1. Data Controller
Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is:
Legal name: Gökşen Dündar (sole proprietorship) Brand: Certoly Address: 19 Mayıs Mah. 19 Mayıs Cad. Golden Plaza No: 3/16 Kat: 9 Şişli / İstanbul, Türkiye Tax Office / Tax No: Mecidiyeköy Tax Office / 3220639324 E-mail: info@certoly.com.tr
Note: In respect of the processing of its customers' commercial data, Certoly acts as a data processor. This Notice concerns the processing of data relating to Portal users, in respect of which Certoly acts as data controller.
2. Scope of this Notice
This Notice concerns personal data processing that takes place during use of the AI-supported module (the "Module") within the Certoly Portal.
Data submitted through the contact form on the website is covered by a separate notice displayed on that form.
3. Personal Data Processed
| Category | Data |
|---|---|
| Identity | First name, surname |
| Contact | E-mail address |
| Transaction security | User account identifier, date and time of the transaction, IP address |
| Module use | The question text submitted by the User, the generated draft answer, the approved answer |
⚠️ Data not transferred to the model
No raw customer data is transferred to the AI model. Individual order records, product lists, supplier information and end-customer information are not sent to the model.
Only the aggregated results produced by the calculation engine (for example, the profit margin ratio of a product group, its share of revenue, or stock turnover days) and the User's question text are transferred.
Users are advised not to include personal data in their question text. Content entered by the User into the question field is processed as submitted.
4. Purposes of Processing
Your personal data is processed for the following purposes:
- preparing and delivering answers to questions submitted through the Module,
- providing, maintaining and improving the Service,
- ensuring information security, preventing unauthorised access, and maintaining transaction records,
- fulfilling legal obligations and providing evidence in the event of a dispute.
5. Legal Grounds
Your data is processed under Article 5/2 of the KVKK on the following grounds:
- Art. 5/2(c) — processing is directly related to the conclusion or performance of a contract (the Customer Service Agreement and the User Agreement),
- Art. 5/2(ç) — compliance with the data controller's legal obligations,
- Art. 5/2(f) — the legitimate interests of the data controller (information security, service quality), provided that this does not harm the fundamental rights and freedoms of the data subject.
6. International Transfer
The Module operates using an artificial intelligence service provided by Anthropic PBC (United States of America). The aggregated results and question text described in clause 3 are transferred to that provider for the purpose of preparing an answer.
Certoly additionally uses a data storage service provided by Airtable, Inc. (United States of America) as part of its infrastructure.
These transfers are carried out within the scope of Article 9 of the KVKK and are limited to what is necessary for the provision of the Service.
Certoly selects providers on the basis of service terms that exclude the use of transferred data for model training, and does not use Customer Data for the purpose of training models.
Certoly's servers are located in Türkiye. No data is transferred abroad other than to the two providers named above.
7. Method of Collection
Your personal data is collected electronically and by automated means when you log in to the Portal and use the Module.
8. Retention Periods
| Data | Period |
|---|---|
| Account data (identity, contact) | For as long as the account is active; 10 years from the end of the service relationship |
| Module question and answer records | 3 years from the end of the service relationship |
| Transaction security records (logs, IP) | 2 years |
At the end of the applicable period, data is deleted, destroyed or anonymised.
9. Rights of the Data Subject (KVKK Art. 11)
By applying to the data controller, you have the right to:
a) learn whether your personal data is being processed, b) request information if it has been processed, c) learn the purpose of processing and whether the data is used in accordance with that purpose, ç) know the third parties to whom the data is transferred, in Türkiye or abroad, d) request rectification where the data is incomplete or inaccurate, e) request erasure or destruction, f) request that actions taken under (d) and (e) be notified to third parties to whom the data has been transferred, g) object to a result arising against you from analysis carried out exclusively by automated systems, ğ) claim compensation for loss suffered as a result of unlawful processing.
Regarding (g): Module outputs are not produced exclusively by automated systems. The Module has two separate flows, and in neither is the text shown to the User written by the AI model.
1. Routing. The AI model only selects which section of the panel the question belongs to. The sentences and figures displayed are produced from Customer Data by Certoly's rule-based calculation engine; those section texts were written and reviewed by Certoly in advance. The only thing the model produces in this flow is the name of the section to display.
2. Draft answer. Where the AI model does write sentences, the draft is never delivered to the User directly: it is read by Certoly, corrected if needed, and approved (the human approval step). No unapproved draft is ever shown to the User.
10. Applications
You may submit requests relating to your rights to info@certoly.com.tr or to the postal address given above.
Your application will be concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. Where the process entails an additional cost, the fee set out in the tariff determined by the Board may be charged.