Privacy Policy

This policy explains how Doğansoft (“the Company”) protects privacy in connection with the www.dogansoft.tr website (“the Site”), its corporate communication channels and the software, installation, hosting, support and training services it provides to institutions.

Detailed information on the processing of personal data is set out in the Privacy Notice (KVKK), information on cookies and similar technologies in the Cookie Policy, and technical and organisational security principles in the Information Security Policy. These documents are to be read together; in the event of any conflict between them, the Privacy Notice shall prevail as regards personal data.

The Company processes personal data in accordance with the general principles set out in Article 4 of the KVKK, namely that personal data shall be:

• processed lawfully and fairly,
• accurate and, where necessary, kept up to date,
• processed for specified, explicit and legitimate purposes,
• relevant, limited and proportionate to the purposes for which they are processed,
• retained only for the period prescribed by the relevant legislation or necessary for the purposes for which they are processed.

• We do not sell data. Personal data are not sold, rented out or exchanged.
• We do not engage in advertising tracking. The Site contains no advertising, retargeting or cross-site tracking tools; Google Analytics, Meta Pixel and similar third-party tracking tools are not used.
• We do not ask for more than is necessary. The forms contain only the fields required to respond to your request; non-mandatory fields are marked “optional”.
• We carry out measurement on our own server. Visit measurement is performed only with your permission, without cookies and anonymously, on the Company’s own server.
• We do not add externally sourced tracking code to our pages. As a rule, the Site’s pages load fonts, scripts and images from the Company’s own server.

The Company’s software is used by public institutions, municipalities in particular, and by private organisations to deliver their own services. The data controller for citizen, application, personnel, real property, location and similar data processed in these systems is the institution using the system.

With regard to such data, the Company:

• processes the data solely within the framework of its contract with the institution and the institution’s instructions, and only to the extent required by the service,
• does not use the data for its own purposes or share them with any other customer or with unauthorised third parties,
• accesses the data for support and maintenance purposes only through its authorised personnel and with the institution’s permission and knowledge,
• upon termination of the contract, returns the data to the institution or deletes them on the institution’s instructions,
• notifies the institution without delay of any data breach of which it becomes aware.

Where the system is installed on the institution’s own servers, the data remain within the institution’s infrastructure; the Company’s access to such data is limited to the access and permissions granted by the institution.

Users of these systems and citizens should apply directly to the relevant institution in order to exercise their rights. Any such applications received by the Company are forwarded to the relevant institution without delay.

The rights and obligations of the parties in their relationship with institutions are determined by the service contract and data processing terms entered into. This policy does not replace those contracts; the provisions of the contracts are reserved.

The Site may contain links to our social media accounts and to other websites. When you click on these links, the privacy and cookie policies of the website concerned apply. The Company is not responsible for the content or practices of third-party websites.

Messages you send to our social media accounts are processed on the infrastructure of the relevant platform and are subject to that platform’s own terms. The Company uses such messages solely to respond to your request.

The Site and our services are intended for institutions; they are not directed at persons under the age of 18, and personal data are not knowingly collected from children. If you become aware that a person under the age of 18 has provided us with data, please let us know and the data concerned will be deleted.

In accordance with Article 12 of the KVKK, technical and organisational measures ensuring an appropriate level of security are taken in order to prevent the unlawful processing of and access to personal data and to ensure their safekeeping. The principal measures are:

• all traffic between the Site and your browser is carried over an encrypted connection (HTTPS/TLS), and browsers are instructed to use encrypted connections only (HSTS),
• form records and the administration panel are accessible only to authorised personnel, with role-based permissions,
• passwords are stored in an irreversible form, and accounts are temporarily locked after repeated failed login attempts,
• rate limiting is applied to the forms to guard against automated submissions and misuse,
• database access is carried out through separate users with the least privilege necessary,
• regular backups are taken and stored in an environment with restricted access,
• security headers are used to prevent the Site’s pages from being framed on other websites and to block similar attacks.

Should personal data be obtained by others through unlawful means, the data subjects concerned and the Personal Data Protection Board will be notified as soon as possible, in accordance with Article 12(5) of the KVKK.

No method of transmission or storage provides absolute security. The Company takes reasonable measures consistent with industry practice and, to the extent permitted by law, cannot be held liable for damage arising from causes beyond its control (for example, the compromise of a user’s own device or e-mail account).

Your rights in relation to your personal data and the means of application are explained in detail in the Privacy Notice (KVKK). For any privacy-related questions, you may use the contact details below.

This policy may be updated where necessary. The current version is always published on this page; the version and date information at the top of the page indicates the most recent amendment.