Signing Process Privacy Notice

This notice explains how your personal data is processed when you sign or approve (as a signer, approver, or party) a contract sent to you or a document you uploaded yourself. If you participate as an approver, you do not add a signature to the document; your "Approve" action, its time, and your connection information are recorded in the same way. You can reach this notice from the confirmation step on the signing screen; it applies together with the general privacy notice under the Turkish Personal Data Protection Law No. 6698 (KVKK) (KVKK Privacy Notice) and Privacy Policy.

1. Data Controller (Layered)

There are two separate layers of responsibility in the signing process:

• The party that sent you the contract (a natural or legal person) is the independent data controller with respect to your personal data in the contract (name and surname, e-mail, phone, Turkish ID number if applicable, and contract content). İmzala.org acts as the data processor on behalf of the sending party with respect to this data. The sending party is responsible for the lawfulness of this personal data and for the KVKK article 10 privacy notice obligation; if the sending party has its own privacy notice, it is also presented to you by that party.
• Codeck Yazılım Anonim Şirketi (İmzala.org) is the independent data controller for the data it adds to its own account for the security and evidentiary integrity of the signing process (IP address, device information, signature timestamp, phone verification result, notification delivery and click records, the interaction record on the signing page, the electronic seal, the TÜBİTAK timestamp, the EU qualified timestamp if the sender enabled it, the integrity digest, and any biometric verification).
• Your GSM operator (Turkcell, Türk Telekom, or Vodafone; today the Turkcell, Türk Telekom and Vodafone channels are in use) is involved only if you choose to sign with Mobile Signature, and is the independent data controller at that step. Your mobile signature subscription and the qualified certificate on your SIM card are based on the relationship between you and your operator (and the Electronic Certificate Service Provider the operator works with); the operator separately fulfils its own privacy notice obligation for this processing. İmzala.org is not the operator's processor at this step.
• WhatsApp (Meta Platforms Ireland Ltd.) is the independent data controller, under its own terms of use, for your phone number and the delivery metadata carried in the notification, if the sending party has enabled the WhatsApp notification channel; it is not İmzala.org's processor (§6).

Contact / data controller requests: [email protected] - DPO: [email protected].

