Signing Process Privacy Notice

This notice explains how your personal data is processed when you sign or approve (as a signer, approver, or party) a contract sent to you or a document you uploaded yourself. If you participate as an approver, you do not add a signature to the document; your "Approve" action, its time, and your connection information are recorded in the same way. You can reach this notice from the confirmation step on the signing screen; it applies together with the general privacy notice under the Turkish Personal Data Protection Law No. 6698 (KVKK) (KVKK Privacy Notice) and Privacy Policy.

1. Data Controller (Layered)

There are two separate layers of responsibility in the signing process:

• The party that sent you the contract (a natural or legal person) is the independent data controller with respect to your personal data in the contract (name and surname, e-mail, phone, Turkish ID number if applicable, corporate party details if applicable, and contract content). İmzala.org acts as the data processor on behalf of the sending party with respect to this data. The sending party is responsible for the lawfulness of this personal data and for the KVKK article 10 privacy notice obligation; if the sending party has its own privacy notice, it is also presented to you by that party. The result page link record created to deliver the signed document to you is also within this scope; İmzala.org keeps this record on behalf of the sending party.
• Codeck Yazılım Anonim Şirketi (İmzala.org) is the independent data controller for the data it adds to its own account for the security and evidentiary integrity of the signing process (IP address, device information, signature timestamp, phone verification result, notification delivery and click records, the short-lived request counters kept to prevent misuse in new link requests made for an expired result link, the interaction record on the signing page, the electronic seal, the TÜBİTAK timestamp, the EU qualified timestamp if the sender enabled it, the integrity digest, and any biometric verification).
• Your GSM operator (Turkcell, Türk Telekom, or Vodafone; today the Turkcell, Türk Telekom and Vodafone channels are in use) is involved only if you choose to sign with Mobile Signature, and is the independent data controller at that step. Your mobile signature subscription and the qualified certificate on your SIM card are based on the relationship between you and your operator (and the Electronic Certificate Service Provider the operator works with); the operator separately fulfils its own privacy notice obligation for this processing. İmzala.org is not the operator's processor at this step.
• WhatsApp (Meta Platforms Ireland Ltd.) is the independent data controller, under its own terms of use, for your phone number and the delivery metadata carried in the notification, if the sending party has enabled the WhatsApp notification channel; it is not İmzala.org's processor (§6).

Contact / data controller requests: [email protected] - DPO: [email protected].

Sign Now from the Dashboard

In the Sign Now flow of the dashboard, you sign a document you uploaded yourself from your account as the only signer. The document is not sent to anyone else; no signing invitation or reminder is sent. In this flow, you are the layer described above as "the party that sent you the contract": you, or the organization on whose behalf you act, are the data controller for the content of the document you upload and the personal data in it (including data of third parties); Codeck Yazılım A.Ş. (İmzala.org) processes this content as a data processor solely to provide the signing service. Codeck Yazılım A.Ş. is the independent data controller for the records it keeps for account security, prevention of misuse and the integrity of signature evidence (the declaration and confirmation records listed in §2 and signature evidence). In this flow, no separate checkbox for the Terms of Use and this notice is shown on the signing screen; it is required that you have accepted the Terms of Use in force in your account, and a link to this notice is given on the signing screen. Phone, location, identity and biometric verification steps are not offered in the Sign Now flow of the dashboard. When the mobile app is offered, if you choose one of these steps yourself there, the step is processed as described in the relevant item of §2; your explicit consent is obtained separately for the location and biometric steps, and your choice and, if any, the withdrawal of your consent are kept as a separate record.

