Privacy Notice (KVKK)
Last updated: 12 September 2026
This English version is provided for information only. The agreement is governed by Turkish law and the Turkish text prevails in case of any discrepancy.
This Privacy Notice has been prepared pursuant to Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Compliance with the Obligation to Inform.
1. Data controller
| Legal name | YouReply Teknoloji Ticaret Eğitim Danışmanlık Araştırma Organizasyon A.Ş. |
|---|---|
| Address | Hacettepe Üniversitesi Teknoloji Geliştirme Bölgesi, Beytepe Kampüsü, 6. Ar-Ge Binası C Blok, Çankaya / Ankara |
| Phone | +90 532 317 20 23 |
| info@youreply.com.tr | |
| MERSIS no | 0982 1041 0030 0001 |
| Trade registry no | 495271 |
| Tax office / no | Doğanbey Vergi Dairesi / 9821041003 |
For applications under KVKK: kvkk@youreply.com.tr
2. Scope
This notice covers four groups:
- Visitors to the marketing site (www.youqualitative.com.tr),
- People who fill in the contact form,
- Users with an account on the Platform and customer contacts,
- Participants appearing in the research data that customers upload to the Platform. For that data, the data controller is the researcher or institution concerned; YouReply, acting as a data processor, refers participant applications to the data controller.
3. Categories of personal data processed
| Category | Data processed |
|---|---|
| Identity | Name, surname; the name of the authorized person on a corporate invoice |
| Contact | E-mail address, phone number, address |
| Customer transaction | Order and plan information, payment method and amount, invoice records, agreement approvals |
| Transaction security | IP address, session and login records, browser and device information, activity history on the Platform |
| Requests and complaints | The content of the contact form and support correspondence |
| Research data uploaded by the customer | Transcript texts, participant codes and attributes, codings, themes, memos and reports. Depending on its content it may contain special categories of personal data; the controller of this data is the customer. |
4. Purposes of processing and legal grounds
| Purpose | Legal ground (KVKK art. 5/2) |
|---|---|
| Creating an account, authentication, providing the service | (c) Being directly related to the conclusion or performance of a contract |
| Orders, payment, invoicing and accounting | (ç) Compliance with a legal obligation; (c) performance of a contract |
| Keeping the information and approval records required by distance sales legislation | (ç) Compliance with a legal obligation |
| Responding to support requests and to the contact form | (c) Pre-contractual steps; (f) legitimate interest (responding to the request) |
| Platform security, prevention of misuse, error logs | (f) Legitimate interest (providing the service securely) |
| Improving the service with anonymous or aggregated usage statistics | (f) Legitimate interest |
| Measuring use of the site with analytics cookies | Explicit consent (the approval in the cookie banner) |
| Legal requests, disputes and the right of defense | (e) Establishment, exercise or protection of a right |
5. Contact form
The name, e-mail, optional phone number, subject and message you share in the form are processed in order to respond to your request and, depending on the nature of the request, to provide pre-sales information. The legal grounds are the steps directly related to the conclusion of a contract (art. 5/2-c) and our legitimate interest in responding to your request (art. 5/2-f). Your message is delivered to our team by e-mail; the delivery uses e-mail infrastructure and mailbox providers whose servers are located abroad (see Sub-processors). No explicit consent is requested for this form and no marketing permission is collected through it.
6. Method of collection
Personal data is collected electronically by wholly or partly automated means, through the forms on the marketing site and the Platform, the records generated automatically during account creation and use, e-mail correspondence and the payment flow.
7. Recipient groups
In Türkiye: the payment institution, the e-invoice and accounting service provider, the short message provider and the hosting service provider; and, upon request, authorized public institutions and organizations.
Abroad: the AI analysis provider (United States), the e-mail delivery infrastructure (Germany), the corporate mailbox service and, if you have consented, the analytics service. The current list of recipients is on the Sub-processors page.
Transfers abroad are made within the framework of Article 9 of KVKK. That article was amended by Law No. 7499: a transfer may be made to a country for which the Board has issued an adequacy decision or, where there is no adequacy decision, on the basis of one of the appropriate safeguards (binding corporate rules, the standard contract announced by the Board, or an undertaking for which permission has been obtained); the exceptions in art. 9/6 are reserved for incidental transfers. You can ask which mechanism a transfer relies on at kvkk@youreply.com.tr.
8. Retention periods
| Data | Period or criterion |
|---|---|
| Account and usage data | For as long as the account remains open; after the account is closed, for the statutory limitation periods |
| Research data uploaded by the customer | Until the customer deletes it or requests its deletion; the period is determined by the customer, who is the data controller |
| Order, payment, invoice and agreement records | For the retention periods in tax and commercial legislation (as a rule, ten years) |
| Information and approval records under distance sales rules | Three years, pursuant to Article 20 of the Regulation on Distance Contracts |
| Contact form and support correspondence | After the request is concluded, for the statutory limitation period applicable to possible disputes |
| System and error logs | For as long as the security and fault investigation purpose requires |
| Database backups | For the retention period of the backup regime (currently 90 days) |
9. Your rights under Article 11 of KVKK
By applying to the data controller, everyone has the following rights in relation to their own personal data:
- To learn whether their personal data is processed,
- To request information if it has been processed,
- To learn the purpose of the processing and whether the data is used in accordance with that purpose,
- To know the third parties to whom it is transferred, in Türkiye or abroad,
- To request its correction if it has been processed incompletely or inaccurately,
- To request its erasure or destruction within the conditions of Article 7 of KVKK,
- To request that correction, erasure and destruction be notified to the third parties to whom the data was transferred,
- To object to an outcome that is adverse to them and that arises from analysis carried out solely by automated systems,
- To claim compensation for damage suffered as a result of unlawful processing.
10. Application procedure
Pursuant to the Communiqué on Application Procedures to the Data Controller, you can submit your application in Turkish by the following means:
- In person or through a notary, with a wet-signed petition sent to the address above,
- With a secure electronic signature or a mobile signature,
- From the e-mail address registered in our system, to kvkk@youreply.com.tr.
Your application must state your name and surname, your signature (for written applications), your Turkish identity number (nationality and passport number for foreign nationals), an address for notification and the subject of your request. Applications are concluded free of charge as soon as possible and within thirty days at the latest; if the process requires an additional cost, the fee in the tariff set by the Board may be charged.
11. Updates
This notice may be updated because of changes in legislation and in our processes. The current version is published on this page.