Personal Data Protection Notice (KVKK)
How Saspera processes personal data as a data controller under Turkish Law No. 6698, and how to exercise your rights.
Effective Date: 24.06.2026
01Identity of the Data Controller
This Notice has been prepared by Saspera Sürdürülebilirlik Danışmanlığı ve Bilişim Teknolojileri Anonim Şirketi ("Saspera" or the "Company"), whose identity details are set out below, as the data controller under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK").
02Scope of the Notice
This notice explains the principles regarding the processing of personal data of natural persons (users, customer representatives, visitors and candidates) who visit the Saspera platform and website, register, or benefit from our services.
03Categories of Personal Data Processed
Depending on the nature of our services and the transactions you carry out, the following categories of personal data may be processed. Where you enter data relating to your organization in the capacity of its representative, such data is processed on behalf of that organization and is not shared by us with third parties:
Identity data (first name, last name)
Contact data (e-mail address, phone number, address and location information)
Customer transaction data (membership records, service requests, support applications)
Data relating to the organization you represent (company title, organizational structure, authorization and role information)
Professional connection data (your role and unit information within the organization)
Transaction security data (IP address, session records, log and audit trail records)
Usage data (platform usage and analytics information)
Content entered or uploaded to the platform by you (documents, invoices, comments and the requests you direct to the artificial intelligence features)
Visual data (profile photo, document images you upload)
04Purposes of Processing Personal Data
Your personal data is processed for the purposes of carrying out membership and account operations, ensuring authentication and account security (including one-time verification codes via e-mail and SMS), fulfilling contractual and legal obligations, providing sustainability and carbon footprint reporting services, processing and analyzing the documents and data you upload, managing requests and support applications, ensuring information security and auditability, and improving our services.
05Legal Grounds for Processing
Your personal data is processed on the legal grounds set out in Article 5 of the KVKK, namely: being directly related to the conclusion or performance of a contract, compliance with the legal obligations of the data controller, the necessity of processing for the establishment, exercise or protection of a right, and the legitimate interests of the data controller provided that the fundamental rights and freedoms of the data subject are not harmed; and, where these grounds are not present, based on your explicit consent.
06Method of Collecting Personal Data
Your personal data is collected directly from you through registration, onboarding and data entry forms on the website and platform, membership operations, document uploads, e-mail, SMS and other communication channels; and automatically through cookies, log records and similar technologies during your use of the platform.
07Transfer of Personal Data and Sub-Processors
Your personal data may be transferred to authorized public institutions within the scope of legal obligations and to the following sub-processors with whom we cooperate for the provision of services, in accordance with the conditions set out in Articles 8 and 9 of the KVKK and only to the extent required by the relevant service. Some of these transfers are made abroad due to the countries in which the relevant providers' infrastructures are located:
E-mail delivery service provider — delivery of authentication, information and notification e-mails (abroad)
SMS delivery service provider — delivery of phone verification and one-time codes (abroad)
Cloud storage service provider — hosting of uploaded documents and images (abroad)
Instant messaging infrastructure — delivery of operational notifications regarding support requests (abroad)
Bot and abuse protection provider — ensuring sign-in security (abroad)
Cloud infrastructure service provider — hosting of artificial intelligence and application components under our Company's control (abroad)
08Artificial Intelligence Powered Features
The platform offers artificial intelligence powered features for the purposes of analyzing sustainability data, processing document and invoice content, and answering your questions. The artificial intelligence models used in these features are run entirely on infrastructure under our Company's own control; your personal data, your company data and the content you direct to the artificial intelligence are not transferred to any third-party artificial intelligence service, are not disclosed externally, and are not used for model training. Request and response records relating to the artificial intelligence features are stored for a limited period solely for the purposes of ensuring service quality and security.
09Retention Period of Personal Data
Your personal data is stored for the periods necessary for the purposes for which they are processed and as foreseen in the relevant legislation; upon expiry of these periods, they are deleted, destroyed or anonymized. Your account and membership data is retained for as long as your membership continues, while audit trail and log records are retained for the periods foreseen in the relevant legislation.
10Rights of the Data Subject
Pursuant to Article 11 of the KVKK, you have the following rights as a data subject:
To learn whether your personal data is being processed
To request information if it has been processed
To learn the purpose of processing and whether it is used in accordance with that purpose
To know the third parties to whom it has been transferred domestically or abroad
To request the correction of incomplete or incorrectly processed data
To request its deletion or destruction within the conditions set out in the KVKK
To object to a result against you arising from the analysis of processed data solely through automated systems
To request compensation for damages in case you suffer harm due to unlawful processing
11Method of Application
You may submit your requests regarding the rights stated above to us, together with information verifying your identity, at info@saspera.com. Your requests will be concluded free of charge as soon as possible and within thirty (30) days at the latest depending on their nature; however, if the transaction requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.
12Effectiveness and Amendments
This Notice enters into force on the date of its publication. The Company reserves the right to amend this notice in line with changes in legislation or updates to its data processing practices. The current version is always published on this page.