2. Personal Data Processed

• Identity and contact: first name, last name, e-mail, phone; if the contract requires it, date of birth and Turkish ID number (for identity verification and evidentiary value). Corporate party details (if entered by the sender): trade name or business name, tax number (for a sole proprietorship, this may be the Turkish ID number), tax office, address (including district and city); the data controller for this information is the sending party (§1). If the sender's template uses them, this information is printed on the contract document and reaches the other parties together with the document; if this information is incorrect, you may ask the sending party to correct it.
• Transaction security / signature evidence: the IP address of your connection, device and browser information, the timestamps of viewing and signing the contract, the signature image (handwritten), the integrity digest and timestamp of the signature; the delivery and link-click time of the e-mail notification sent to you, the send time of the SMS notification and (when the provider reports it) its delivery status, and the send time of the WhatsApp notification. When the link preview servers of messaging apps and social networks are recognised from their device information, their opening of the link is not recorded as a view. If the device information of a previously recorded view matches a known link preview tool, the record is neither deleted nor altered; a separate flag is added to it and the view is shown in the control panel of the party that sent the contract with the note "May have been opened by a link preview tool". The language (Turkish or English) in which the signing page and the information, confirmation and consent texts shown on it were displayed to you is also recorded. The signing page additionally records the following steps with their times: the page being opened; the document being displayed at 25%, 50%, 75%, 90%, and 100% on screen; the first view of each page; pressing the "I have seen the document, continue" button and the integrity digest (SHA-256) of the document displayed at that moment; a field's fill-in window being opened (only the field's identifier and type); and the signature box being opened and the save button being pressed. At each step, the time your device reports, the time the server records it, your IP address with its last segment masked, and your device/browser type are recorded. The record also includes the verification and signing steps that take place on the server: the sending of the phone verification code, its verification or failed attempts (without the code or the phone number); the result status of ID photo verification (including the rejection reason code for failed attempts) and, where applicable, an irreversible digest of the ID images; only the result status of liveness and ID card chip (NFC) verification; and the signing, rejection, approval without a signature and secure electronic signature steps. The detailed match result and the failure reason of liveness and ID card chip (NFC) verification do not enter this record. The steps are chained to each other with integrity digests. The moment you sign, the last link of the chain is added to the record for which a timestamp is obtained for your signature; no new step is added to the chain after signing. If you reject the signature, give unsigned approval, or sign the document with a secure electronic signature (USB token or mobile signature), the last link of the chain is likewise added to a separate record that contains no personal data; only the integrity digest of that record receives a TÜBİTAK KamuSM timestamp, and no new step is added to the chain after this operation. The values you type into fields, the text, and the signature image itself do not additionally enter this record; your mouse and keyboard movements and screen recordings are not kept. The on-screen steps show that the document was displayed on screen; they do not show that it was read or understood.
• Phone verification (optional): If the sending party has enabled this step, a single-use verification code is sent to your phone number by SMS; the code, the verification result, and its time are processed. The code may be requested in two ways. In the first, the code is requested before you view the contract. In the second, if the sending party has enabled this option in the signature field, the code is not sent before you view the contract but is instead sent right before you save your first signature, and the verification is recorded in association with that signature; in this case, the contract can be viewed by whoever opens the signing link without entering a code. If phone verification is also enabled for the contract, a separate code is requested for actions you take before signing, such as rejecting or giving unsigned approval, and the code is requested again for your first signature. The code is valid for 5 minutes. To be able to later show the connection between the verification and your number, a keyed digest of your phone number is stored; if the number later changes, the records show a "previous number" notation. This step does not record your identity; it records that whoever entered the code had access, at that moment, to the phone number provided by the sender.
• Stamp information (optional): The party sending you the contract may pre-fill a stamp field that you are to complete (for example, company name, address, tax number, phone, or Turkish ID number). You may correct this information, or clear a stamp field that is not mandatory, before signing. Where you do not edit a pre-filled stamp, the signing screen and the Completion Certificate carry the notation "This stamp information was pre-filled by the party sending the contract." The data controller for this information is the sending party (§1).
