The notice applies to the apply.tr website, the enquiry form and any message you send to one of our @apply.tr mailboxes. It does not govern information we handle inside clients' own systems, for example while administering their server or Microsoft 365 tenant. There, the client is the data controller (veri sorumlusu), while Apply works for it as veri işleyen, bound by the processing contract we have signed with that client.
Who is responsible
Your data is controlled by Apply LLP, the owner of the Apply brand and of this website. It is established outside Turkey, yet because it serves people and organisations in Turkey it follows KVKK, and where people in the EU are concerned it also complies with the GDPR.
- Name - Apply LLP, represented by its director, Andrey Vasin
- Address - 62B Bukhar Zhyrau Boulevard, Almaty 050057, Kazakhstan
- Company number (BIN) - 220540005599, issued in Kazakhstan
- Where to send data protection questions - office@apply.tr
- Representative in Turkey and VERBİS - [to be confirmed: whether a data controller representative is appointed in Turkey, with name and contact details; VERBİS registration status; an EU representative if required]
Privacy messages reaching office@apply.tr are handled by the team member responsible for data protection. The remaining company information is on the Legal notice page.
Information we handle
We ask only for what is genuinely needed to answer you or to perform a contract. No ID card numbers, health data or other sensitive (özel nitelikli) data are requested on the site, and the site is not designed for minors. Data reaches us electronically, partly by automated means, through the form, email and video calls.
- Enquiry form - name, the email or other contact point for our reply, the topic selected and whatever you write.
- Technical data attached to a submission - the URL where the form was used, the IP address and the user agent reported by your browser; these help us weed out spam and misuse.
- Client relationship - contact persons on the client side, billing details and contract-related emails.
- Support tickets - how the problem was described, how the ticket developed and the engineers' notes.
- Individuals' payments - sum, date and transaction reference only. Card numbers stay with the payment company.
Never type passwords into the form or a normal email. Log-in details for your systems travel only through an encrypted route we set up together in advance.
Why we use it
- To reply to your enquiry and prepare a proposal.
- To sign and fulfil agreements with you or the business you represent.
- To work through support tickets and keep a traceable record of the work.
- To issue invoices and meet obligations under tax and commercial law.
- To shield the website from spam, bots and attacks.
- To establish, exercise or defend a legal claim should a dispute ever arise.
There is no profiling, no automated decision that produces legal or similarly significant effects for you, and no marketing messages unless you have given explicit consent.
Why we are allowed to, and for how long
Every purpose is tied to a processing condition recognised by KVKK and has a defined storage period. After it expires, and provided no law still requires us to keep the records, we erase, destroy or anonymise it in line with our retention and destruction policy. For EU visitors, the matching GDPR bases are contract, legal obligation and legitimate interest.
| Activity | Processing condition | Storage period |
|---|---|---|
| Replying to messages from the form or mailboxes | Processing directly linked to concluding a contract (the preliminary talks you initiated), plus our legitimate interest where it does not override your fundamental rights | While the conversation and any follow-ups are ongoing, or until you object |
| Delivering contracted services and support | Processing directly linked to concluding or performing a contract | For the life of the contract, then until potential claims under it lapse |
| Billing and bookkeeping | Fulfilment of a legal obligation resting on the controller | As long as the applicable legislation obliges us to retain them |
| Keeping the website safe from misuse | Our legitimate interest in a secure site | Network identifiers such as IP and user agent only while needed to spot and look into abuse |
| Settings stored locally | Essential for operating the site | Until you remove them yourself |
Cookies and local settings
You will find no analytics tools, advertising pixels or tracking cookies on apply.tr. The only cookies set are technically essential ones: a session cookie and a security cookie that guards the form against CSRF attacks. Without them an enquiry cannot be submitted, and both expire when the session ends. The Turkish Personal Data Protection Authority's guidance on cookies likewise takes the view that strictly necessary cookies do not call for separate explicit consent.
