Privacy Notice

Last updated: 22 September 2026

1. Controller and contact

For FaturaMerkez account administration, website operations, platform security, support, subscriptions, collections and invoicing, the controller is EFDA LABS TEKNOLOJİ VE BİLİŞİM HİZMETLERİ SANAYİ TİCARET LİMİTED ŞİRKETİ.

Registered address: ATAKÖY 7-8-9-10. KISIM MAH. ÇOBANÇEŞME E-5 YAN YOL CAD. ATAKÖY TOWERS A BLOK NO: 20/1 İÇ KAPI NO: 70 BAKIRKÖY / İSTANBUL
Tax Office: Bakırköy Vergi Dairesi
Tax Identification Number: 3241211915
Operational contact: [email protected].

2. Scope and role distinction

This Notice covers website visitors, Office account users, support/contact requesters and subscription representatives where FaturaMerkez processes information for its own account, security, billing and support purposes.

Client invoices, receipts, bank transactions, accounting information and similar records uploaded by an accounting Office involve a distinct relationship. The Office generally determines the professional purpose of that processing while FaturaMerkez substantially provides technical processing on the Office’s instructions. Clients should also review the relevant Office's own privacy/KVKK notice.

3. Data categories

  • Account and user details: name, email, phone, Office, role and verification state.
  • Office, contact, demo and support communications.
  • Authentication and security: password hash (not the password), session/token data, IP, user agent, access and incident records.
  • System and audit events, changes, errors, timestamps and relevant tenant/object identifiers.
  • Subscription, plan limits, proposal, invoice, collection and payment-status information where applicable.
  • When payment functionality is introduced: Payment Provider customer/payment-method references and limited non-sensitive card display information such as brand/last four digits. FaturaMerkez does not intend to store full card numbers or CVV in its application database.
  • Documents, extracted fields, review records and accounting drafts processed on Office instructions.
  • Integration configuration, provider, authorization and synchronization status; credentials are protected as secrets.
  • Necessary session/language/consent preferences and, only when allowed, optional analytics, marketing and support data.
  • When Marketing is enabled, campaign-attribution data such as source, medium, campaign, content and advertising/ad-set identifiers supplied through UTM parameters. If registration succeeds, available first-touch attribution values may be associated with the created account for campaign-performance reporting.

4. Purposes and legal grounds

Data may be processed to create and administer accounts, authenticate Users, enforce authorization and security, provide enabled Service functions, execute Office-instructed workflows, answer support requests, manage subscriptions, collections and invoicing, investigate audit/error events, prevent abuse, measure marketing campaign performance, comply with law and protect legal rights.

Depending on the activity, grounds under KVKK Articles 5 and, where applicable, 6 may include contract formation/performance, legal obligation, establishment/exercise/protection of rights, legitimate interests that do not prejudice fundamental rights, and explicit consent where genuinely required. Optional analytics, marketing and support technologies are activated only by the corresponding cookie preference.

5. Collection, recipients and transfers

Data is collected through web interfaces, registration/login forms, campaign links, uploads, Integrations, email/support channels, system logs and service providers. Where necessary and purpose-limited, it may be disclosed to hosting/storage, email, security, support, analytics, advertising/marketing, payment/invoicing or Integration providers, authorized Office Users, advisers and competent authorities.

Google Analytics, Meta Pixel, LinkedIn Insight Tag and Tawk.to load only after the matching cookie choice. These and infrastructure, email, payment or Integration providers may operate global systems involving access or processing outside Türkiye. International transfers are handled subject to the applicable KVKK requirements, taking into account the provider, location, contract and technical setup.

6. Retention and security

For customer business data after a Trial or Subscription ends, the current product policy is approximately: up to 30 days of restricted export/view access, deletion or anonymization from active production systems by 60 days, and possible residual encrypted backup copies for roughly 30 additional days as normal backup rotation completes.

Agreement evidence, billing/fiscal records, security/audit records, legal claims and records subject to longer mandatory retention are not necessarily deleted on the same schedule. They may be retained for the applicable legal, security and evidentiary periods. Risk-proportionate safeguards include role-based access, tenant separation, authentication, secure transport, secrets protection, audit, backup and incident management.

7. Rights and requests

Under KVKK Article 11, eligible data subjects may ask whether data is processed, request information, learn the purpose and recipients, seek correction, deletion or destruction where conditions apply, request notification to recipients, object to adverse results arising exclusively from automated analysis, and claim compensation for unlawful processing.

Requests may be sent to [email protected]. Applications subject to mandatory formal requirements are handled in accordance with applicable Turkish rules and the company's registered address.

8. Updates

This Notice may be updated as law, product and providers change, with appropriate notice for material changes. Reading this Notice is not contractual acceptance or explicit consent.