Privacy Policy and KVKK Privacy Notice
Last updated: 28 September 2026 · Version 2026-09-28.2
This text is a translation provided for information purposes; in the event of a dispute, the Turkish text shall prevail.
This text is the privacy notice prepared under Article 10 of Personal Data Protection Law No. 6698 ("KVKK") and explains how personal data is processed in the KaliteGO service.
1. Data controller
ZincirX Inc. is the data controller for your account, contact, payment and security data. The Service is operated from Türkiye on behalf of ZincirX Inc. by ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.; this company processes your data only on ZincirX Inc.'s instructions and in order to provide the Service, and is the point of contact for your requests in Türkiye.
Data in company content: The content your company enters into KaliteGO (for example, training participants, audit findings, responsible persons, supplier contacts) may include personal data belonging to other individuals. For such data, the relevant company is the data controller; we process this data solely on the company's instructions and as a data processor in order to provide the Service. Requests concerning this data should be addressed to the relevant company.
2. Personal data processed
| Category | Data |
|---|---|
| Identity and contact | Full name, email address, your job title at the company |
| Account | A hash of your password (the password itself is not stored), two-factor authentication data (encrypted), your Google account ID if you sign in with Google, your roles and memberships, and the version and date on which you accepted the terms of use |
| Company | Company name, address, phone, email, general manager's name, scope statement and website; the standards selected by the company |
| Company content | Documents and their revisions, approval records, corrective action, audit, risk, training, supplier, calibration, objective and certification records; AI generation logs |
| Payment | Plan, amount, currency, date, payment status, Stripe customer and subscription IDs or ZincirX order and invoice numbers, billing address, tax office and tax number (VKN) or Turkish ID number. Your card details are processed by Stripe; we do not see or store your card number. |
| Transaction security | IP address, session information, browser information, activity records (who changed what and when) and server logs |
3. Purposes of processing and legal grounds
| Purpose | Legal ground (KVKK Art. 5(2)) |
|---|---|
| Opening and managing the account, inviting users to the company, storing documents and records, sending notification emails | Formation and performance of a contract (c) |
| Generating document drafts with AI when you choose to, and extracting company information from the company website | Performance of a contract (c) |
| Managing the subscription and payments, and keeping invoice and accounting records | Performance of a contract (c); legal obligation (ç) |
| Keeping track of changes to documents and records (audit trail) | Performance of a contract (c); establishment, exercise or protection of a right (e) |
| Ensuring the security of the Service, preventing misuse, fixing errors | Legitimate interest (f); legal obligation (ç) |
| Complying with requests from competent authorities and courts | Legal obligation (ç) |
We don't send marketing emails, we don't use your data for advertising, and we don't use your data to train AI models.
4. Method of collection
Your data is collected electronically, by automated or partly automated means, through registration and profile forms, Google sign-in, forms and modules within the Service, the payment providers Stripe and ZincirX, and strictly necessary cookies.
5. Transfer of data
We share data with the following recipients only to the extent necessary to provide the Service:
| Buyer | Purpose | Location |
|---|---|---|
| ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. | Operation of the Service on behalf of ZincirX Inc., support and maintenance | Türkiye |
| Hostinger | Hosting the Service and data; sending notification emails | Lithuania (EU) |
| Stripe | Managing card (USD) subscriptions and payments, issuing invoices and receipts | USA / Ireland |
| ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. (ZincirX payment page) and the payment institution Tosla (Akbank) | Collecting and invoicing Turkish lira payments | Türkiye |
| Anthropic (Claude) | Generating document drafts with AI: template content and the company information required for generation | USA |
| Sign in with Google; company website analysis and classification (Gemini) | USA | |
| Competent public authorities and courts | Legal claims | Türkiye |
As some of these recipients are located abroad, your data is transferred outside Türkiye. Cross-border transfers are carried out in accordance with the procedures and safeguards set out in Article 9 of KVKK.
6. Retention periods
- Account and company content: for as long as the account and company record remain open. Deleted or anonymized within 30 days of a closure request at the latest; deleted from backups within the backup cycle (at most 14 days).
- Payment and accounting records: for the period required by the applicable tax and commercial legislation (5–10 years).
- Server and security logs: for as long as the security purpose requires, up to 2 years.
7. Your rights (KVKK Art. 11)
You can exercise the following rights by applying to the data controller:
- to learn whether your personal data is being processed and, if so, to request information about it,
- to learn the purpose of processing and whether the data is used in accordance with that purpose,
- to know the third parties in Türkiye or abroad to whom your data is transferred,
- to request correction if it is incomplete or has been processed incorrectly,
- to request erasure or destruction within the framework of the conditions set out in Article 7 of KVKK,
- to request that third parties to whom the data has been transferred be notified of the correction, deletion or destruction,
- to object to an outcome detrimental to you arising from the analysis of the processed data exclusively by automated systems,
- to claim compensation if you suffer damage as a result of unlawful processing.
So that we can verify your identity, you can submit your request by writing to bilgi@kalitego.com from the email address registered to your account, or in writing to one of the addresses below. We will conclude your request free of charge within 30 days at the latest. If your request is rejected or you find the response inadequate, you may lodge a complaint with the Personal Data Protection Board.
8. Cookies
We only use cookies that are strictly necessary for the Service to work; we don't use analytics or advertising cookies. See the Cookie Policy for details.
9. Security
Connections are encrypted with TLS, passwords are stored as hashes, two-factor authentication is supported, and each company can access only its own data. No system is completely secure; in the event of a data breach, we will notify the data subjects and the Board as required by KVKK.
10. Changes
We may update this text. The current version is always available on this page; we will also notify you separately of significant changes.
Service provider
- Seller and data controller
- ZincirX Inc.
- Country
- United States (Delaware)
- Address
- c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, ABD
- bilgi@kalitego.com
- Phone
- +90 536 587 41 81
The Service is operated from Türkiye on behalf of ZincirX Inc. by the company below; this company is your point of contact in Türkiye.
- Legal name
- ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.
- Address
- Teknopark İzmir, İYTE Kampüsü, 35430 Urla/İzmir, Türkiye
- Tax office / no.
- Urla Vergi Dairesi 9991441373
- MERSİS
- 0999144137300001