KVKK Privacy Notice
1. Data controller
Under Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by Sendix as data controller, as described below. This is a translation; the Turkish version prevails.
- Service
- Sendix
- Legal status
- Individual developer (not a registered company)
- Address
- Available on request at [email protected]
- [email protected]
- Web
- sendix.dev
- Country
- Türkiye
This notice is for Sendix website visitors, customers, customer staff and people who contact us. For personal data in email that customers send or receive through Sendix, the customer is the controller; Sendix processes that data as processor, and informing recipients is the customer’s responsibility.
2. Categories of personal data
| Category | Data |
|---|---|
| Identity | Name |
| Contact | Email address; for some payment providers, phone number and billing address |
| Customer transactions | Plan, orders, invoice and payment records, support requests |
| Transaction security | IP address, browser and device data, session and sign-in records, password and API key hashes, two-factor data, audit records |
| Finance | Payment status and payment provider references (we do not store card details) |
| Legal transactions | Records of acceptance of agreements and policies, correspondence, abuse reports |
| Marketing | Not processed |
3. Purposes
- running registrations and accounts and providing the Service;
- performing contracts, payments, invoicing and refunds;
- information security, preventing fraud and abuse, protecting email recipients;
- customer support and requests, service and security notices;
- meeting accounting, tax and commercial law obligations;
- using records as evidence in disputes, establishing and protecting rights;
- providing information to competent persons and authorities;
- improving the Service with aggregated, de-identified statistics.
4. Legal bases and collection method
Your data is collected electronically through the website, dashboard, API and email — provided by you or collected automatically while you use the Service, from Google or GitHub if you sign in with them, and from the payment provider you choose. It is processed on these legal bases in Article 5(2) KVKK:
- (c) it is directly related to the conclusion or performance of a contract;
- (ç) it is necessary to fulfil a legal obligation of the controller (including tax, commercial and Law No. 5651 obligations);
- (e) it is necessary to establish, exercise or protect a right;
- (f) it is necessary for the legitimate interests of the controller, provided it does not harm your fundamental rights and freedoms.
We do not carry out any processing based on explicit consent. If we ever do, we will ask for your consent separately and freely.
5. Transfers
Within Türkiye: our hosting providers ODEAWEB Bilişim Teknolojileri San. ve Tic. Ltd. Şti. (Bilhost) and Alastyr Telekomünikasyon A.Ş.; PayTR and iyzico if you choose them at checkout; competent public authorities and courts under our legal obligations.
Abroad: Cloudflare, Inc. (USA) for security and delivery of web traffic; Google LLC and GitHub, Inc. (USA) if you sign in with them; Stripe, Dodo Payments, OxaPay and NOWPayments if you choose them at checkout; Knoku if you open the documentation assistant. The complete, current list is on the Sub-processors page.
Transfers abroad are carried out in line with Article 9 KVKK, by putting in place one of the appropriate safeguards it provides (such as signing the standard contract published by the Board and notifying the Authority) or, for occasional transfers, relying on the exceptions in Article 9(6) (for example where necessary to perform a contract).
6. Retention and destruction
Your data is kept for as long as the purpose requires and for the periods set by law, and then deleted, destroyed or anonymised. Main periods: account data while the account exists; audit and security logs 365 days; encrypted backups 14 days; payment records as long as tax law requires (up to 10 years); records of acceptance of agreements up to 10 years after account deletion. All periods are listed in section 8 of the Privacy Policy.
7. Your rights under Article 11 KVKK
By applying to the controller you have the right to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of processing and whether it is used accordingly;
- know the third parties to whom it is transferred in Türkiye or abroad;
- request correction if it is incomplete or inaccurate;
- request deletion or destruction under the conditions in Article 7 KVKK;
- request that third parties who received the data be notified of correction, deletion or destruction;
- object to a result against you arising exclusively from automated analysis;
- claim compensation for damage caused by unlawful processing.
8. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application in Turkish, stating your identity, address or email address for notifications and your request, by one of these methods:
- a signed letter delivered in person or by post to our postal address, provided on request;
- registered electronic mail (KEP); our KEP address is provided on request;
- an email signed with a secure electronic or mobile signature to [email protected];
- an email to [email protected] from the email address registered with your Sendix account.
We conclude applications as soon as possible and within 30 days at the latest, free of charge. If the request involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, the answer is insufficient or we do not answer in time, you can complain to the Board within 30 days of learning the answer and in any case within 60 days of your application.
Questions about this document: [email protected]