Privacy Notice under the Turkish Personal Data Protection Law (KVKK)

1. Data controller

Your personal data is processed by the following company as data controller:

Company

Roni Yazılım Hizmetleri Limited Şirketi

Address

[Adres]

MERSİS

[MERSİS No]

KEP

[KEP adresi]

Email

[KVKK başvuru e-postası]

2. Categories of personal data

• Identity: first and last name.
• Contact: email address, (optional) phone number.
• Visual: the profile photo you upload.
• Customer transactions: workspace, project, task, comment and file records; notifications; support requests; language, time zone, theme and notification preferences; content imported from integrations you connect.
• Transaction security: password hash, session data, sign-in times, server logs containing IP address and browser information, administration logs, encrypted integration access tokens.
• Finance: plan, subscription and payment transaction records (card details never reach the Company).

3. Purposes of processing

• Managing membership and authenticating users;
• Providing the product, enabling collaboration and notifications within workspaces;
• Running the integrations and AI features you request;
• Managing contracts, payments and invoicing for paid plans;
• Information security, abuse prevention and error detection;
• Handling requests and complaints and providing support;
• Meeting legal obligations and responding to competent authorities;
• Establishing, exercising and defending legal claims.

4. Collection method and legal bases

Your personal data is collected electronically, partly by automated means, through the sign-up and sign-in screens, forms and actions in the app, Google sign-in, the integrations you connect and server logs. We rely on the following grounds of Article 5(2) of the Law:

• (c) Establishment or performance of a contract: account creation, providing the Service, collaboration features, notifications, integrations, Roni AI, paid plans.
• (ç) Compliance with a legal obligation: retaining invoices and payment records, requests from authorities.
• (e) Establishing, exercising or protecting a right: records used as evidence in disputes.
• (f) Legitimate interest: security of the Service, abuse prevention, debugging and logging administrative actions, provided this does not harm your fundamental rights and freedoms.

We do not carry out any processing based on explicit consent. We do not send commercial electronic messages; if we do so in the future, we will ask for your approval separately.

5. Transfer of personal data

Limited to the purposes above, your personal data may be transferred to:

• Other users of the workspaces you are a member of (name, avatar, email and your activity in the workspace);
• The service providers (suppliers) listed below that we use to provide the Service;
• Competent public authorities and courts where legally required;
• Our legal and financial advisers, to protect our rights.

6. Transfers abroad

Transfers to providers outside Türkiye are made in accordance with Article 9 of the Law:

• Transfers to countries with an adequacy decision of the Board rely on one of the grounds in Article 5.
• For countries without an adequacy decision, the Board’s standard contractual clauses are signed with the recipients and notified to the Authority within five business days of signature.
• Where appropriate safeguards cannot be provided, a transfer is made only if one of the incidental cases listed in Article 9(6) of the Law applies.

The Google Calendar, Slack, Trello and Asana integrations work only when you connect them; data is then sent to or received from that service at your request.

7. Workspace content

For content entered into a workspace by our customers and the people they invite (projects, tasks, comments, files and any third-party data in them), the workspace owner is the data controller; the Company processes that content as a data processor, only to provide the Service and on the controller’s instructions. Customers who enter other people’s personal data into a workspace are responsible for informing them and having a valid legal basis.

8. Retention and destruction

Your personal data is kept for as long as necessary for the purpose of processing and as required by law, and is then deleted, destroyed or anonymised under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Specific periods are listed in the “Retention” section of the Privacy Policy.

9. Your rights under Article 11

By applying to the data controller, you have the right to:

1. Learn whether your personal data is processed,
2. Request information if it has been processed,
3. Learn the purpose of processing and whether data is used accordingly,
4. Know the third parties in Türkiye or abroad to whom it is transferred,
5. Request correction if it is incomplete or inaccurate,
6. Request deletion or destruction under the conditions of Article 7,
7. Request that third parties to whom data was transferred be notified of actions under (e) and (f),
8. Object to a result against you arising exclusively from automated analysis of processed data,
9. Claim compensation for damage caused by unlawful processing.

10. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit requests in Turkish with information allowing us to verify your identity (name, Turkish ID number or, for foreigners, nationality and passport number, address, email and phone if any, and the subject of the request) by one of the following:

• A signed written application in person or via a notary: [Adres]
• Registered electronic mail (KEP): [KEP adresi]
• With a secure electronic or mobile signature, or from the email address registered in Roni: [KVKK başvuru e-postası]

Requests are concluded free of charge within 30 days at the latest. If the action requires an additional cost, a fee set by the Board may be charged. If your request is rejected, you find the answer insufficient or we do not respond in time, you can lodge a complaint with the Personal Data Protection Board. Users in the EEA or UK can also contact their local supervisory authority under the GDPR.