• Geolocation (optional): only with your explicit consent, precise location (GPS); if you do not give consent, only an approximate location derived from your IP may be processed, and you can still complete the signature.
• Biometric verification (optional, special category): if the sending party requests it and only with your separate explicit consent, face/liveness verification or reading the NFC chip of your ID card. Detail: KVKK Privacy Notice.
• Turkish ID verification (optional): If the sending party has enabled this step, the consistency of your name and surname, Turkish ID number, and date of birth is checked solely through a verification query against the records of the General Directorate of Population and Citizenship Affairs (NVİ) through the Identity Sharing System (KPS); no new data is registered with NVİ. Only the verification result and date are written to the system.
• ID photo verification (optional): If the sending party has enabled this step, you photograph the front and back of your ID card with your device's camera. The information in the image (name, surname, Turkish ID number, date of birth) is read using optical character recognition (OCR) and the machine-readable zone (MRZ), and matched against the signer information in the contract. No facial recognition is performed; no biometric template is extracted from the image. ID images are stored encrypted and processed for the purposes of identity verification, evidencing the signing process, and operating the service (troubleshooting, dispute review, and audit). Only a limited number of authorised staff can access the images, with logged access. The ID image is deleted 90 days after verification is completed, or within 30 days for attempts that remain inconclusive; the masked digest showing that verification took place and the match result continue to be stored together with the contract record. Detail: KVKK Privacy Notice.
• Secure electronic signature via Mobile Signature (optional): If the sending party has enabled the secure electronic signature option and you choose to sign with Mobile Signature, or if you choose this method while signing your own document, you select your operator and enter the phone number that holds your mobile signature subscription. A neutral transaction description containing part of the contract record number appears in the signature request sent to your phone, and you approve the signature with a single mobile signature PIN. If the certificate references are not returned by the operator, a one-time certificate matching step may first be requested; in that step your name and surname, a six-digit code, and the transaction time appear on your phone, the text carries the note "This is not a contract signature", and the contract is not signed at that step. The qualified certificate returned by the operator (which contains your name, surname, and Turkish ID number) is compared against the signer information in the contract. Your number, the operator name, your certificate's fingerprint, and the result of the identity match are written to the system. The content of your contract is not sent to the operator; the value that is signed is an irreversible digest generated from the document.
• Decision reasons: If an approver role is defined in the contract, you give your decision by choosing Approve, Request Changes, or Reject Permanently; the reason text you write for the Request Changes and Reject Permanently decisions (at least 10 and at most 1000 characters) is processed, and no reason is requested for the Approve decision. If you participate as a signer, you are not required to write a reason when rejecting the signature; if you do, that text is processed in the same way. The explanation you write when requesting changes as a signer is also processed in the same way. The reason is text that you write freely; we recommend that you do not include personal data that is not necessary (for example, another person's identity or contact information) in this text.
• New version of the contract: Where a change or correction is needed in a contract it has sent (for example, following a change request by a party), the party that sent you the contract may prepare and send a new version of the contract. In that case, the identity and contact details recorded for you in the contract (including those entered by the sending party and those you entered during identity verification on the previous version: name and surname, e-mail, phone and, where present in the contract, Turkish ID number, ID card serial number, date of birth, address and company details) are carried over to the new version. The result of identity verification is not carried over; where required, verification is carried out again on the new version. The approval, signature, decision and consent records, verification results and signature evidence you gave on the previous version are not carried over to the new version; they are kept unchanged, together with that version's document, as the record of the previous version. If the sending party changes any of your details in the new version, whether this is a correction of the same person's details or a replacement of the party with another person is entered in the version record according to the sending party's choice. If the sending party makes no choice, the party is recorded as another person when the Turkish ID number is changed to another valid number or, where there is no number, when the e-mail and phone are changed together, and as the same person for other corrections. This record is kept so that the records belonging to the same person can be matched across the versions of the contract (version history and comparison between versions) and so that your erasure and rectification requests can be applied to all versions that concern you. This matching and the transaction records of the previous version are also used to calculate correctly, across versions, the service fee (credits) of the party that sent the contract; this use has no additional consequence for you. İmzala.org does not verify your identity through this statement. All versions of a contract are part of the same contract record and are subject to the same retention period (§5).
