This privacy notice has been prepared by Sora Yazılım Teknolojileri ("Sora Yazılım", "we"), in its capacity as data controller, pursuant to Article 10 of the Kişisel Verilerin Korunması Kanunu No. 6698 (Türkiye's Personal Data Protection Law; the "Law" or "KVKK") and the Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ (the Communiqué on the procedures and principles for fulfilling the obligation to inform). It covers the personal data of persons who visit sora-ik.com, register a company, log in, submit a contact, demo or quote form, file a KVKK request or correspond with us.
About employee data in the Sora İK application: For employee, job candidate and user data that customer companies upload to the Sora İK application, the data controller is the relevant customer company. Sora Yazılım is the data processor that processes this data solely on the customer's instructions and on its behalf. The obligation to inform data subjects about the processing of this data lies with the customer company; the parties' rights and obligations are governed by the Data Processing Agreement. If you are an employee of a customer company, you need to apply first to the company you work for to exercise your rights.
1. Who is the data controller?
| Information | Details |
|---|---|
| Trade name | Sora Yazılım Teknolojileri (to be confirmed) |
| MERSİS (Central Registry System) number | (to be confirmed) |
| Tax office and tax number | (to be confirmed) / (to be confirmed) |
| Address | Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul C1 Blok No: 2B İç Kapı No: 376, Ataşehir/İstanbul |
| KVKK contact email | kvkk@sora-ik.com |
| KEP (registered electronic mail) address | (to be confirmed) |
| Phone | 0510 222 09 17 |
2. Which personal data do we process?
| Data category | Example data | How is it obtained? |
|---|---|---|
| Identity | Full name; in KVKK requests, optionally the Turkish national identity number (T.C. kimlik numarası) or, for foreign nationals, nationality and passport number | Registration, contact, demo and KVKK request forms |
| Contact | Email address, phone number; in KVKK requests, optionally an address for notifications | Forms and email correspondence |
| Company and customer transaction | Company name, tax number (Turkish national identity number for sole proprietorships), employee count range, plan, trial and subscription status; plan request (plan, number of active employees, note); for invoicing, trade name, tax office, tax number, billing address and e-invoice information; records of privacy notice and agreement approvals (type, version, date) | Registration form and the plan request and billing details forms on the account page |
| Account and transaction security | An irreversible hash of your password (the password itself is not stored), login and session records, IP address, browser and device information, email verification and password reset records, the verification result of bot protection | Automatically, while you use the website and your account |
| Request | Request subject, your message, the module you are interested in, the page from which you submitted the form, the source and campaign (UTM) information that brought you to the website, website language | Contact, demo and KVKK request forms |
| Marketing | Your marketing communications consent and consent records (date, IP address), your communication preferences | The optional consent box in forms |
| Cookies and usage | Your cookie preferences; if you consent, page view and usage statistics and online identifiers | Cookies and similar technologies (Cookie Policy) |
Your personal data is collected electronically through forms, email and cookies, by automated and partially automated means. For sole proprietorships, the tax identification number and billing address may also qualify as personal data. We do not request special categories of personal data (for example, health information) through our forms; please do not enter such information in message fields.
3. For what purposes do we process your personal data?
- Creating the company registration and user account, verifying the email address, running the trial period and checking that a trial is opened only once per tax number; evaluating the registration where necessary.
- Establishing and performing the sales and subscription agreement: receiving the plan request, defining the plan, tracking the subscription term and sending service-related notifications (start and end of the trial period, renewal).
- Issuing invoices, tracking payments and fulfilling record-keeping obligations arising from tax and commercial legislation.
- Receiving and responding to your contact, demo, quote, support, partnership and payroll consulting requests.
- Receiving your requests under KVKK, verifying your identity and concluding the requests.
- Ensuring information security: session management, preventing unauthorized access, misuse and bot traffic, rate limiting and keeping audit logs.
- Responding to information and document requests from authorized public institutions and organizations that are based on law.
- Establishing, exercising or protecting our rights in legal disputes.
- If you consent, producing statistics on the use of the website and improving the website.
- With your explicit consent, sending marketing communications about product news, new modules and events.
4. Which legal grounds do we rely on?
Your personal data is processed on the basis of the following processing conditions listed in Article 5 of the Law:
| Purpose | Legal ground |
|---|---|
| Company registration, account, trial period, plan request, subscription and service notifications (purposes 1–2) | Article 5/2-c: processing is directly related to the establishment or performance of a contract; for the data of authorized persons acting on behalf of the company and for checking that a trial is opened only once per tax number, Article 5/2-f: the legitimate interest of the data controller |
| Invoicing and record keeping arising from legislation (purpose 3) | Article 5/2-ç: processing is necessary for the data controller to fulfil its legal obligation |
| Contact, demo, quote and support requests (purpose 4) | Article 5/2-c for requests aimed at establishing a contract, such as quotes and demos; Article 5/2-f for other requests |
| KVKK requests (purpose 5) | Article 5/2-ç (the obligation under Article 13 of the Law) |
| Information security and necessary cookies (purpose 6) | Article 5/2-f; Article 5/2-c for cookies that are strictly necessary for the service requested by the user |
| Requests from authorized institutions (purpose 7) | Article 5/2-ç |
| Legal disputes (purpose 8) | Article 5/2-e: processing is necessary for the establishment, exercise or protection of a right |
| Analytics cookies and usage statistics (purpose 9) | Article 5/1: explicit consent |
| Marketing communications (purpose 10) | Article 5/1: explicit consent |
For processing based on explicit consent, you can withdraw your consent at any time: for analytics cookies, use the "Cookie preferences" link at the bottom of the page; for marketing communications, use the unsubscribe link in the messages; or write to kvkk@sora-ik.com. Withdrawal of consent does not affect processing carried out up to that date. Not consenting to analytics cookies and marketing communications does not prevent you from using the website, submitting forms or registering your company.
