Data Protection Notice (KVKK & GDPR)

Last updated: August 15, 2026

Part I — Disclosure under Turkish Law No. 6698 (KVKK)

1. Identity of the Data Controller

Pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation, in the capacity of data controller:

AK Kurumsal İletişim Turizm Eğitim Danışmanlık A.Ş. (the “Company”)
Address: Çeliktepe Mah. Kubilay Cad. No:1 İç Kapı No:13, 34413 Kağıthane/Istanbul, Türkiye
Phone: +90 212 225 61 31 · E-mail: info@reportengine.ai
Brand / service: ReportEngine (reportengine.ai)

2. Categories of Personal Data Processed

• Identity data: first name, last name;
• Contact data: work e-mail address, phone (if provided), company/organization information;
• Customer transaction data: account activity, metadata of created reports and content, requests and applications, invoice details;
• Transaction security data: IP address, session and log records, device/browser information, authentication records;
• Data contained in content uploaded to the platform: personal data appearing in documents and reports uploaded by users (the uploading user is responsible for having obtained such data lawfully);
• Marketing data (only with explicit consent): communication preferences.

Special categories of personal data (health, biometrics, religion, etc.) are not requested and are not knowingly processed.

3. Purposes of Processing

• Conclusion and performance of the membership agreement, account and access management;
• Provision of reporting, AI-assisted content generation, compliance checking, and export services;
• Invoicing and fulfillment of financial obligations;
• Information security processes, prevention of unauthorized access, log keeping;
• Handling requests and complaints, running support processes;
• Providing information to competent institutions and fulfilling legal obligations;
• Sending commercial electronic messages where explicit consent exists.

4. Legal Grounds for Processing (KVKK Art. 5)

• Art. 5/2-c: processing directly related to the conclusion or performance of a contract (account, service delivery, invoicing);
• Art. 5/2-ç: compliance with a legal obligation of the data controller (tax, commercial, and Law No. 5651 obligations);
• Art. 5/2-e: establishment, exercise, or protection of a right (evidence in disputes);
• Art. 5/2-f: legitimate interest, provided that fundamental rights and freedoms are not harmed (service security, misuse prevention, product improvement);
• Art. 5/1 (explicit consent): only for marketing messages, consent-based analytics cookies (usage analysis via Microsoft Clarity — consent can be withdrawn at any time via the “Cookie Preferences” link on the site), and cross-border transfer situations requiring consent.

5. Method of Collection

Personal data is collected through forms on the website and application, account registration and session processes, automatically during use of the service (logs, cookies), and through communication channels established by e-mail/phone, by fully or partially automated means.

6. Transfer of Personal Data (KVKK Art. 8 and 9)

Personal data may be transferred, strictly for the purposes above, to infrastructure service providers (hosting, authentication, database, e-mail, error monitoring, AI models), to competent public authorities within the scope of legal obligations, and to professional advisors. Recipient categories and locations are listed in Section 4 of the Privacy Policy.

Transfers abroad: pursuant to Article 9 of the KVKK as amended by Law No. 7499 of March 12, 2024, and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad of July 10, 2024, transfers abroad are made primarily to countries with an adequacy decision; where no adequacy decision exists, by signing the standard contracts announced by the Turkish Personal Data Protection Board and notifying the Authority within the prescribed period, or by providing other appropriate safeguards. In exceptional cases where appropriate safeguards cannot be provided, the incidental transfer provisions of Article 9 or your explicit consent apply.

7. Retention Periods

Personal data is retained for the period required by the processing purposes and the limitation/ retention periods prescribed by applicable law; at the end of these periods it is deleted, destroyed, or anonymized. Category-based periods are set out in Section 6 of the Privacy Policy.

8. Rights of the Data Subject (KVKK Art. 11)

Under Article 11 of the KVKK, everyone has the right, by applying to the data controller, to:

• learn whether their personal data is processed;
• request information if it has been processed;
• learn the purpose of processing and whether the data is used in line with that purpose;
• know the third parties to whom data is transferred domestically or abroad;
• request rectification of incomplete or inaccurate data;
• request erasure or destruction of personal data under the conditions of Article 7 of the KVKK;
• request that rectification/erasure/destruction operations be notified to third-party recipients;
• object to an outcome to their detriment arising exclusively from automated analysis;
• claim compensation for damages arising from unlawful processing.

9. Application Procedure

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your applications, together with identity-verifying documents:

• In writing: by registered mail with return receipt or through a notary to Çeliktepe Mah. Kubilay Cad. No:1 İç Kapı No:13, 34413 Kağıthane/Istanbul, Türkiye;
• Electronically: from your e-mail address registered in our system to info@reportengine.ai.

Your application is concluded free of charge as soon as possible and within thirty (30) days at the latest, depending on its nature; if the operation requires an additional cost, the fee in the tariff determined by the Board may be charged. If your application is rejected, the response is found insufficient, or no response is given in time, you retain the right to lodge a complaint with the Turkish Personal Data Protection Board within 30 days of learning of the response and in any case within 60 days of the application date.

Part II — Data Protection Notice under the GDPR

This part constitutes the information provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) for data subjects located in the European Union / European Economic Area (EU/EEA). The controller is the company identified in Part I.

1. Purposes and Legal Bases (GDPR Art. 6)

• Art. 6(1)(b) (performance of a contract): account creation, service delivery, support;
• Art. 6(1)(c) (legal obligation): tax and commercial record obligations, official requests;
• Art. 6(1)(f) (legitimate interests): service security, misuse prevention, error detection, and product improvement — balanced against your fundamental rights and freedoms;
• Art. 6(1)(a) (consent): marketing communications and consent-based analytics cookies (Microsoft Clarity); you may withdraw your consent at any time with effect for the future.

2. Data Subject Rights (GDPR Art. 15-22)

• Right of access (Art. 15): to learn whether your data is processed and obtain a copy;
• Right to rectification (Art. 16): to have inaccurate/incomplete data corrected;
• Right to erasure / right to be forgotten (Art. 17): to have your data deleted, subject to statutory retention obligations;
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20): to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller;
• Right to object (Art. 21): to object to processing based on legitimate interests and to direct marketing;
• Right not to be subject to automated decision-making (Art. 22): no decisions producing legal effects concerning you are made solely by automated processing.

To exercise your rights, contact info@reportengine.ai. Requests are answered free of charge within one (1) month as a rule; for complex requests this period may be extended by two (2) months. You also retain the right to lodge a complaint with a supervisory authority (Art. 77) in the member state of your habitual residence, place of work, or the place of the alleged infringement.

3. International Transfers (GDPR Chapter V)

Data is primarily hosted on infrastructure in the EU region (see Privacy Policy, Section 4). Transfers outside the EEA (including Türkiye and the US) are conducted under the European Commission’s adequacy decisions or Standard Contractual Clauses (SCCs) with necessary supplementary safeguards. You may request a copy of the safeguards applied through the contact channels above.

4. Retention, Security, and Breach Notification

Retention periods are described in Section 6 of the Privacy Policy. Appropriate technical and organizational measures are applied pursuant to GDPR Art. 32. In the event of a data breach posing a risk to your rights and freedoms, the competent supervisory authority is notified within 72 hours under Art. 33, and you are notified without undue delay where the conditions of Art. 34 are met.

5. Obligation to Provide Data and Automated Decision-Making

The data requested for account opening is necessary for the conclusion of the contract; if not provided, the service cannot be delivered. No automated decision-making or profiling producing legal effects within the meaning of GDPR Art. 22 is carried out; AI outputs serve only as drafts under user control.