• Document decisions in multi-document submissions: If the party sending you the contract added more than one document to the submission (for example, a contract, a privacy notice, an explicit consent text, a preliminary information form), the decision you give for each document (accepted, confirmed reading, declined, gave consent or did not give consent) and the time of the decision are recorded. Your decision on the explicit consent text relates to the own processing activity of the sending party that presents that text to you; the sending party is the data controller of that activity, and İmzala.org keeps this record on behalf of the sending party (§1). Not giving consent does not prevent you from signing the contract. To withdraw consent you have given, you need to send your request to the sending party.
• Evidence files added to the completed signed document: When the signing process is completed, the following are placed as attached files inside the signed PDF given to all parties: for each signer, the part of the signing record shared with the parties (party order and role, signing time, integrity digests of the signature image and of the document pages presented to you, the digest of the last link of the signing page interaction record and the number of entries), the TÜBİTAK KamuSM timestamp obtained for this part, and verification instructions. The shared part of the signing record does not contain your name, IP address, device and browser information, location, Turkish ID number or its digest, phone number or verification code information; these are in the part of the signing record kept separately on the platform, and the shared part contains only an integrity digest of that separate part created with a random value. The original document uploaded by the sending party may also be added as uploaded (including the metadata inside the file and any earlier editing versions); when it is not added, only its integrity digest is written. When the original document is added, its content (including personal data in the contract text) is added as written in the document. These attachments are not placed in documents signed with a secure electronic signature, documents signed before upload or documents in archival format.
• Sign Now from the dashboard (only if you use this flow): For each file you upload, its name, type, size, integrity digest (SHA-256) and the number of signatures already in the file are recorded; documents and images other than PDF are converted to PDF and page images are generated. The declarations and confirmations in the flow are kept as separate records: the upload authority declaration you tick in the upload step; when you press the Continue to signing button and open the secure signing area, confirmation of the information about the legal effect of the signing method and the evidence records, the signing intent declaration and a reference to the Terms of Use acceptance record you gave earlier in your account; and, if you delete the draft, your deletion request. The information confirmation and the signing intent are recorded when you press this button, using the version and digest of the server's fixed declaration texts; in the mobile app, the digest of the text the app showed you is recorded. Each record contains the version and integrity digest of the declaration text, the time of the record and the integrity digest of the document version at that moment; the information confirmation, signing intent and Terms of Use reference records also contain your IP address with its last segment masked, your device type and an irreversible digest of your browser information (in the mobile app, also the operating system and app version). The records carry an irreversible identifier linking you and your workspace to this document. Your choice of whether you sign on your own behalf or as an authorized representative of the organization in your workspace is recorded; this choice and the organization's legal name are included in the integrity digest of the document version. To prevent the same upload from being repeated by mistake, an upload transaction record linked to your account is kept; this record does not contain the file name or file content in plain text, only irreversible digests generated from them. If you choose the secure electronic signature, your Turkish ID number is collected so that the signature can be matched with the ID number in your certificate, and it is written to the signature record; if a Turkish ID number is registered in your profile, it is also compared with that number, and if none is registered, you may also save it to your profile. If your account has a verified phone number, this number is copied to your party in the signature record; in the Sign Now flow, Mobile Signature can only be used with this verified number and for single-document transactions. When you sign, the transaction security / signature evidence records above are also kept in this flow. When signing is completed, the signed document is sent as a PDF attachment to your account's e-mail address; if a phone number is registered in your account, an SMS notification may also be sent.