2. Personal Data Processed

• Identity and contact: first name, last name, e-mail, phone; if the contract requires it, date of birth and Turkish ID number (for identity verification and evidentiary value).
• Transaction security / signature evidence: the IP address of your connection, device and browser information, the timestamps of viewing and signing the contract, the signature image (handwritten), the integrity digest and timestamp of the signature; the delivery and link-click time of the e-mail notification sent to you, the send time of the SMS notification and (when the provider reports it) its delivery status, and the send time of the WhatsApp notification. The language (Turkish or English) in which the signing page and the information, confirmation and consent texts shown on it were displayed to you is also recorded. The signing page additionally records the following steps with their times: the page being opened; the document being displayed at 25%, 50%, 75%, 90%, and 100% on screen; the first view of each page; pressing the "I have seen the document, continue" button and the integrity digest (SHA-256) of the document displayed at that moment; a field's fill-in window being opened (only the field's identifier and type); and the signature box being opened and the save button being pressed. At each step, the time your device reports, the time the server records it, your IP address with its last segment masked, and your device/browser type are recorded. The steps are chained to each other with integrity digests. The moment you sign, the last link of the chain is added to the record for which a timestamp is obtained for your signature; no new step is added to the chain after signing. If you reject the signature, give unsigned approval, or sign the document with a secure electronic signature (USB token or mobile signature), the last link of the chain is likewise added to a separate record that contains no personal data; only the integrity digest of that record receives a TÜBİTAK KamuSM timestamp, and no new step is added to the chain after this operation. The values you type into fields, the text, and the signature image itself do not additionally enter this record; your mouse and keyboard movements and screen recordings are not kept. This record shows that the document was displayed on screen; it does not show that it was read or understood.
• Phone verification (optional): If the sending party has enabled this step, a single-use verification code is sent to your phone number by SMS; the code, the verification result, and its time are processed. The code may be requested in two ways. In the first, the code is requested before you view the contract. In the second, if the sending party has enabled this option in the signature field, the code is not sent before you view the contract but is instead sent right before you save your first signature, and the verification is recorded in association with that signature; in this case, the contract can be viewed by whoever opens the signing link without entering a code. If phone verification is also enabled for the contract, a separate code is requested for actions you take before signing, such as rejecting or giving unsigned approval, and the code is requested again for your first signature. The code is valid for 5 minutes. To be able to later show the connection between the verification and your number, a keyed digest of your phone number is stored; if the number later changes, the records show a "previous number" notation. This step does not record your identity; it records that whoever entered the code had access, at that moment, to the phone number provided by the sender.
• Stamp information (optional): The party sending you the contract may pre-fill a stamp field that you are to complete (for example, company name, address, tax number, phone, or Turkish ID number). You may correct this information, or clear a stamp field that is not mandatory, before signing. Where you do not edit a pre-filled stamp, the signing screen and the Completion Certificate carry the notation "This stamp information was pre-filled by the party sending the contract." The data controller for this information is the sending party (§1).
• Geolocation (optional): only with your explicit consent, precise location (GPS); if you do not give consent, only an approximate location derived from your IP may be processed, and you can still complete the signature.
• Biometric verification (optional, special category): if the sending party requests it and only with your separate explicit consent, face/liveness verification or reading the NFC chip of your ID card. Detail: KVKK Privacy Notice.
• Turkish ID verification (optional): If the sending party has enabled this step, the consistency of your name and surname, Turkish ID number, and date of birth is checked solely through a verification query against the records of the General Directorate of Population and Citizenship Affairs (NVİ) through the Identity Sharing System (KPS); no new data is registered with NVİ. Only the verification result and date are written to the system.
• ID photo verification (optional): If the sending party has enabled this step, you photograph the front and back of your ID card with your device's camera. The information in the image (name, surname, Turkish ID number, date of birth) is read using optical character recognition (OCR) and the machine-readable zone (MRZ), and matched against the signer information in the contract. No facial recognition is performed; no biometric template is extracted from the image. ID images are stored encrypted and processed for the purposes of identity verification, evidencing the signing process, and operating the service (troubleshooting, dispute review, and audit). Only a limited number of authorised staff can access the images, with logged access. The ID image is deleted 90 days after verification is completed, or within 30 days for attempts that remain inconclusive; the masked digest showing that verification took place and the match result continue to be stored together with the contract record. Detail: KVKK Privacy Notice.
• Secure electronic signature via Mobile Signature (optional): If the sending party has enabled the secure electronic signature option and you choose to sign with Mobile Signature, or if you choose this method while signing your own document, you select your operator and enter the phone number that holds your mobile signature subscription. A neutral transaction description containing part of the contract record number appears in the signature request sent to your phone, and you approve the signature with a single mobile signature PIN. If the certificate references are not returned by the operator, a one-time certificate matching step may first be requested; in that step your name and surname, a six-digit code, and the transaction time appear on your phone, the text carries the note "This is not a contract signature", and the contract is not signed at that step. The qualified certificate returned by the operator (which contains your name, surname, and Turkish ID number) is compared against the signer information in the contract. Your number, the operator name, your certificate's fingerprint, and the result of the identity match are written to the system. The content of your contract is not sent to the operator; the value that is signed is an irreversible digest generated from the document.
• Decision reasons: If an approver role is defined in the contract, you give your decision by choosing Approve, Request Changes, or Reject Permanently; the reason text you write for the Request Changes and Reject Permanently decisions (at least 10 and at most 1000 characters) is processed, and no reason is requested for the Approve decision. If you participate as a signer, you are not required to write a reason when rejecting the signature; if you do, that text is processed in the same way. The explanation you write when requesting changes as a signer is also processed in the same way. The reason is text that you write freely; we recommend that you do not include personal data that is not necessary (for example, another person's identity or contact information) in this text.

