Sarman Soft · Corporate and legal
Personal Data Notice
Last updated: 11 September 2026 · Version: 2026-09-11.1
Seller / service provider and data controller for applications and sales on this website.
Bakırköy Tax Office · Tax No: 751 092 76 30
Ataköy 7-8-9-10. Kısım Mahallesi, Çobançeşme E-5 Yan Yol Caddesi, Ataköy Towers A Blok No:20/1 İç Kapı No:70, Bakırköy / İstanbul
This notice is prepared under Turkish Personal Data Protection Law No. 6698 for website visitors, project and demo applicants, customer representatives and online purchasers. It is not a statement of explicit consent or marketing permission.
1. Data controller and scope
Sarman Soft is the data controller for personal data processed through its web forms, quotations, customer communications, invoicing and orders. A company using Sarman 360 is generally the data controller for its own customer, employee and business records. Where Sarman Soft accesses those records for hosting, maintenance or support, its processor role and instructions are defined separately in service and data processing arrangements.
2. What information do we collect?
- Identity and representation: Full name, registered company name and authorised representative details.
- Contact: Email, phone, country, city and contact details needed for delivery or setup.
- Requests and projects: Selected service, project description, demo/quotation requests, support correspondence and the originating page.
- Sales and invoicing: Package, modules, licence duration, order number, price/discount/VAT information, tax office and number, Turkish ID number where required for invoicing, billing address and payment outcome.
- Transaction security: Session and verification records, access/error logs, transaction time, contract version and acceptance records. Request source IP addresses are stored as keyed hashes to monitor misuse; web servers and security infrastructure may separately maintain access logs.
Our application and order forms do not request card numbers, expiry dates, CVV or 3D Secure verification codes. Payment details are processed by QNB Pay; we receive outcome data such as transaction ID, amount and status. Do not include health data, identity documents, card details, passwords or unnecessary third-party data in project descriptions. Anonymise any sample data.
3. Purposes and legal bases
| Process and purpose | Relevant data categories | Legal basis |
|---|---|---|
| Assessing your project, contacting you at your request, preparing demos/quotations | Identity, contact, company and request details | Necessity for entering into or performing a contract (Law No. 6698, Article 5/2-c); legitimate interests for business communications with company representatives, provided your rights are not harmed (Article 5/2-f). |
| Orders, licence activation, setup, training and support | Identity, contact, order and support records | Performance of a contract (Article 5/2-c); legitimate interests in managing representatives and authorised users (Article 5/2-f). |
| Invoicing, accounting and reporting to competent authorities | Billing/tax, identity, transaction and payment outcome data | Express provision in law and compliance with legal obligations (Article 5/2-a and ç). |
| Information security, prevention of misuse, error and access control | Technical logs and transaction security data | Legitimate interests, provided your rights are not harmed; legal obligations where applicable (Article 5/2-f and ç). |
| Requests, objections, disputes and protection of rights | Relevant contract, correspondence, request and transaction records | Establishment, exercise or protection of a right (Article 5/2-e). |
Processing required to respond to your request and carry out contractual transactions is not based on blanket explicit consent. Separate processing, such as advertising, campaign messages or non-essential tracking, will not take place without the necessary legal conditions and, where required, your separate choice. Submitting a request does not grant permission for commercial electronic messages.
4. Collection methods
Data is collected electronically, or physically where needed, through Sarman Soft website forms, Sarman 360 checkout, the support system, email, phone, WhatsApp conversations initiated by you, quotations/contracts and automated technical logs. Web form requests are recorded in the company CRM for evaluation and notified to the authorised team's business email account.
5. Recipients and purposes of disclosure
Information is processed by authorised sales, project, support and finance staff to the extent necessary for their duties. Where required for service delivery, it may be disclosed to:
- QNB Pay and relevant banks/payment institutions to carry out and verify payments.
- Authorised hosting and technical infrastructure providers operating the website, CRM, email and support systems.
- Accounting/tax advisers and competent public authorities for invoicing and legal obligations.
- Legal advisers, courts and legally authorised institutions for exercising rights, disputes and official requests.
Disclosures are limited to the stated purposes and comply with Article 8 of Law No. 6698. Your project information is not sold to third parties to create independent marketing lists. If you choose to activate a third-party integration, the data scope of that connection is assessed separately.
6. Overseas links and transfers
External links such as WhatsApp take you to the provider's environment, where its own data processing terms also apply. Email and phone alternatives are available. Services/integrations requiring transfers to overseas infrastructure must separately satisfy the current conditions under Article 9 of Law No. 6698. Reading this notice does not constitute general or unlimited permission for overseas transfers.
7. Retention, deletion and security
Data is retained for the periods required by the request, contract and support relationship, taking account of applicable tax, commercial, limitation and other mandatory retention periods. The same period does not automatically apply to every data category. Where a continuing right or dispute requires retention, only necessary records are kept. Once processing conditions cease to exist, data is deleted, destroyed or anonymised in accordance with applicable law.
Access is limited by duties and permissions. Form and payment workflows use validation, encrypted connections and misuse controls. Security does not justify collecting excessive data. Workflows involving special categories of personal data require separate legal and security assessment.
8. Your rights under Law No. 6698
Under Article 11, you may learn whether your data is processed, request information about processing, question its purpose and use, learn domestic/overseas recipients, request correction of inaccurate or incomplete data and, where conditions are met, deletion/destruction and notification of those actions to recipients. You may object to adverse outcomes arising solely from automated analysis and seek compensation for harm caused by unlawful processing.
9. Requests and responses
You may submit your request in writing to our company address, or from an email address already registered in our system to info@sarmansoft.com.tr or use another appropriate method under the Communiqué on the Principles and Procedures for Requests to the Data Controller. Include your name, information necessary to verify your identity, notification/contact address, your request and relevant documents, if any. Do not send excessive documentation, card details or passwords.
Requests are resolved as soon as possible, depending on their nature, and within 30 days at the latest. If processing incurs additional cost, only the tariff set by the Board may apply. You retain your right to complain to the Board under Article 14 if your request is rejected, answered inadequately or not answered in time.
10. Updates to this notice
New purposes or different processing activities will be notified separately. Publishing an updated notice does not permit past data to be used for undisclosed new purposes. This notice does not fulfil product customers' own duties to inform their users and customers.
Official sources: KVKK — Duty to Inform and Overseas Transfers.
You can save this page using your browser's Print / Save as PDF option.