3. Purposes of Processing

To enable you to view and sign the contract; to evidence to whom, when, and under what conditions the signature was applied (non-repudiation); to ensure the security and integrity of the signing process; to prevent misuse; to notify you, when a new version of the contract is sent, that the process for the previous version has been closed, and to keep a record of the version history of the contract; to calculate the fee for the service provided to the party that sent the contract; to fulfil obligations arising from applicable legislation.

4. Legal Basis

Data	Legal basis (KVKK)
Name-surname, e-mail, phone, Turkish ID number, date of birth, corporate party details	art. 5/2-c, performance of a contract (signing party)
IP, device/browser, viewing/signing timestamps, signature image, integrity digest	art. 5/2-f, legitimate interest (evidentiary value) and art. 5/2-ç, legal obligation under Law No. 5070
Evidence files added to the signed document (shared part of the signing record, timestamp, the original document when added)	art. 5/2-f, legitimate interest (evidentiary value) and art. 5/2-e, establishment, exercise or protection of a right
Signing page interaction record (page opening, viewed section ratios, first views of pages, the "I have seen the document" step and document digest, opening a field window (field type), signature box and save steps; times, masked IP, device type). The record also includes the verification and signing steps that take place on the server: the sending of the phone verification code, its verification or failed attempts (without the code or the phone number); the result status of ID photo verification (including the rejection reason code for failed attempts) and, where applicable, an irreversible digest of the ID images; only the result status of liveness and ID card chip (NFC) verification; and the signing, rejection, approval without a signature and secure electronic signature steps. The detailed match result and the failure reason of liveness and ID card chip (NFC) verification do not enter this record.	art. 5/2-f, legitimate interest (evidencing which document was displayed when the signature was applied); in the event of a dispute, art. 5/2-e, establishment, exercise, or protection of a right
Precise location (GPS)	art. 5/1, explicit consent (optional)
Biometric face/liveness verification	art. 6/2, explicit consent (optional, special category)
Turkish ID verification query (NVİ/KPS matching)	art. 5/2-f legitimate interest (identity accuracy and evidentiary value); art. 5/2-ç, legal obligation under Law No. 5070
ID document image (front + back), the match result of information read via OCR/MRZ	art. 5/2-f, legitimate interest (identity verification and evidentiary value) (optional)
Phone verification code (SMS OTP), verification result, time, and type (login, first signature, first action), keyed digest of the phone number; notification e-mail delivery and click time, SMS and WhatsApp send time	art. 5/2-f, legitimate interest (transaction security and evidentiary value)
Result page link record (irreversible digest of the link, the party and channel it was sent to, creation, validity and revocation time; İmzala.org keeps this record on behalf of the sending party, §1)	The sending party's legal basis; for delivering a copy of the signed document to you, as a rule art. 5/2-c, performance of a contract
New link request (security check and short-lived request counters containing the IP address and, for delivery by SMS or WhatsApp, the phone number)	art. 5/2-f, legitimate interest (security of the link and prevention of misuse)
Mobile Signature: phone number, operator name, qualified certificate, and identity match result (only if you choose this method)	art. 5/2-c, performance of a contract and art. 5/2-ç, legal obligation under Law No. 5070
Decision reasons (rejection and change request)	art. 5/2-c, a statement made in the course of concluding and performing the contract; art. 5/2-f, legitimate interest (evidentiary value)
Identity and contact details carried over to the new version of the contract	art. 5/2-c, conclusion and performance of the contract; art. 5/2-f, legitimate interest (continuing the corrected version of the contract with the same parties)
The document and records of the previous version	art. 5/2-f, legitimate interest (preserving the version history and evidentiary value); in case of a dispute, art. 5/2-e, establishment, exercise or protection of a right
The "same person" record in the version record	art. 5/2-f, legitimate interest (matching the records across versions); for applying your erasure and rectification requests to all versions that concern you, art. 5/2-ç, legal obligation (KVKK art. 7 and art. 11)
Matching and transaction records used to calculate the service fee of the party that sent the contract	art. 5/2-f, legitimate interest (correct calculation of the fee for the service provided)
New version notification (the channel used, delivery status and time)	art. 5/2-c, conclusion and performance of the contract (informing the parties of the status of the process); art. 5/2-f, legitimate interest (proof that the notification was made)
Sign Now from the dashboard: name, type, size and integrity digest of the uploaded file, choice of signing capacity, upload transaction record (only if you use this flow)	art. 5/2-c, performance of a contract (provision of the service)
Sign Now from the dashboard: Turkish ID number for the secure electronic signature	art. 5/2-c, performance of a contract; art. 5/2-ç, legal obligation under Law No. 5070; in case of a dispute, art. 5/2-e, establishment, exercise or protection of a right
Sign Now from the dashboard: declaration and confirmation records (declaration version and digest, time, digest of the document version; masked IP and device information in the relevant records)	art. 5/2-f, legitimate interest (transaction security, prevention of misuse and evidentiary value); in case of a dispute, art. 5/2-e, establishment, exercise or protection of a right

Because the core data of the signing process (identity, IP, device, signature image, timestamp) rests on the bases above, no explicit consent is obtained for them. The checkbox you accept on the signing screen is acceptance of the Terms of Use and confirmation that you have read this notice; it is not explicit consent under KVKK. Explicit consent is obtained separately only for the optional location and biometric steps marked above; the ID photo verification step, on the other hand, is processed under legitimate interest, does not additionally require explicit consent, but is activated only at the sending party's choice. For the Sign Now flow of the dashboard, see §1.