3. Purposes of Processing

To enable you to view and sign the contract; to evidence to whom, when, and under what conditions the signature was applied (non-repudiation); to ensure the security and integrity of the signing process; to prevent misuse; to fulfil obligations arising from applicable legislation.

4. Legal Basis

Data	Legal basis (KVKK)
Name-surname, e-mail, phone, Turkish ID number, date of birth	art. 5/2-c, performance of a contract (signing party)
IP, device/browser, viewing/signing timestamps, signature image, integrity digest	art. 5/2-f, legitimate interest (evidentiary value) and art. 5/2-ç, legal obligation under Law No. 5070
Signing page interaction record (page opening, viewed section ratios, first views of pages, the "I have seen the document" step and document digest, opening a field window (field type), signature box and save steps; times, masked IP, device type)	art. 5/2-f, legitimate interest (evidencing which document was displayed when the signature was applied); in the event of a dispute, art. 5/2-e, establishment, exercise, or protection of a right
Precise location (GPS)	art. 5/1, explicit consent (optional)
Biometric face/liveness verification	art. 6/2, explicit consent (optional, special category)
Turkish ID verification query (NVİ/KPS matching)	art. 5/2-f legitimate interest (identity accuracy and evidentiary value); art. 5/2-ç, legal obligation under Law No. 5070
ID document image (front + back), the match result of information read via OCR/MRZ	art. 5/2-f, legitimate interest (identity verification and evidentiary value) (optional)
Phone verification code (SMS OTP), verification result, time, and type (login, first signature, first action), keyed digest of the phone number; notification e-mail delivery and click time, SMS and WhatsApp send time	art. 5/2-f, legitimate interest (transaction security and evidentiary value)
Mobile Signature: phone number, operator name, qualified certificate, and identity match result (only if you choose this method)	art. 5/2-c, performance of a contract and art. 5/2-ç, legal obligation under Law No. 5070
Decision reasons (rejection and change request)	art. 5/2-c, a statement made in the course of concluding and performing the contract; art. 5/2-f, legitimate interest (evidentiary value)

Because the core data of the signing process (identity, IP, device, signature image, timestamp) rests on the bases above, no explicit consent is obtained for them. The checkbox you accept on the signing screen is acceptance of the Terms of Use and confirmation that you have read this notice; it is not explicit consent under KVKK. Explicit consent is obtained separately only for the optional location and biometric steps marked above; the ID photo verification step, on the other hand, is processed under legitimate interest, does not additionally require explicit consent, but is activated only at the sending party's choice.

