KVKK privacy notice

This notice is for everyone who uses Efespay or whose records are kept through Efespay: business owners and team members, customers who pay businesses, people who apply to the partner program, visitors to efespay.com and anyone who writes to us through the contact form.

Efespay is a product name. The business that provides the service, referred to in this notice as "we" or the data controller, is:

Our position regarding your personal data depends on the purpose of the processing and on whose behalf it is done.

• Data we control. Your Efespay account (name, email, phone, password), business and live application details, subscription and billing details, partner applications, support conversations, the contact form, website visits and records kept for the security of the service. We decide for what purpose and how this data is processed.
• Data we process on behalf of businesses. Records sent to Efespay or created in Efespay for a business's payment operations: payment sessions and attempts, order references and amounts, details of the paying customer provided by the business, transaction results, refund and notification (webhook) records, and the business's customer records. The data controller for these records is the business concerned. We process this data only on the business's instructions and to provide the service.

Data we process as a data controller:

• Identity and contact: first name, last name, email address, phone number.
• Account and transaction security: an irreversible hash of your password, verification codes, session and device details, IP address, login and activity records.
• Business and live application: business name and type, legal name, tax ID and tax office, address, contact details, industry and monthly volume range.
• Subscription and billing: billing name, Turkish ID or tax number, tax office, address, the chosen plan and payment status. Card details never reach Efespay; they are entered on the payment institution's page.
• Partner program: the identity, contact, tax and bank details in the application form; referral and commission records.
• Support and contact form: the content of your message and the business name you give.
• Efespay Assistant usage: the messages you write to the assistant, its replies, the actions you approve and your monthly usage count.
• Marketing consent: your email and SMS preferences, if you gave consent.
• Cookies: session and preference data; analytics data if you consent (cookie policy).

As a data processor, we process the following data sent by a business or created during payment: the paying customer's name, email address and phone (if the business provides them); order reference, amount and currency; payment attempts and the result returned by the provider; refund records; notification (webhook) delivery records. Card numbers never reach Efespay; card details are entered in the payment service provider's secure area.

As a data controller, we process your data on the following grounds listed in KVKK art. 5:

• Establishing and performing a contract (art. 5/2-c): opening an account and logging in, registering a business and reviewing its live application, the subscription, payment and invoicing, running the partner program, answering support requests, and mandatory service notifications.
• Legal obligation (art. 5/2-ç): keeping records required by tax and commercial legislation, and requests from authorized institutions.
• Establishing, exercising or protecting a right (art. 5/2-e): records that must be kept as evidence in case of a dispute.
• Legitimate interest (art. 5/2-f): account and service security, preventing misuse, fixing bugs, and improving the service through aggregate usage measurements that don't identify individuals.
• Explicit consent (art. 5/1): sending commercial electronic messages and optional analytics cookies. You can withdraw your consent at any time.

For records we process as a data processor, the purpose and legal ground are set by the business concerned (for example, collecting payment for an order, refunds, informing the customer). The business is responsible for informing its customers and, where necessary, obtaining their explicit consent.

Your data is collected, by automated or partly automated means, from you through the efespay.com website, the web dashboard, the mobile app, the API, the contact form and email; from records businesses enter in the dashboard or send through the API; from transaction results returned by the banks and payment institutions a business connects; and from SMS providers' delivery reports.

Personal data is shared only as far as necessary and limited to the purpose, with the following groups of recipients:

• Server, database, file storage, backup and email delivery service providers.
• Payment institutions for subscription payments (iyzico; Stripe if the foreign card option is on).
• Banks and payment institutions a business connects: to send payment requests, query results and process refunds; for SMS, the Netgsm or Twilio account the business connects.
• Apple and Google notification services, to deliver mobile notifications.
• Providers of AI language model services, to generate Efespay Assistant replies; only the content needed to answer the question concerned is sent.
• Public institutions authorized by law and, in case of a dispute, our legal advisers.

Some of these providers may have servers abroad. Transfers abroad are made in line with KVKK art. 9: to countries with an adequacy decision, with appropriate safeguards such as the standard contracts announced by the Board, or in the incidental transfer cases listed in the law.

• Account, subscription and billing records: for the duration of membership and, after it ends, for the period required by tax and commercial legislation.
• Security and access records: for the period required by the relevant legislation.
• Support and contact form conversations: for a reasonable period after the request is resolved, for possible disputes.
• Records processed on behalf of businesses: for the duration of the service; when the business is deleted or the business requests it, they are deleted or anonymized, subject to statutory retention obligations.
• Marketing consent: until it is withdrawn.

Under KVKK art. 11, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties to whom it has been transferred; to request its correction if it is incomplete or inaccurate, its deletion or destruction when the legal conditions are met, and notification of these actions to the third parties to whom it was transferred; to object to an outcome against you resulting from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.

You can submit your application to info@efespay.com from the email address registered to your account, or in writing to Ahmet Aksungur (Aksungur Yazılım), Karşıyaka Mah. 3923 Sk. Tez Apt. No: 2 İç Kapı No: 1 Kepez / Antalya. Your application is concluded free of charge within 30 days at the latest; if the process involves an additional cost, the fee set by the Personal Data Protection Board may apply. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board.

You can delete your Efespay account yourself in the account settings in the app; records subject to statutory retention obligations are kept for that period.

This notice is updated when necessary. The current version is published on this page; the "Last updated" date at the top of the page applies.