5. Retention Periods

• Signature and evidence data (identity, IP, device, signature image, timestamp, confirmation record, decision and rejection reasons, signing page interaction record, notification delivery and click times, the part of the signing record kept separately on the platform): up to 10 years, together with the contract record, within the scope of evidentiary value and statutory retention obligations (Law No. 5070, Turkish Commercial Code art. 82, Turkish Code of Obligations art. 146, Code of Civil Procedure art. 199). The interaction record is retained and, when deleted, deleted as a whole together with the contract. Because the record has a chained structure, individual steps are not deleted separately. Evidence files added to the signed document remain in the parties' copies of the document; deletion on the platform does not affect those copies. After the part kept separately on the platform is deleted, the integrity digest in the shared part can no longer be opened.
• Phone verification code: 5 minutes; deleted upon verification, expiry, or exceeding the attempt limit, and unused codes are automatically cleared by the next day at the latest. The verification result, time, type, and the keyed digest of the phone number are retained together with the signature and evidence data for up to 10 years, and deleted together when the contract is deleted.
• ID document image (front + back): deleted within 90 days after verification is completed, or within 30 days for attempts that remain inconclusive; for attempts using a document type that is not accepted, the image is deleted upon rejection. Where necessary due to a dispute, request, or legal review, the image may be retained, limited to the duration of that need, for the establishment, exercise, or protection of a right (KVKK art. 5/2-e).
• Identity verification record (masked digest of the information read, irreversible digest of the ID images, match result, and verification timestamp): up to 10 years, together with the signature evidence (Law No. 5070, Turkish Commercial Code art. 82 (for the merchant side), Turkish Code of Obligations art. 146, Code of Civil Procedure art. 199).
• Mobile Signature records: if you signed by this method, your phone number, operator name, your certificate's fingerprint, and the identity match result are retained for up to 10 years, together with the signature evidence. The records of the signature ceremony (the operator's transaction numbers and the transaction description shown on your phone) are kept attached to the relevant contract and are deleted together when the contract is deleted. A copy of your qualified certificate is additionally stored so that matching does not need to be repeated for your subsequent signatures; when your certificate is renewed or changed, this copy is replaced with the new one. You may request the deletion of this copy at any time from [email protected].
• Biometric data (face images, liveness frames, match details and score): at most 1 year, then automatically deleted/anonymised. The record showing that verification took place and its result status contains no biometric data; it is retained for up to 10 years together with the interaction record.
• WhatsApp notification and correspondence record (the sent notification text, the recipient number, and any replies you send on this line): the notification-send record is retained together with the signature and evidence data for up to 10 years; replies you send on this line are retained as support correspondence for the duration of the support record.
• Result page link record (irreversible digest of the link, the party and channel it was sent to, creation, validity and revocation time): the link is valid for 90 days; the record is deleted automatically 30 days after the end of the validity period, or together with the contract if the contract is deleted earlier. The link itself is not kept in this record. The request counters kept to prevent misuse when a new link is requested (your IP address; for delivery by SMS or WhatsApp, also your phone number) are deleted automatically within 24 hours at the latest. For links that are not time-limited, see §2.
• Contract versions: No separate period is run for previous versions for which a new version has been sent; these versions are kept as part of the contract record and are deleted together with all versions when the retention period of the contract record ends. The delivery tracking record of the new version notification (channel, delivery status and time; your contact address is not written to this record) is deleted 1 year after the notification is concluded. The information on which channel the notification was sent through and when is kept in the transaction records of the contract for the same period as the contract record. A comparison report showing the changes between two versions may be produced for the sending party. The report may contain images and text excerpts of the changed parts of the document, is not sent to you, and is kept and deleted together with the contract record.
• Incomplete/abandoned signature requests: when the related contract is deleted, all attached records are deleted together (except the declaration and confirmation records in Sign Now from the dashboard, see below).
• Sign Now from the dashboard: Temporary files of an upload that could not be completed are deleted automatically within a short time. You can delete your draft from the dashboard before signing is completed; in that case the document you uploaded, the page images and the values you entered in the fields are deleted; a record showing your deletion request is added and the declaration and confirmation records created up to that point are not deleted. Drafts you do not delete remain in your account until you delete them. The upload transaction record is deleted after 30 days; if file cleanup is still in progress at that time, it is deleted once cleanup is completed. The document you signed and the signature and evidence records are subject to the same period as the signature and evidence data above. Declaration and confirmation records (including the deletion request record if you deleted the draft without signing) are retained for up to 10 years for evidentiary value.