5. Retention Periods

• Signature and evidence data (identity, IP, device, signature image, timestamp, confirmation record, decision and rejection reasons, signing page interaction record, notification delivery and click times): up to 10 years, together with the contract record, within the scope of evidentiary value and statutory retention obligations (Law No. 5070, Turkish Commercial Code art. 82, Turkish Code of Obligations art. 146, Code of Civil Procedure art. 199). The interaction record is retained and, when deleted, deleted as a whole together with the contract.
• Phone verification code: 5 minutes; deleted upon verification, expiry, or exceeding the attempt limit, and unused codes are automatically cleared by the next day at the latest. The verification result, time, type, and the keyed digest of the phone number are retained together with the signature and evidence data for up to 10 years, and deleted together when the contract is deleted.
• ID document image (front + back): deleted within 90 days after verification is completed, or within 30 days for attempts that remain inconclusive; for attempts using a document type that is not accepted, the image is deleted upon rejection. Where necessary due to a dispute, request, or legal review, the image may be retained, limited to the duration of that need, for the establishment, exercise, or protection of a right (KVKK art. 5/2-e).
• Identity verification record (masked digest of the information read, match result, and verification timestamp): up to 10 years, together with the signature evidence (Law No. 5070, Turkish Commercial Code art. 82 (for the merchant side), Turkish Code of Obligations art. 146, Code of Civil Procedure art. 199).
• Mobile Signature records: if you signed by this method, your phone number, operator name, your certificate's fingerprint, and the identity match result are retained for up to 10 years, together with the signature evidence. The records of the signature ceremony (the operator's transaction numbers and the transaction description shown on your phone) are kept attached to the relevant contract and are deleted together when the contract is deleted. A copy of your qualified certificate is additionally stored so that matching does not need to be repeated for your subsequent signatures; when your certificate is renewed or changed, this copy is replaced with the new one. You may request the deletion of this copy at any time from [email protected].
• Biometric data: at most 1 year, then automatically deleted/anonymised.
• WhatsApp notification and correspondence record (the sent notification text, the recipient number, and any replies you send on this line): the notification-send record is retained together with the signature and evidence data for up to 10 years; replies you send on this line are retained as support correspondence for the duration of the support record.
• Incomplete/abandoned signature requests: when the related contract is deleted, all attached records are deleted together.

