary. The confidentiality, security and personal data protection obligations of the parties involved are assessed within the framework of the applicable contracts and legislation.

8. International Data Transfers

Depending on the nature of the service, some technology providers or infrastructure services may be located outside Türkiye.

Where personal data is to be transferred abroad, the legal conditions required by the applicable legislation and appropriate safeguards are assessed before the transfer.

In client-specific projects, data location, hosting region, sub-processors and transfer conditions are determined according to the relevant contract and project requirements.

This policy alone does not constitute a commitment that a specific data center will be used or that all data will be kept in a specific country.

9. Cookies and Similar Technologies

Cookies and similar technologies may be used on our websites for purposes such as keeping the site working, supporting security and managing user preferences.

If analytics, advertising or other optional cookies are used, the required notice and consent mechanisms are arranged in line with the applicable legislation and the actual configuration of the relevant website.

The types, purposes and retention periods of the cookies used are explained in the cookie notice provided on the relevant website.

10. Retention Periods and Data Disposal

Information is retained for as long as necessary for the processing purposes and within the framework of the applicable legal, contractual or regulatory obligations.

When the retention period ends or the reason for processing no longer exists, the relevant records are deleted, destroyed or anonymized according to the applicable conditions.

Return and deletion of client data at the end of the service are carried out in line with the provisions of the relevant contract.

11. Protection of Personal Data

Legal information on the processing of personal data, including the identity of the data controller, processing purposes, legal bases, data transfers and the rights of data subjects, is explained in the relevant Personal Data Notice (KVKK).

Obligations under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR) are assessed according to the nature of the relevant processing activity.

This Privacy Policy does not replace the separate privacy notices or data processing agreements required by law.

12. Contact

For general questions about our privacy policy or information security approach, you can use the contact channels below.

Which company a formal personal data request should be addressed to depends on the relevant processing activity and the role of data controller. A message sent to the general contact address should not be assumed to constitute a formal request under KVKK in every case.

13. Changes to This Policy

This Privacy Policy may be updated in response to changes in our services, technologies or the applicable legislation. The current text takes effect on the date it is published on the relevant website.

Last updated: 22 October 2026

1. Data Controller

As Devsfield Yazılım Teknolojileri A.Ş. and its affiliate DevsGate Yazılım Ltd., we attach importance to processing your personal data lawfully, protecting it and keeping it confidential.

Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data may be processed by the company that carries out the relevant processing activity and acts as data controller, for the purposes and on the legal bases explained below.

Which company processes your personal data depends on the website concerned, the company you contact and the nature of the activity. The affiliate relationship between the companies does not by itself mean joint controllership.

2. Personal Data Processed and Purposes of Processing

When you visit our websites, use our contact forms or contact our companies by email or other corporate communication channels, the following personal data may be processed, limited to the relevant activity.

2.1. Identity Data

Example data: First name and last name.

Purposes of processing:

• Evaluating and responding to contact requests.
• Conducting business relationships and commercial discussions.
• Conducting pre-contractual discussions and contractual processes.

2.2. Contact Data

Example data: Email address, phone number, company and job title.

Purposes of processing:

• Responding to contact requests.
• Evaluating requests for information about software development and technology services.
• Managing client, business partner and supplier relationships.
• Conducting contractual processes where necessary.

2.3. Transaction Security and Technical Data

Example data: IP address, access time, connection and server logs, technical records of security events and necessary information about website usage.

Purposes of processing:

• Ensuring the security of websites and information systems.
• Detecting unauthorized access and abuse attempts.
• Supporting the operation, integrity and performance of systems.
• Fulfilling legal obligations and preserving the necessary records for possible disputes.

The processing of this data depends on the technical structure of the relevant system and the scope of the records actually collected.

2.4. Request and Correspondence Data

Example data: Messages sent through contact forms, email correspondence, and the content of support and quotation requests.

Purposes of processing:

• Receiving, evaluating and responding to requests.
• Conducting commercial discussions and service processes.
• Recording request and transaction history to the extent necessary.
• Fulfilling legal obligations and protecting rights.

We recommend that you do not include unnecessary personal or sensitive information in your messages when contacting our companies.

3. Legal Bases for Processing Personal Data

Your personal data may be processed on one or more of the applicable legal bases set out in Article 5 of KVKK.

Conclusion or performance of a contract

Your request is directly related to the conclusion or performance of a contract and processing is necessary for it.

Compliance with a legal obligation

Processing is mandatory for the relevant company to comply with the legal obligations it is subject to.

