Data Protection Notice
Effective date: 5 July 2026 · Version: 2.0
This Data Protection Notice has been prepared by Arı Bulut Depolama Bilişim ve Ticaret A.Ş. (the "Company"), acting in its capacity as data controller, in order to inform data subjects about its personal data processing activities, in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (the "KVKK") and the Communiqué on the Principles and Procedures to Be Followed in Fulfilling the Obligation to Inform.
Scope note: This Notice concerns the personal data that the Company processes in its own capacity as data controller (customer/clinic representatives, Authorised Users and visitors). With respect to patient data that clinics enter into UDENTIVA, the relevant clinic is the data controller; the Company acts as a data processor in relation to such data (see the Data Processing Addendum — DPA). The obligation to inform in respect of that data rests with the clinic, and a separate privacy notice must be provided to patients by the clinic.
1. Identity of the Data Controller
Arı Bulut Depolama Bilişim ve Ticaret A.Ş. Güldallar İş Merkezi, Akçaburgaz, Hadımköy Yolu Cd. No:84, 34522 Esenyurt/İstanbul, Türkiye Email: [email protected] · Telephone: (0212) 886 52 79
2. Categories of Personal Data Processed
- Identity: Full name, title.
- Contact: Telephone, email, address.
- Customer transaction: Subscription, package and order information.
- Financial: Invoicing information, payment/collection records.
- Account / transaction security: Username, IP address, log records, device/browser information, access records, two-factor authentication (2FA) information.
- Request / complaint management: Support and contact requests.
- Marketing (where applicable, subject to explicit consent): Newsletter and communication preferences.
Within the scope of this Notice, the Company does not process special categories of personal data (health data) in its own capacity as data controller. In respect of patient health data held on the platform, the Company acts as a data processor.
3. Purposes of Processing Personal Data
- Establishment and performance of the contract;
- Provision of the Service, and creation and management of accounts;
- Invoicing, collection and finance/accounting processes;
- Customer support and request management;
- Conduct of information security processes (authorisation, authentication, logging, breach detection);
- Improvement and development of the Service (as a rule, in de-identified form);
- Fulfilment of legal obligations and relations with official authorities;
- Marketing and informational activities, where explicit consent has been given.
4. Legal Bases for Processing (KVKK Art. 5)
Your personal data is processed on the following legal bases:
- Art. 5(2)(c): Direct connection with the establishment or performance of a contract;
- Art. 5(2)(ç): Fulfilment of a legal obligation;
- Art. 5(2)(e): Establishment, exercise or protection of a right;
- Art. 5(2)(f): Legitimate interest, provided that it does not harm fundamental rights and freedoms;
- Art. 5(1): Explicit consent, where required (e.g. marketing).
5. Method of Collecting Personal Data
Your personal data is collected through registration/contract forms, use of the platform and website, communication by email and telephone, support requests and cookies; by automated or partially automated means.
6. Transfer of Personal Data (KVKK Arts. 8 and 9)
Your data may be transferred, limited to the purposes set out in this Notice, to sub-processors (cloud/server hosting, S3-compatible storage, email/SMS infrastructure, payment institutions), to authorised public institutions and organisations, and to legal/financial advisers.
Data residency: Your data is hosted in Türkiye. Platform data containing personal health data is kept within the country only and is not transferred abroad, as required by the Regulation on Personal Health Data and the Regulation on Health Information Management Systems. In cases where a transfer abroad may exceptionally arise (in respect of data that does not contain health data), such transfer is carried out solely in accordance with the conditions prescribed by Article 9 of the KVKK.
7. Rights of the Data Subject (KVKK Art. 11)
Pursuant to Article 11 of the KVKK, every data subject has the right to:
- Learn whether their personal data is being processed;
- Request information if it has been processed;
- Learn the purpose of processing and whether the data is used in accordance with that purpose;
- Know the third parties to whom the data has been transferred domestically or abroad;
- Request rectification if the data has been processed incompletely or inaccurately;
- Request erasure or destruction of the data;
- Request that rectification/erasure operations be notified to the parties to whom the data has been transferred;
- Object to any adverse outcome resulting from analysis carried out exclusively by automated systems;
- Request compensation for damage suffered as a result of unlawful processing.
8. How to Apply
To exercise your rights, you may submit your requests:
- To the email address [email protected]; or
- In writing to the postal address specified above.
Your applications will be concluded within 30 days at the latest, in accordance with the KVKK and the Communiqué on the Principles and Procedures for Application to the Data Controller. Where a fee tariff has been set by the Board, the relevant fee may be charged.
9. Data Security
In accordance with Article 12 of the KVKK and the Personal Data Security Guide, the Company implements technical and organisational measures including row-level tenant isolation (RLS — fail-closed), argon2id password hashing, encryption in transit and at rest, role-based access control (RBAC), two-factor authentication (2FA), append-only audit logging, sensitive-field masking and network (loopback) isolation. For details, please refer to the Privacy Policy and the Data Processing Addendum (DPA).
10. Applicable Legislation
- Law No. 6698 (KVKK): https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5
- Regulation on Personal Health Data (32610): https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=32610&MevzuatTur=7&MevzuatTertip=5
- Regulation on the Erasure, Destruction or Anonymisation of Personal Data (30224): https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=23391&MevzuatTur=7&MevzuatTertip=5
- KVKK / Personal Data Security Guide: https://www.kvkk.gov.tr/