Protection of Personal Data
Information notice under Turkish Law No. 6698 (KVKK)
Last updated: 2026-10-08
1. Data Controller and Scope
This notice is provided by TenderZoom (https://tenderzoom.com) under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and its implementing communiqué on the duty to inform.
This is an information notice, not a consent form. The duty to inform applies independently of consent. For analytics — the only processing that relies on consent — your consent is collected separately and per category in the cookie preferences panel.
- Name / legal name
- Sefa Tayfun Yalçın
- Registered address
- Büyükesat Mah. Koza 1 Cad. Sev Apt. No: 153 İç Kapı No: 8 Çankaya / Ankara
- Tax office
- Cumhuriyet Vergi Dairesi
- [email protected]
- Website
- tenderzoom.com
For requests and questions: [email protected] or [email protected]
2. Personal Data Processed, Purposes and Legal Bases
| Data category | Contents | Purpose | Legal basis |
|---|---|---|---|
| Account and identity data | Email address, name, account preferences and plan. | Creating your account, signing you in and managing your access to the service. | Performance of a contract (KVKK art. 5/2-c) |
| Company profile | Company name, sector/activity, capacity and qualification details. | Matching tenders to your company profile and producing eligibility assessments. | Performance of a contract (KVKK art. 5/2-c) |
| Saved tenders and workspace | Tenders you saved, watchlists and your pipeline records. | Providing the tracking and workspace features you requested. | Performance of a contract (KVKK art. 5/2-c) |
| Alert and notification preferences | Tender alerts you configured, filter criteria and email notification preferences. | Sending you notifications for tenders matching the criteria you set. | Performance of a contract (KVKK art. 5/2-c) |
| Opportunity scores | Fit scores computed between your company profile and tenders. | Prioritising the tenders that fit you best. | Performance of a contract (KVKK art. 5/2-c) |
| Organisation membership data | Your membership and role, if you belong to an organisation account. | Managing team access and authorisation. | Performance of a contract (KVKK art. 5/2-c) |
| Market access checks | Market/country readiness checks and status notes you saved. | Providing the market-entry readiness tracking you requested. | Performance of a contract (KVKK art. 5/2-c) |
| Contact and analysis form data | Name, email, phone, company name and the message/request content; any other details you add to your request. | Receiving and assessing your request and replying to you. Your submission is also kept in the business's own request-management records so the request can be followed up. | Legitimate interest (KVKK art. 5/2-f) |
| Technical and security data | Session data, security-related server logs and strictly necessary cookies. Analytics data is NOT included here; it is collected only with your explicit consent. | Operating the service securely, preventing abuse and diagnosing faults. | Legitimate interest (KVKK art. 5/2-f) |
| Analytics data (only with explicit consent) | Microsoft Clarity session replay and heatmap data. Without your consent this technology is never loaded and no data is collected. | Identifying usability problems and improving the product. | Explicit consent (KVKK art. 5/1) |
3. Method of Collection
4. Transfers, Including Transfers Abroad
To provide the service we rely on the providers below (processors or recipient groups). Their infrastructure may be located, or they may be established, outside Türkiye; in that case your personal data is transferred abroad. Where the processing location is verified it is stated:
- Supabase — Database, authentication and session management. Database infrastructure: Frankfurt, Germany.
- Microsoft Clarity — Analytics: session replay and heatmaps (only with your explicit consent).
- Güzel Hosting (SMTP) — Transactional email delivery (notifications and digest emails).
- Hosting and network infrastructure providers (Cloudflare, Netcup) — Hosting the site, content delivery and network security; requests to the site (including the IP address) pass through this infrastructure.
- Form notification email service (Web3Forms) — Delivering contact and analysis form submissions to our team by email.
- Google (only when “Sign in with Google” is chosen) — Authentication with your Google account.
- Rate-limiting service (Upstash; when configured) — IP-address-based request counters to prevent abuse.
- Flag image content delivery service — Loading country-flag images; your IP address and browser details are sent to this service when an image is requested.
No payment provider is currently integrated, so we process no card or payment data. Integration with the payment institution iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) is planned for paid subscription payments. Once live, your card details will not be sent to TenderZoom but taken on the payment institution's own secure page; payment data will be subject to that institution's own privacy notice, and this text will be updated.
Transfer to the analytics provider happens ONLY if you give explicit consent; without consent the technology is never loaded. You can withdraw your consent at any time.
Your personal data may also be disclosed to competent public authorities where legislation requires it. Your data is never sold or rented to third parties.
5. Cookies and Similar Technologies
Every cookie and browser-storage technology we use is listed individually — with its purpose and retention — in the Cookie Policy. No non-essential technology is loaded before you allow it.
6. Retention Periods
- Account and service data: kept while your account is open.
- When you delete your account: the "Delete my account" action on the Account page permanently removes the records linked to your account.
- Contact and analysis form submissions: kept for as long as needed to handle and answer your request. They are not linked to your account, so they are not covered by "Delete my account" or "Download my data"; use the KVKK request channel for them.
- Free-trial entitlement record: to prevent the free trial from being used again, your email address (lowercased) is kept after your account is deleted.
- Strictly necessary cookies and session records: for the durations stated in the Cookie Policy.
- Consent record (tz_consent cookie): 180 days; you are asked again when it expires or the policy version changes.
- Analytics data: collected only while you consent; its retention is governed by Microsoft Clarity's own policy.
7. Your Rights as a Data Subject (KVKK art. 11)
- Learn whether your personal data is processed
- Request information if it has been processed
- Learn the purpose of processing and whether it is used accordingly
- Know the third parties to whom it is transferred, at home or abroad
- Request rectification if it is incomplete or inaccurate
- Request erasure or destruction within the conditions set out in the Law
- Request that rectification/erasure be notified to third parties it was transferred to
- Object to an adverse outcome produced solely by automated analysis
- Claim compensation for damage arising from unlawful processing
Two of these rights can be exercised directly in the product: "Download my data" on the Account page provides a copy of your data, and "Delete my account" removes the records linked to your account.
For other requests, write to [email protected]. Under KVKK art. 13 requests are answered within 30 days at the latest.
Contact for KVKK Requests
You can submit requests about your personal data, together with information verifying your identity, through the channels below.
Related pages