6. Transfers

• Notification delivery (İmzala.org's own channels): Mailgun for e-mail (Frankfurt/EU); İmzala.org's system account for SMS (NetGSM, Kobikom, or Twilio); WhatsApp (Meta Platforms Ireland Ltd., Ireland; global infrastructure) if the sending party has enabled the WhatsApp channel. Only your phone number, your name and surname, your signing link, and the message text are sent to WhatsApp; document content, Turkish ID number, and IP address are not sent. This transfer is a cross-border transfer under KVKK art. 9; Meta, in this transfer, is not İmzala.org's processor but an independent data controller processing the data under its own terms of use and privacy policy, and there is no separate data processing agreement between İmzala.org and Meta. The channel is optional and may be turned off by the sending party; the data transferred is limited to the phone number, name and surname, signing link, and message text. A process to complete the appropriate safeguard (the Board's standard contract) for this transfer is under way.
• Notification delivery (sending party's own provider): The organisation sending you the contract may choose to have notifications delivered through its own SMS, e-mail (SMTP or e-mail API), or WhatsApp Business account. Notifications related to the signing process (for example invitation, reminder, completion, rejection notice, or document copy) may be delivered through the channel and provider the sending organisation prefers; a PDF copy of the signed contract is additionally sent with the completion e-mail; this provider may be located abroad. Choosing the provider and the legal basis for the transfer are primarily the sending organisation's responsibility. This provider is not İmzala.org's processor; the SMS and e-mail providers are the sending organisation's own data processor, and where a WhatsApp Business account is used, the role between the provider and the organisation is governed by their own agreement. Delivery is technically carried out from İmzala.org's servers. This situation relates only to the delivery of the notification; İmzala.org's role regarding the signature evidence records (the time of the send request, IP, timestamp, audit record) does not change. If the sending organisation has chosen this option, the notification may be delivered from İmzala.org's own channel when this provider cannot be reached.
• Timestamp: the TÜBİTAK KamuSM timestamp service (domestic). If the sending party has enabled the EU-valid qualified timestamp (eIDAS) option, only the document's irreversible digest value (SHA-256) is additionally sent to a qualified timestamp service established in the European Union (Sectigo (Europe) SL, Spain); document content, your identity information, and your IP address are not sent.
• Identity verification: the General Directorate of Population and Citizenship Affairs (NVİ/KPS) - domestic, a public authority; only a name-surname/Turkish ID number/birth year match query.
• Mobile Signature (only if you choose this method): your phone number, the transaction description to be shown on your phone (part of the contract record number; and, if a certificate pairing step is required, your full name, a six-digit code and the time of the operation at that step), and the irreversible digest value to be signed are sent to your GSM operator (Turkcell, Türk Telekom, or Vodafone - domestic); the operator returns the signature and your qualified certificate. The contract content and your IP address are not sent to the operator. At this step the operator is not a processor but the independent data controller described in §1.
• Infrastructure/security: Cloudflare (connection metadata/proxy). When you open an expired result link, if the link is registered in your name, a security check (Cloudflare Turnstile) is loaded on the page; for the check, your IP address and your browser and device information are sent to Cloudflare, our infrastructure provider headquartered in the United States; the basis for this transfer abroad is stated on the Sub-processors page (§2).
• Transfer to the sending party and to the contract's other parties (by way of display): your time of viewing and signing/approving the contract, the IP address of your connection (with the last segment masked on the Completion Certificate), your device type, the phone verification result and the e-mail delivery and link-click time and the SMS send time, your steps on the signing page (the page being opened, the viewed section ratios and pages of the document, the "I have seen the document" step, field window and save steps, the result status of the phone, identity, liveness and ID card chip (NFC) verification steps and failed attempts) are shown, for the purpose of evidencing the contract, to the party that sent you the contract through its control panel and the Completion Certificate; and to the other parties of the contract through the result page and the Completion Certificate given to them. The detailed list of your steps on the signing page and the failed attempts are shown only in the control panel of the party that sent you the contract. A view record carrying the preview tool flag (§2) is shown with that note in the control panel of the party that sent you the contract. This note appears only in the sending party's control panel; on the Completion Certificate and the result page, the viewing time continues to be shown without the note. You can request the correction of the viewing record on a Completion Certificate already issued under KVKK art. 11 at [email protected]. Whether you completed the confirmation step on the