6. Transfers

• Notification delivery (İmzala.org's own channels): Mailgun for e-mail (Frankfurt/EU); İmzala.org's system account for SMS (NetGSM, Kobikom, or Twilio); WhatsApp (Meta Platforms Ireland Ltd., Ireland; global infrastructure) if the sending party has enabled the WhatsApp channel. Only your phone number, your name and surname, your signing link, and the message text are sent to WhatsApp; document content, Turkish ID number, and IP address are not sent. This transfer is a cross-border transfer under KVKK art. 9; Meta, in this transfer, is not İmzala.org's processor but an independent data controller processing the data under its own terms of use and privacy policy, and there is no separate data processing agreement between İmzala.org and Meta. The channel is optional and may be turned off by the sending party; the data transferred is limited to the phone number, name and surname, signing link, and message text. A process to complete the appropriate safeguard (the Board's standard contract) for this transfer is under way.
• Notification delivery (sending party's own provider): The organisation sending you the contract may choose to have notifications delivered through its own SMS, e-mail (SMTP or e-mail API), or WhatsApp Business account. Notifications related to the signing process (for example invitation, reminder, completion, rejection notice, or document copy) may be delivered through the channel and provider the sending organisation prefers; a PDF copy of the signed contract is additionally sent with the completion e-mail; this provider may be located abroad. Choosing the provider and the legal basis for the transfer are primarily the sending organisation's responsibility. This provider is not İmzala.org's processor; the SMS and e-mail providers are the sending organisation's own data processor, and where a WhatsApp Business account is used, the role between the provider and the organisation is governed by their own agreement. Delivery is technically carried out from İmzala.org's servers. This situation relates only to the delivery of the notification; İmzala.org's role regarding the signature evidence records (the time of the send request, IP, timestamp, audit record) does not change. If the sending organisation has chosen this option, the notification may be delivered from İmzala.org's own channel when this provider cannot be reached.
• Timestamp: the TÜBİTAK KamuSM timestamp service (domestic). If the sending party has enabled the EU-valid qualified timestamp (eIDAS) option, only the document's irreversible digest value (SHA-256) is additionally sent to a qualified timestamp service established in the European Union (Sectigo (Europe) SL, Spain); document content, your identity information, and your IP address are not sent.
• Identity verification: the General Directorate of Population and Citizenship Affairs (NVİ/KPS) - domestic, a public authority; only a name-surname/Turkish ID number/birth year match query.
• Mobile Signature (only if you choose this method): your phone number, the transaction description to be shown on your phone (part of the contract record number; and, if a certificate pairing step is required, your full name, a six-digit code and the time of the operation at that step), and the irreversible digest value to be signed are sent to your GSM operator (Turkcell, Türk Telekom, or Vodafone - domestic); the operator returns the signature and your qualified certificate. The contract content and your IP address are not sent to the operator. At this step the operator is not a processor but the independent data controller described in §1.
• Infrastructure/security: Cloudflare (connection metadata/proxy).
• Transfer to the sending party and to the contract's other parties (by way of display): your time of viewing and signing/approving the contract, the IP address of your connection (with the last segment masked on the Completion Certificate), your device type, the phone verification result and the e-mail delivery and link-click time and the SMS send time, your steps on the signing page (the page being opened, the viewed section ratios and pages of the document, the "I have seen the document" step, field window and save steps; the detailed list only in the control panel of the party that sent you the contract, and only as a summary to the other parties and on the Completion Certificate) are shown, for the purpose of evidencing the contract, to the party that sent you the contract through its control panel and the Completion Certificate; and to the other parties of the contract through the result page and the Completion Certificate given to them. These parties are not processors but the independent-data-controller layer described in §1. Whether phone verification took place, its type (at first signature or at first action), and whether the number later changed are also shown, with your name and identity information masked, on the publicly accessible verification page opened by the QR code on the Completion Certificate. The detailed list of interaction steps is not shown on the publicly accessible verification page. Your name and surname, your transaction status (waiting, awaiting approval, signed, approved, rejected or information party) and the time you signed or approved are shown to the other parties of the contract in the party list on the signing screen; this list does not include your e-mail address, your phone number or your Turkish ID number. When you sign or give your approval, the type of signing or approval method you used is also shown in the same list. This information is only the type of method: digital signature, secure electronic signature (by USB token or by Mobile Signature) or approval without a signature; it contains no detail about the verification steps you completed beyond what is listed in this item. If you rejected the contract or reported that you are not the intended recipient of the contract, this is shown to the other parties of the contract in the same list only as the "rejected" status; which of the two you chose and your reason are not part of this display. This information is shown so that the parties to the contract can see what stage the process is at and for the purpose of evidencing the contract, under KVKK art. 5/2-c (conclusion and performance of a contract) and art. 5/2-f (legitimate interest). Your time of rejection, on the other hand, is shown only to the party that sent you the contract (through its control panel, e-mail notification and the API and webhook integrations set up by the sending party); it is not shown to the other parties of the contract. The reason text you write when requesting changes as an approver or signer, when rejecting permanently as an approver, or when rejecting the signature as a signer is shown to the party that sent you the contract through the contract detail and timeline in its control panel and through e-mail notification (through the sending party's own e-mail provider if it has connected one), and through the API and webhook integrations set up by the sending party; the copy transferred to the sending party's own systems is the sending party's responsibility. SMS notifications (through whichever provider they are sent) do not include the reason text. The reason text is not shown to the other parties of the contract.

Current full list: Sub-processors. The basis for cross-border transfers to İmzala.org's own sub-processors is stated in the relevant item and in that list; for transfers to the sending organisation's own provider, the explanation above applies.

7. Your Rights (KVKK art. 11)

You can exercise your rights to access, correct, delete, object to processing, and (where applicable) withdraw explicit consent regarding your personal data through [email protected]. For requests concerning your personal data in the contract, you may also need to direct them, in the relevant layer, to the party that sent you the contract.

8. Obtaining a Copy of Your Document and Rejecting the Signature

This process is carried out electronically; the digital signature you apply is a valid signature under Law No. 5070 and its related legislation.

You can view, download, and print the document you signed and the signature/audit record. When the signature is completed, a copy of the signed document is provided to you and remains accessible to you afterwards, at no additional charge.

You are not obliged to sign. If you do not wish to proceed, you may reject the signature; in that case the process stops and the document is treated as unsigned. If phone verification is enabled for the contract, the rejection action is also verified with an SMS code.

