This text is a draft and not yet final. Highlighted fields in square brackets (e.g. company name and address) must be filled in and the text must be reviewed by a lawyer before publication.
KVKK Privacy Notice
Privacy notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) for personal data processed in the RintUp service.
1. Data controller
This notice is issued by [COMPANY NAME] ("RintUp", "we") as data controller under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. The Turkish version prevails in case of conflict.
| Item | Value |
|---|---|
| Company name | [COMPANY NAME] |
| Address | [ADDRESS] |
| MERSIS | [MERSIS NO] |
| Tax office / no | [TAX OFFICE / NO] |
| Registered e-mail (KEP) | [REGISTERED E-MAIL (KEP) ADDRESS] |
| Contact e-mail | [CONTACT E-MAIL: kvkk@rintup.com] |
| VERBIS | [VERBIS REGISTRATION STATUS] |
2. Scope and our role
RintUp is a service that monitors the availability of websites, APIs and servers, sends alerts on outages and publishes status pages (rintup.com). This notice covers account owners, workspace members, invitees, visitors of our website and status page subscribers.
For personal data that our customers enter into the service on their own behalf (e.g. phone numbers of team members who receive alerts, status page subscribers), the customer is the data controller and RintUp is the data processor. This relationship is governed by the Data Processing Addendum.
3. Personal data we process
| Category | Data |
|---|---|
| Identity | Full name |
| Contact | E-mail address; phone number if added as an alert channel |
| Customer transaction | Workspace name, membership and role, invitations, plan and subscription status, billing details |
| Transaction security | Password hash (Argon2id; the password itself is never stored), two-factor secret (encrypted), session records (IP address, browser information, session times), API key hashes, audit records |
| Service data | Monitor targets (domain, URL, IP, port), check results (status, response time, HTTP code, error summary), incident and maintenance records; header and credential secrets entered by the customer are stored with envelope encryption |
| Status page subscriber | E-mail address and subscription confirmation time (once the feature is enabled) |
| Marketing | Only with separate permission: commercial electronic message preference |
Your card and payment details never reach us; payments are collected directly by the licensed payment institution Paynkolay. We only receive the transaction result and a subscription reference. Response bodies (the content of monitored pages) are not stored.
4. Purposes of processing
- Creating your account, verifying your e-mail, authentication and session management
- Providing the monitoring, alerting and status page services under the contract
- Delivering alert notifications by e-mail, SMS and other channels chosen by the customer
- Managing subscriptions, payments and invoicing
- Ensuring information security; preventing abuse, unauthorised access and attacks; keeping audit records
- Complying with legal obligations (tax, commercial law, Law No. 5651) and responding to authorities
- Answering support requests and improving the service
- Sending commercial electronic messages about product news and offers, only with your explicit permission
5. Collection method and legal bases
Your personal data is collected electronically through sign-up, sign-in and settings forms, the panel and the API, and partly by automated means (session and server logs, strictly necessary cookies). The legal bases are those in KVKK Article 5(2):
- (c) Formation and performance of a contract: account, authentication, monitoring, alerting, status pages and billing
- (ç) Legal obligation: invoices and commercial records, traffic data under Law No. 5651, requests from authorities
- (e) Establishing, exercising or defending a right: audit and transaction records as evidence in disputes
- (f) Legitimate interest: information security, abuse prevention, measuring service quality (provided your fundamental rights and freedoms are not harmed)
- Explicit consent (Art. 5(1)): only for the optional commercial message permission and, if needed, occasional cross-border transfers under Art. 9(6)
Permission for commercial electronic messages under Law No. 6563 on the Regulation of Electronic Commerce is separate from KVKK consent and optional; not giving it does not prevent you from using the service, and you can withdraw it at any time via the link in each message or by writing to us.
6. Transfers
Your personal data may be transferred, limited to the purposes above and in line with KVKK Articles 8 and 9, to the following recipient groups. Current list: Subprocessors.
- Our service providers (processors): hosting (Türkiye), e-mail delivery (Postmark, USA), SMS delivery (Netgsm, Türkiye), DNS (Cloudflare), payments (Paynkolay, Türkiye)
- Integrations chosen by the customer (e.g. Slack, Microsoft Teams, Discord, Telegram, webhooks): alert content is sent to these services on the customer's instruction
- Public authorities and judicial bodies authorised by law (upon request and under legal obligation)
7. Transfers abroad
The service's database and application servers are located in Türkiye. Transactional e-mails (verification, password reset, alerts, invitations) are sent through US-based Postmark; the recipient's e-mail address and the message content (e.g. monitor name and status) are therefore transferred to the USA. DNS is provided by Cloudflare on a global network.
Transfers to countries without an adequacy decision are made under KVKK Article 9 primarily on the basis of the standard contract published by the Board, notified to the Authority within 5 business days of signature. Where this safeguard cannot be put in place, transfers are made only in the occasional cases listed in Article 9(6) (e.g. your explicit consent) and not on a regular basis.
Draft note: signing the KVKK standard contract with Postmark and Cloudflare and notifying the Authority must be completed before publication; counsel should confirm that explicit consent cannot be relied on for regular transfers.
8. Retention periods
| Data | Period |
|---|---|
| Account and workspace data | For the life of the account; deleted within 30 days of a deletion request and purged from backups within 14 days |
| Raw check results | 90 days (the panel may show a shorter window depending on your plan) |
| Check summaries (hourly/daily availability and response time) | For the life of the account, at most 3 years |
| Session records | At most 1 year after the session ends |
| Audit records | For the life of the account and the limitation period thereafter (at most 10 years) |
| Invoices and accounting records | 10 years under the Tax Procedure Law and the Turkish Commercial Code |
| Traffic data under Law No. 5651 | At least 1 and at most 2 years as a hosting provider |
| Commercial message permission records | 3 years after the permission is withdrawn |
Data whose retention period has expired is deleted or anonymised through periodic destruction processes in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
9. Your rights under KVKK Article 11
- To learn whether your personal data is processed
- To request information if it has been processed
- To learn the purpose of processing and whether it is used accordingly
- To know the third parties to whom it is transferred in Türkiye or abroad
- To request correction if it is incomplete or inaccurate
- To request deletion or destruction under the conditions of KVKK Article 7
- To request that correction, deletion or destruction be notified to third parties to whom it was transferred
- To object to a result against you arising exclusively from automated analysis
- To claim compensation for damages arising from unlawful processing
10. How to apply
You can send requests regarding your rights in line with the Communiqué on the Procedures and Principles of Application to the Data Controller: in writing to [ADDRESS], to our KEP address [REGISTERED E-MAIL (KEP) ADDRESS], with a secure electronic or mobile signature, or from the e-mail address registered in our system to kvkk@rintup.com.
Your application must include your full name, signature (for written applications), Turkish ID number (for foreigners: nationality and passport/ID number), address or e-mail for notification and the subject of the request. We respond free of charge within 30 days at the latest; if the action involves an additional cost, a fee may be charged according to the Board's tariff.
If your application is rejected, you find the answer insufficient or we do not respond in time, you may file a complaint with the Personal Data Protection Board under KVKK Article 14.
11. Changes
We may update this notice to reflect changes in the service or the law. The current version is always published on this page; we also notify significant changes to the e-mail address on your account.