Privacy Policy

1. Data Controller

Pursuant to the Turkish Personal Data Protection Law No. 6698 ('KVKK'), your personal data may be processed by Haneko Software and Technology ('Company', 'Haneko', or 'We') as the data controller, within the scope described below.

Haneko is committed to ensuring the security and confidentiality of your personal data in compliance with KVKK, its secondary legislation, and the decisions of the Personal Data Protection Board. This Privacy Policy explains in detail which personal data is collected during your use of our platform, how it is processed, with whom it is shared, and your rights.

2. Personal Data We Collect

The following categories of personal data are collected and processed during your registration and use of our platform:

a) Identity Data: Name, surname, Turkish ID number or tax identification number, date of birth.

b) Contact Data: Email address, phone number, business address.

c) Professional Data: License number, areas of expertise, professional title, company information, consulting fields.

d) Financial Data: Billing information, payment status, AI credit balance and usage history, company income/expense statements, balance sheet data and other financial data.

e) Transaction Security Data: IP address, login/logout logs, browser type and version, device information, access timestamps.

f) Usage Data: Click and navigation data on the platform, preferred features, messaging statistics, alarm and notification preferences.

g) Communication Content: Messages sent and received through the platform, file attachments, notes, and comments.

This data is obtained directly from you (registration form, profile edits, platform usage), through automated means (cookies, server logs), and where applicable, from third-party sources (data entered by authorized advisors or company users).

3. Purpose of Processing and Legal Basis

Your personal data is processed for the following purposes and based on the specified legal grounds:

a) Performance of a Contract (KVKK Art. 5/2-c): • Creating and managing your platform account • Advisor-company matching and process management • Providing messaging, notification, and alarm services • Invoice creation and payment processing • Carrying out transactions within the AI credit system

b) Legal Obligation (KVKK Art. 5/2-ç): • Fulfilling record-keeping and reporting obligations under the Turkish Commercial Code, Tax Procedure Law, and related legislation • Responding to requests from authorized public institutions • Complying with legal retention periods

c) Legitimate Interest (KVKK Art. 5/2-f): • Ensuring platform security and preventing fraud • Measuring and improving service quality • Statistical analysis and reporting (after anonymization)

d) Explicit Consent (KVKK Art. 5/1): • AI-powered analyses, profiling, and recommendation services • Transfer of personal data abroad • Sending commercial electronic messages

You have the right to withdraw your consent for processing activities based on your explicit consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

4. Domestic Data Sharing

Your personal data may be shared domestically with the following recipient groups for the stated purposes:

a) Authorized Public Institutions: When explicitly required by law or upon request of authorized bodies (tax offices, courts, regulatory authorities, etc.).

b) Business Partners and Suppliers: With domestic service providers with whom we have a contractual relationship for the purpose of providing the service (hosting, payment infrastructure, email delivery services, etc.), only to the extent necessary.

c) Advisor-Company Relationship: Due to the nature of platform use, information shared between matched advisor and company users (messages, financial statements, reports, etc.) is shared with the relevant parties.

Shared data is protected by confidentiality agreements and data processing agreements signed with recipients and is used only for the stated purposes.

5. International Data Transfers

To ensure uninterrupted and secure service, Haneko uses cloud service providers that meet international standards. In this context, your personal data may be transferred abroad in the following cases:

a) Cloud Infrastructure Providers: Supabase (database and authentication), AWS or similar cloud computing providers. These providers' servers may be located in the US, EU, or other countries.

b) Artificial Intelligence API Providers: Third-party API services used for AI-powered services (e.g., OpenAI, Google Cloud AI, etc.). Transfer only occurs if you approve the Explicit Consent Text.

International data transfer is carried out solely based on your explicit consent pursuant to KVKK Article 9. If you do not provide explicit consent, you may not be able to use AI-powered services; however, the platform's core functions outside of AI will remain available to you.

Data Processing Agreements (DPA) have been signed with all third-party providers to which data is transferred, and these providers' compliance with international data protection standards (SOC 2, ISO 27001, etc.) is audited.

6. Data Security Measures

Haneko takes all necessary technical and administrative measures within the scope of KVKK Article 12 to prevent unlawful processing, access, loss, or alteration of your personal data:

a) Technical Measures: • Data security through TLS/SSL encryption during transmission • Database-level encryption (encryption at rest) • Strong password policy and two-factor authentication (2FA) support • Regular security scans and vulnerability tests • Access authorization and role-based control mechanisms • Detailed access logs and monitoring systems • Regular data backup and disaster recovery plan

b) Administrative Measures: • Binding personnel with access to personal data with confidentiality commitments • Providing regular data protection training to employees • Creating and maintaining a data processing inventory • Notifying the Personal Data Protection Board and relevant individuals within 72 hours in case of a data breach pursuant to KVKK Article 12/5 • Contractual arrangements regarding data security with third-party service providers

7. Retention Period

Your personal data is retained for the duration required by the processing purpose and/or until the end of the legal retention periods prescribed by applicable legislation:

• Commercial and financial records: 10 years pursuant to the Turkish Commercial Code • Tax-related documents: 5 years pursuant to the Tax Procedure Law • Contract records: 10 years (statute of limitations under the Code of Obligations) • Platform usage logs: Up to 2 years for security purposes • Messaging content: As long as the account is active; up to 6 months after account deletion • Marketing data: Immediately upon withdrawal of consent

At the end of the relevant periods, your personal data will be irreversibly deleted, destroyed, or anonymized in accordance with KVKK and the 'Guide on Deletion, Destruction, or Anonymization of Personal Data' published by the Personal Data Protection Board.

8. Your Rights Under KVKK

You have the following rights under Article 11 of KVKK:

a) To learn whether your personal data has been processed, b) To request information if your personal data has been processed, c) To learn the purpose of processing your personal data and whether it is used in accordance with its purpose, d) To know the third parties to whom your personal data has been transferred domestically or abroad, e) To request correction of your personal data if it has been processed incompletely or inaccurately, f) To request deletion or destruction of your personal data under the conditions set forth in Article 7 of KVKK, g) To request that operations carried out pursuant to (e) and (f) be notified to third parties to whom your personal data has been transferred, h) To object to the occurrence of a result against you through analysis of your processed data exclusively by automated systems, ı) To claim compensation for damages arising from unlawful processing of your personal data.

To exercise these rights, you may contact us through the methods specified in the 'Contact and Requests' section below. Your application will be resolved free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request.

9. Children's Privacy

The Haneko platform is not designed for individuals under the age of 18, and we do not knowingly collect personal data from persons who have not reached the age of 18.

If we discover or are notified by a parent/guardian that personal data of an individual under the age of 18 has been recorded on our platform, the relevant data will be immediately deleted. If you become aware of such a situation, please contact us through the channels listed below.

10. Policy Changes

Haneko reserves the right to update this Privacy Policy in light of legal requirements, technical developments, or service changes.

In case of significant changes, the updated policy will be published on the platform and a notification will be sent to your registered email address. Your continued use of the platform after the update constitutes acceptance of the changes.

This Privacy Policy was last updated on September 14, 2026.

11. Contact and Requests

For questions about your personal data, requests under KVKK, or data protection inquiries, you can reach us through the following methods:

• Email: contact@haneko.co • Applications sent with 'KVKK Request' in the subject line must include identity-verifying information and a detailed description of your request.

Your applications will be answered free of charge as soon as possible and within 30 (thirty) days at the latest, in accordance with Article 13 of KVKK. If you find our response insufficient or your application is rejected, you have the right to file a complaint with the Personal Data Protection Board within 30 days of learning the response.