Establishment, exercise or protection of a right

Processing is necessary to assess possible disputes or to protect legal rights.

Legitimate interest

Processing is mandatory for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject.

Explicit consent

Where no other legal basis exists for the relevant processing activity and the law requires it, the valid explicit consent of the data subject is obtained.

The appropriate legal basis is assessed separately for each processing activity. Explicit consent is not a general basis used in every case instead of the other legal bases.

4. Methods of Collecting Personal Data

Your personal data may be obtained through the following methods within the scope of the relevant activity:

• Contact forms on our websites.
• Email and other corporate communication channels.
• Phone calls and commercial correspondence.
• Technical records generated by web servers and security systems.
• Other information provided directly by you.

Depending on the nature of the activity, data may be collected electronically and by automated or non-automated means.

5. Transfer of Personal Data

Provided that it is necessary and an appropriate legal basis exists, your personal data may be transferred to the following groups of recipients, limited to the processing purpose:

• Website, email, hosting, cloud and information technology service providers.
• Business partners and suppliers authorized to deliver the relevant service.
• Legally authorized public authorities, regulators and judicial bodies.
• Relevant parties where necessary for the establishment, exercise or protection of a right.

Data minimization, access restriction and confidentiality principles are observed during transfers.

Where personal data needs to be transferred between Devsfield Yazılım Teknolojileri A.Ş. and DevsGate Yazılım Ltd., the purpose of the transfer, the legal roles of the parties and the appropriate legal basis are also assessed separately.

6. Transfer of Personal Data Abroad

Where some technology, email, hosting or cloud services are located abroad, the transfer of personal data abroad may become relevant.

Where such transfers take place, the applicable transfer conditions and necessary safeguards under Article 9 of KVKK and the related regulations are assessed.

For a specific service or client project, data location, hosting region and sub-processors are determined in line with the relevant contracts and service requirements.

This notice does not mean that personal data is transferred abroad or stored in a specific country in every case.

7. Retention and Disposal of Personal Data

Your personal data is retained for as long as the processing purposes require, taking into account the retention obligations set out in the applicable legislation.

When the retention period ends or the processing purpose no longer exists, personal data is deleted, destroyed or anonymized in line with the applicable legislation and the retention and disposal procedures of the companies.

Retention periods are determined by considering the type of data, the processing purpose, legal obligations and the relevant contract provisions, if any.

8. Rights of the Data Subject

Under Article 11 of KVKK, you may have the following rights regarding the processing of your personal data:

• To learn whether your personal data is being processed.
• To request information if your personal data has been processed.
• To learn the purpose of processing and whether the data is used in line with that purpose.
• To know the third parties to whom your personal data is transferred, in Türkiye or abroad.
• To request the correction of incomplete or inaccurate personal data.
• To request the deletion or destruction of your personal data under Article 7 of KVKK.
• To request that correction, deletion or destruction be notified to the third parties to whom the data has been transferred.
• To object to a result that is to your detriment arising from the analysis of processed data exclusively through automated systems.
• To claim compensation if you suffer damage due to unlawful processing of personal data.

The exercise of these rights is subject to the conditions set out in KVKK and the applicable exceptions.

9. How to Submit a Request

You may submit your requests under KVKK to the relevant data controller in accordance with the procedures set out in the Communiqué on the Procedures and Principles of Application to the Data Controller and other applicable regulations.

Including the following information in your request will make it easier to evaluate:

• Your first name and last name.
• The subject of your request and a clear explanation of what you are asking for.
• The contact details to which you want the response sent.
• Other information needed to evaluate your request.

Requests are evaluated with identity verification where the legislation requires it. A request must be submitted in writing or through the accepted electronic methods, in accordance with its nature and the applicable legislation.

For general contact:

The email addresses above are general contact channels. The channel used for formal requests under KVKK must meet the application requirements set out in the legislation.

Your requests are concluded as soon as possible and within thirty days at the latest, in accordance with Article 13 of KVKK. If the process involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

10. Data Security

Our companies take technical and administrative measures appropriate to the nature and risk level of their activities in order to prevent unlawful processing of and access to personal data and to ensure its safekeeping.

In this context, measures such as access controls, authentication, confidentiality obligations, system security and employee awareness are applied according to the requirements of the relevant processes.

In the event of a security incident or personal data breach, the nature of the incident is assessed and the necessary actions are taken in accordance with the applicable legislation.

11. Updates to This Notice

This Notice may be updated in response to changes in personal data processing activities or the applicable legislation.

The current text is published on the relevant website.