Privacy Policy and Personal Data Notice

1. Data Controller

Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), the data controller is Yellowstone Yazılım ve Bilişim Hiz. Ltd. Şti. (the “Company”), whose details are given below.

2. Personal Data We Process

• Identity: name and surname; for business customers, details of the authorised contact.
• Contact: email, phone, billing and company address.
• Customer transactions: orders, subscriptions and quote requests, support records and correspondence.
• Finance: invoicing details, tax office and number, payment status. Your card details are never seen or stored by the Company; payments are taken on the secure page of a licensed payment institution.
• Setup details: company name, domain, database name, administrator account and other details required to set up the system.
• Transaction security: IP address, session and access logs, browser information.
• Marketing: your communication preferences, only where you have given consent.

3. Purposes of Processing

• Taking orders, concluding and performing the contract, setting up YSSERP and providing the service
• Invoicing, payment and accounting
• Handling support, training and development requests
• Ensuring information security, system continuity and backups
• Meeting legal obligations and requests from competent authorities
• Managing requests and complaints
• Sending product and campaign announcements, if you have given consent

4. Legal Grounds

Your personal data is processed on the grounds of concluding or performing the contract, complying with our legal obligations, establishing, exercising or protecting a right, and our legitimate interests provided that your fundamental rights and freedoms are not harmed. Processing that requires explicit consent, such as commercial electronic messages, is carried out only with your consent, which you may withdraw at any time.

5. How We Collect Data

Your data is collected electronically, by automated or partly automated means, through the website, the checkout and payment steps, the My Account panel, the setup and quote forms, the contact form, email, phone and live chat.

6. Transfers and Storage Location

Your personal data may be shared, only for the purposes above and to the extent necessary, with the licensed payment institution to take payments, with an authorised e-invoicing service provider to issue e-Invoices and e-Archive invoices, with our legal and financial advisers, and with competent public authorities upon request.

The only exception is analytics and advertising cookies used with your consent: to measure visit statistics and track advertising performance, online identifiers such as cookie IDs, IP address and browser information may be transferred to analytics and advertising service providers whose servers are located abroad. This transfer is based on your explicit consent, and you can change your cookie preferences at any time.

7. Customer Data in YSSERP

For the data our customers enter into YSSERP for their own business (accounts, employees, products, etc.), the customer is the data controller. The Company processes this data only as a data processor, to provide the service, set it up, support it and back it up, in line with the customer’s instructions. Only our authorised staff can access this data, and only as far as necessary.

8. Retention and Security

Your data is kept for as long as the purpose of processing requires and for the periods set out in the applicable legislation; at the end of these periods it is deleted, destroyed or anonymised. Invoices and accounting records are kept for the statutory retention periods. When a subscription ends, you are given a reasonable period to export your data on request. Free trial environments and the data in them are deleted within 1 day after the trial ends.

Technical and organisational measures such as encrypted connections (SSL/TLS), role-based access, regular backups, access logs and up-to-date security patches are applied to keep data secure.

9. Cookies

Our website uses strictly necessary cookies, such as session and language preference, and analytics, advertising and campaign cookies that depend on your consent. See our Cookie Policy for details.

10. Your Rights

Under Article 11 of the KVKK, you may apply to the Company to:

• learn whether your personal data is processed and, if so, request information about it
• learn the purpose of processing and whether data is used in line with that purpose
• know the third parties to whom data is transferred
• request correction of incomplete or inaccurate data
• request deletion or destruction of data when the relevant conditions are met
• request that corrections and deletions are notified to third parties to whom data was transferred
• object to a result against you that arises solely from automated analysis
• claim compensation for damage arising from unlawful processing

11. How to Apply

You can send your request, together with information verifying your identity, by email to info@yellowstonesoft.com or in writing to our address above. Requests are answered free of charge within 30 days at the latest; if the request involves additional cost, the fee set by the Personal Data Protection Board may apply.

12. Changes

This notice is updated when necessary. The current version is always published on this page with its last updated date.