Personal Data Protection

WAAIY PRIVACY NOTICE UNDER THE TURKISH PERSONAL DATA PROTECTION LAW

Last Updated: August 13, 2026

1. Data Controller

Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by:

-

acting in the capacity of the data controller.

Address: -
Email: -
Phone: -
MERSIS No.: -
Tax No.: -

In this Notice, Waaiy shall be referred to as "Waaiy", the "Company", "we", or the "Data Controller".

2. Personal Data Processed

Within the scope of providing Waaiy services, the following personal data may be processed:

  • First and last name;

  • Email address;

  • Phone number;

  • Company and business information;

  • Tax information;

  • Billing information;

  • User account information;

  • IP address;

  • Login and logout records;

  • Device and browser information;

  • Transaction security records;

  • Usage and transaction history;

  • Support requests and communication records;

  • Payment and subscription information;

  • Technical data relating to the use of the Website and Platform;

  • Content uploaded to the Platform by the User that may contain personal data.

Payment card information may be processed by the relevant payment service providers depending on the payment infrastructure used. Unless necessary, Waaiy aims not to store complete payment card information within its own systems.

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

  • creating and managing your Waaiy account;

  • verifying the identity of the User;

  • providing the Services;

  • managing subscription transactions;

  • processing payments and billing;

  • providing technical support;

  • managing customer relations;

  • ensuring the security of the Platform;

  • preventing unauthorized access;

  • detecting fraud and misuse;

  • improving the Services;

  • analyzing system performance;

  • detecting errors and security issues;

  • fulfilling legal obligations;

  • managing legal disputes;

  • evaluating requests and complaints;

  • improving the User experience;

  • sending commercial electronic communications where explicit consent has been obtained.

4. Legal Grounds for Processing Personal Data

Your personal data may be processed on the legal grounds specified under Article 5 of the KVKK, including:

  • processing being expressly provided for by law;

  • processing being necessary for the establishment or performance of a contract;

  • processing being necessary for the Data Controller to fulfill its legal obligations;

  • processing being necessary for the establishment, exercise, or protection of a right;

  • processing being necessary for the legitimate interests of the Data Controller;

  • the explicit consent of the data subject.

5. Transfer of Personal Data

Your personal data may be transferred, to the extent necessary and for the purpose of providing the Services, to:

  • payment service providers;

  • hosting and server providers;

  • cloud service providers;

  • email and communication service providers;

  • technical service providers;

  • accounting and financial advisory service providers;

  • legal and consultancy service providers;

  • authorized public institutions and organizations;

  • legally authorized persons and entities.

Where the transfer of personal data abroad is involved, such transfers shall be carried out in accordance with the applicable provisions of the KVKK concerning international transfers of personal data.

6. Methods of Collecting Personal Data

Your personal data may be collected through automated or partially automated methods via:

  • the Waaiy website;

  • the Waaiy user panel;

  • registration and membership forms;

  • purchase and payment pages;

  • contact forms;

  • support requests;

  • email communications;

  • cookies;

  • log records;

  • APIs and technical systems.

7. Retention Period

Personal data shall be retained for the period required for the purposes for which it is processed and in accordance with the applicable statutory retention periods.

Upon expiration of the applicable retention period, personal data shall be deleted, destroyed, or anonymized in accordance with applicable legislation.

8. Rights of the Data Subject

Pursuant to Article 11 of the KVKK, the data subject has the right to:

  • learn whether their personal data is being processed;

  • request information regarding the processing of their personal data if it has been processed;

  • learn the purpose of processing and whether the data is used in accordance with such purpose;

  • know the third parties to whom their personal data has been transferred, whether within Türkiye or abroad;

  • request the correction of incomplete or incorrectly processed personal data;

  • request the deletion or destruction of personal data under the conditions stipulated by the KVKK;

  • request notification of the relevant actions taken to third parties to whom the personal data has been transferred;

  • object to the occurrence of a result against the data subject as a result of the analysis of processed data exclusively through automated systems;

  • request compensation for damages in the event of suffering damage due to unlawful processing of personal data.

9. Application Method

You may submit your requests within the scope of the KVKK in writing to:

Email:

Applications shall be evaluated in accordance with the procedures and time limits specified under the KVKK and applicable secondary legislation.

10. Updates

Waaiy may update this Privacy Notice due to changes in applicable legislation or changes to its Services.

The current version of this Notice shall be published on the Waaiy website.

Waaiy