KVKK compliance

1. Data Controller

Your personal data is processed by Respongo as the data controller within the scope of Law No. 6698, the Turkish Personal Data Protection Law (KVKK).

2. Data Categories Processed

• Identity and contact data: first name, last name, company, job title, email, phone
• Customer transaction data: request, quote, contract, and support records
• Transaction security data: IP address, session, and access logs
• Platform usage data: learning activity, progress, and completion records (on behalf of the customer organization, as data processor)
• Candidate data: CV and qualification information submitted in career applications

3. Purposes of Processing

• Provision of products and services, performance of contracts
• Management of request, quote, and support processes
• Ensuring the security and continuity of the platform
• Informational and marketing communications to the extent you have consented
• Fulfillment of legal obligations

4. Legal Grounds

Your data is processed on the legal grounds of entering into or performing a contract, fulfilling a legal obligation, legitimate interest, and, where required, explicit consent.

5. Data Controller vs. Data Processor

For employee data on the platforms of our corporate customers, the customer organization is the data controller; Respongo processes this data as a data processor, within the scope of the contract and in accordance with the customer's instructions.

A data processing agreement (DPA) is signed as part of this relationship; our standard DPA is shared upon request.

6. Transfer and Retention

Data may be transferred to infrastructure, hosting, and integration providers to the extent necessary to deliver the service. Where data is transferred abroad, the conditions and appropriate safeguards set out under KVKK are applied.

Data is retained for the period set out in applicable legislation or required by the purpose of processing; at the end of that period, it is deleted, destroyed, or anonymized.

7. Data Subject Rights

Under Article 11 of KVKK, you have the right to access your data, request its correction, request its deletion, object to its processing, request restriction of processing, and data portability.

You can submit your requests through our contact channels. Requests are answered within the period set out in applicable legislation.

8. Security Measures

Administrative and technical measures are applied to protect data, including access authorization, encryption, record keeping, regular penetration testing, and employee awareness training. For details, please see our security page.

Last updated: July 1, 2026 · For questions, please use our contact page.