5. To whom and for what purposes do we transfer your personal data?
Your personal data is transferred in accordance with Articles 8 and 9 of the Law and only to the extent necessary for the purposes below. Your data is not sold and is not shared with third parties for advertising purposes.
| Recipient | Data transferred | Purpose | Location |
|---|---|---|---|
| Hosting provider: (to be confirmed) | Data held in our systems | Running and backing up the website, the application programming interface (API) and databases | (to be confirmed) |
| Cloudflare R2 (Cloudflare, Inc.) | Data in database backups (including account, consent, request and application records) | Storing database backups | Europe (Eastern Europe, EEUR location hint; the EU jurisdiction option is not used) |
| Email delivery provider: (to be confirmed) | Full name, email address, email content | Sending verification, notification and request response emails | (to be confirmed) |
| Cloudflare, Inc. | IP address, browser information and request information in requests for media files (media.sora-ik.com) | Domain name management (DNS) and delivery of media files (media.sora-ik.com) | Abroad (Cloudflare's global network) |
| Cloudflare Turnstile (Cloudflare, Inc.) | IP address, TLS fingerprint, browser information | Bot verification on form submissions | Abroad |
| Google (Google Analytics 4), only if you consent to analytics cookies | Online identifiers, page view and usage data | Website usage statistics | Abroad |
| Ahrefs (Ahrefs Web Analytics), only if you give analytics consent | Page view and referring source information (no cookies are used) | Measuring website traffic | Abroad |
| Accountant (mali müşavir) and legal advisors | Invoice and contract records; data related to a dispute | Accounting, financial audit and legal advice | Türkiye |
| Authorized public institutions and organizations, judicial authorities | Data requested by law | Fulfilling legal obligations | Türkiye |
Transfer abroad: A copy of the database backups is stored in Cloudflare R2, on servers outside Türkiye (in Europe). Cloudflare delivers media files, and (if you consent) the analytics providers deliver their services, through servers located abroad. Transfers to these providers therefore qualify as transfers abroad within the scope of Article 9 of the Law. These transfers are made on the basis of one of the conditions set out in Article 9 of the Law: an adequacy decision of the Personal Data Protection Board (KVK Kurulu) regarding the country of transfer, one of the appropriate safeguards listed in the fourth paragraph of Article 9 of the Law (for example, a standard contract announced by the Board), or the incidental cases listed in the sixth paragraph of the same article. Basis per provider:.
6. How long do we keep your personal data?
| Data group | Retention period |
|---|---|
| Contact, demo, quote, support and KVKK requests (including identity information provided in the request) | 2 years from the closing of the request; automatically deleted when the period expires |
| Company and user account records, privacy notice and agreement approval records | 10 years from the end of the agreement |
| Applications that are not approved and trial accounts that do not turn into an agreement (including records whose email address has not been verified) | 2 years from the rejection of the application or the end of the trial period |
| Invoice and payment records | 5 years |
| Session records (session token, IP address, browser information) | Until the session ends; at most 30 days |
| Server and security logs | (to be confirmed) |
| Cookies | The period stated for each cookie in the Cookie Policy |
| Marketing consent and communication preferences | Until you withdraw your consent; the consent and withdrawal record is kept for the relevant retention period to prove the consent |
Where laws require a longer retention period or a legal dispute exists, data may be kept for that period. Personal data whose retention period has expired, or for which the reasons requiring processing no longer exist, is erased, destroyed or anonymized in accordance with Article 7 of the Law.
7. What rights do you have under KVKK?
Under Article 11 of the Law, by applying to the data controller, you have the right to:
- Learn whether your personal data is processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing your personal data and whether it is used in line with that purpose,
- Know the third parties, domestically or abroad, to whom your personal data is transferred,
- Request the correction of your personal data if it is incomplete or inaccurately processed,
- Request the erasure or destruction of your personal data under the conditions set out in Article 7 of the Law,
- Request that the correction, erasure and destruction operations be notified to the third parties to whom your personal data has been transferred,
- Object to a result arising against you through the analysis of the processed data exclusively by automated systems,
- Claim compensation for damage if you suffer damage due to the unlawful processing of your personal data.
8. How can you submit your request?
Under the Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ (the Communiqué on the procedures and principles of applications to the data controller), you can submit your request in Turkish through the following channels:
- Web form: Through the KVKK request form.
- Email: To kvkk@sora-ik.com from the email address you previously notified to us and that is registered in our system.
- Written request: With a wet-ink signed petition, delivered by hand or by post to our address in Section 1.
- Registered electronic mail (KEP): To (to be confirmed).
- Secure electronic signature or mobile signature: By sending your request, signed with one of these signatures, to kvkk@sora-ik.com by email.
Under the Communiqué, a request contains the full name; the signature for written requests; the Turkish national identity number for citizens of the Republic of Türkiye, or nationality together with the passport number or, if any, the identity number for foreign nationals; the residential or workplace address for notifications; the email address and telephone number for notifications, if any; and the subject of the request. In our web form, the identity number field is optional: if we can verify your identity through the email address you previously notified to us, we do not need this information. Where we cannot verify your identity, we may request additional information.
Your request is concluded within the period set out in Article 13 of the Law and, as a rule, free of charge; if the process requires an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board. If your request is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the Law.
9. How is this notice updated?
We may update this notice in line with changes in legislation or in our data processing activities. The current version is always published on this page, and the "Last updated" date at the top of the page changes. We notify our registered users of significant changes by email.
Version of this notice: 1.2. During company registration, the record that you have read the privacy notice is stored together with this version number.
This text is a translation of the Turkish original; in case of any discrepancy, the Turkish version prevails.