In addition, the site keeps three preferences in your browser's localStorage: the city you picked in the location selector, the light or dark colour theme, and a note that you have seen the cookie banner. These values never leave your device, and clearing site data in the browser removes them. If we ever decide to add analytics, this notice will be updated first and your explicit consent requested.
Who else sees the data
We do not trade in personal data or use it for ads. Access is limited to service providers we cannot operate without; when they act as processors, they are contractually bound to follow our instructions.
- Hosting - operates the machine on which apply.tr runs and where submissions are saved. Provider details are on the Legal notice page.
- Email service - provides the @apply.tr mailboxes and stores correspondence with clients and prospective clients.
- Notification service - forwards the name, contact detail, subject and text of each new form submission to an instant messaging service so the team hears about it quickly. The messaging provider may process data outside Turkey and the EU; see the section on transfers abroad.
- Payment provider - processes individuals' card transactions as an independent controller of the card data.
- Authorised public bodies and courts - strictly when a legal duty applies, such as an order from a court or a demand by the tax office.
Transfers abroad
To be upfront: Apply LLP is incorporated in Kazakhstan, our team is distributed and some members access data from outside Turkey, and the servers and services we rely on may also sit abroad. Put simply, processing can happen beyond Turkish borders, and KVKK treats that as a transfer abroad (yurt dışına aktarım).
KVKK allows such transfers only under certain conditions: an adequacy decision for the destination country, appropriate safeguards such as standard contracts, or, in limited cases, an occasional transfer. The mechanism we will rely on is still being finalised: [to be confirmed: the legal mechanism for transfers abroad (standard contract with notification to the Authority, written undertaking or occasional transfer), destination countries and recipient groups]. Technically, we protect the data with encrypted connections, individual user accounts and two-step verification.
EU visitors should note that Brussels has issued no adequacy finding for Kazakhstan. Data leaving the EU is therefore covered by safeguards recognised by the GDPR, such as the Commission's standard contractual clauses, or on the derogation for transfers needed to perform a contract with you or pre-contract steps you requested. You can obtain the safeguard documents by writing to office@apply.tr.
Security and deletion
Once data serves none of the purposes above and no retention period is running, we delete it or anonymise it so that it can no longer be linked to anyone.
- Only colleagues whose work requires it get access.
- Accounts are personal, and two-step verification is switched on wherever a system offers it.
- Traffic is encrypted; backup copies live separately from production.
- Should unauthorised parties obtain personal data, the Personal Data Protection Board hears from us within 72 hours of discovery, and the individuals concerned are informed without undue delay. Where individuals in the EU are affected, we also follow the GDPR notification rules.
Your rights
Under KVKK, as a data subject you may:
- find out whether we process your personal data and, if so, request information about it;
- learn the purpose of processing and whether the data is used accordingly;
- know the third parties in Turkey or abroad to whom it has been transferred;
- have incomplete or inaccurate data corrected;
- ask for erasure or destruction once the conditions are met, and for those third parties to be told about it;
- object to an outcome against you that results solely from automated analysis;
- claim compensation for damage caused by unlawful processing.
Send your request to office@apply.tr from an email address you have previously given us and that is on our records, or via registered electronic mail (KEP) or a secure electronic signature, and state which right you wish to exercise. Where your identity is unclear, we may need extra proof. We deal with requests as quickly as possible, within 30 days at the latest and, as a rule, free of charge. Unhappy with the reply, or no reply in time? You may then turn to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
If you live in the EU, the GDPR additionally gives you rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interest. We respond within one month; complicated cases can take up to two extra months, in which event you hear about the delay inside the first month. You may also complain to the data protection supervisory authority in the EU member state where you live or work.
Bookkeeping documents such as invoices must survive until their legal storage term runs out, whatever we are asked. In the meantime they are locked away and touched only for compliance purposes; afterwards they are destroyed.
Privacy questions
Questions about this notice, and requests for information, correction or deletion, go to office@apply.tr. The mailbox is monitored Monday to Friday, 09:00-18:00 Turkey time. The Contact page shows every other channel.