If you participate as an approver, you give your decision by choosing Approve, Request Changes, or Reject Permanently. Writing a reason is mandatory for the Request Changes and Reject Permanently decisions. Reject Permanently ends the signing process for that contract and this decision cannot be undone. Until your change request is resolved, you cannot give approval and the signers cannot proceed to the signing stage; when the party that sent you the contract updates the document and resolves your request, your approval is requested again. If the sending party updates the content while an open change request exists on a contract that some approvers have already approved, and no one has yet signed or given a document decision, previously given approvals are reset with that update and a decision is requested again from the approvers; if a party has already signed or given a decision, the content can no longer be changed.

Translation version: 1.16-en.1. Source: Turkish version 1.16 (2026-10-12.1). Earlier versions and the change log are available in the Turkish version.

Translation change (1.16-en.1, 12 October 2026): translation of Turkish version 1.16. The Mobile Signature item now states that this method also applies when you choose it while signing your own document, not only when the sending party has enabled the secure electronic signature option; the wording was aligned with the KVKK Privacy Notice (§2). Signing a document you uploaded yourself was added to the scope sentence (introduction). The information shown to the other parties of the contract in the party list on the signing screen is now stated explicitly: your name and surname, your transaction status, the time you signed or approved, the type of signing or approval method you used (digital signature, secure electronic signature or approval without a signature) and, if you rejected the contract or reported that you are not its intended recipient, only the "rejected" status; this list does not include your e-mail address, your phone number or your Turkish ID number. The purpose and legal basis of this display (KVKK art. 5/2-c and art. 5/2-f) were stated. As in the previous version, your time of rejection and your reason text are not shown to the other parties (§6). The data sent to the operator, the purpose, the legal basis and the retention period are unchanged; no new recipient or transfer abroad arises.

Earlier translation change (1.15-en.1, 6 October 2026): translation of Turkish version 1.15. Decision reasons were added as processed data (§2); a "Decision reasons (rejection and change request)" row was added to the legal basis table: art. 5/2-c and art. 5/2-f (§4); the retention wording now reads "together with the contract record" and covers decision and rejection reasons, so it applies to the records of rejected contracts as well (§5); the reason text and the time of rejection are shown only to the party that sent you the contract (control panel, e-mail and the API and webhook integrations set up by the sending party), SMS notifications do not include the reason text, and they are not shown to the other parties, and the time of rejection was removed from the items shown to the other parties (§6); approver decisions (Approve / Request Changes / Reject Permanently) were explained, including that Reject Permanently ends the process and cannot be undone (§8). No new retention period was introduced.

Earlier translation change (1.14-en.1, 6 October 2026): translation of Turkish version 1.14. The GSM operator item now states that the Mobile Signature channel is in use today with Turkcell, Türk Telekom and Vodafone (it previously said Turkcell and Türk Telekom, and that the Vodafone channel was not yet in use). The operators were already named; no change to the data sent to the operator, its role as independent data controller, purpose, legal basis or retention; no new recipient.

Earlier translation change (1.13-en.1, 4 October 2026): translation of Turkish version 1.13. The GSM operator item now states that the Mobile Signature channel is in use today with Turkcell and Türk Telekom (it previously said only Turkcell). The operators were already named; no change to the data sent to the operator (the description of that data was made more detailed), its role as independent data controller, purpose, legal basis or retention; no new recipient. The Vodafone channel is not yet in use.

Earlier translation change (1.12-en.1, 29 September 2026): translation of Turkish version 1.12. The transaction security / signature evidence item now states that the language (Turkish or English) in which the signing page and the texts shown on it were displayed is recorded. No new purpose, legal basis, recipient or retention period.

Earlier translation change (1.11-en.3, 29 September 2026): wording corrections only, the Turkish text did not change. The masked IP address, the confirmation step and confirmation record, the phone verification sentence, and the first mentions of KVKK and KPS were aligned with the Turkish text.