signing screen (acceptance of the Terms of Use and confirmation that you have read this notice) is shown to the party that sent you the contract in the control panel. For submissions containing more than one document, the decision you give for each document and its time are shown to the party that sent you the contract in the control panel and through the API integrations set up by the sender. The decision you give on an explicit consent document is not shown to the contract's other parties (including the Completion Certificate and documents sent to them) or on the public result page; it is shown only to you and to the party that sent you the contract. The other parties and the Completion Certificate are shown only a summary: the page being opened, the viewing ratio, the number of pages viewed, the "I have seen the document" step and the integrity status of the record. These parties are not processors but the independent-data-controller layer described in §1. Whether phone verification took place, its type (at first signature or at first action), and whether the number later changed are also shown, with your name and identity information masked, on the publicly accessible verification page opened by the QR code on the Completion Certificate. The detailed list of interaction steps is not shown on the publicly accessible verification page. Your name and surname, your transaction status (waiting, awaiting approval, signed, approved, rejected or information party) and the time you signed or approved are shown to the other parties of the contract in the party list on the signing screen; this list does not include your e-mail address, your phone number or your Turkish ID number. When you sign or give your approval, the type of signing or approval method you used is also shown in the same list. This information is only the type of method: digital signature, secure electronic signature (by USB token or by Mobile Signature) or approval without a signature; it contains no detail about the verification steps you completed beyond what is listed in this item. If you rejected the contract or reported that you are not the intended recipient of the contract, this is shown to the other parties of the contract in the same list only as the "rejected" status; which of the two you chose and your reason are not part of this display. This information is shown so that the parties to the contract can see what stage the process is at and for the purpose of evidencing the contract, under KVKK art. 5/2-c (conclusion and performance of a contract) and art. 5/2-f (legitimate interest). Your time of rejection, on the other hand, is shown only to the party that sent you the contract (through its control panel, e-mail notification and the API and webhook integrations set up by the sending party); it is not shown to the other parties of the contract. The reason text you write when requesting changes as an approver or signer, when rejecting permanently as an approver, or when rejecting the signature as a signer is shown to the party that sent you the contract through the contract detail and timeline in its control panel and through e-mail notification (through the sending party's own e-mail provider if it has connected one), and through the API and webhook integrations set up by the sending party; the copy transferred to the sending party's own systems is the sending party's responsibility. SMS notifications (through whichever provider they are sent) do not include the reason text. The reason text is not shown to the other parties of the contract.
• Evidence files added to the signed document: The evidence files listed in §2 are given, together with the signed document, to the party that sent you the contract and to the other parties of the contract. When the original document is added, it is added as uploaded, so the metadata and earlier editing versions inside it also reach the parties; these versions may contain earlier content that is not visible in the document. No new recipient or transfer abroad arises.

Current full list: Sub-processors. The basis for cross-border transfers to İmzala.org's own sub-processors is stated in the relevant item and in that list; for transfers to the sending organisation's own provider, the explanation above applies.

7. Your Rights (KVKK art. 11)

You can exercise your rights to access, correct, delete, object to processing, and (where applicable) withdraw explicit consent regarding your personal data through [email protected]. For requests concerning your personal data in the contract, you may also need to direct them, in the relevant layer, to the party that sent you the contract.

8. Obtaining a Copy of Your Document and Rejecting the Signature

This process is carried out electronically; the digital signature you apply is a valid signature under Law No. 5070 and its related legislation.

You can view, download, and print the document you signed and the signature/audit record. When the signature is completed, if you have a registered e-mail address and the sending party has not turned off e-mail notifications, a PDF copy of the signed document is sent to you with the completion e-mail; in multi-document submissions, if the files exceed the e-mail size limit, no attachment is sent and the document can be reached through the access link in the e-mail. The result page link is valid for 90 days; if the link is registered in your name, you can request a new link on the same page within 30 days after the end of its validity (§2); in other cases, you can ask the person who sent you the document. No additional charge is made.

You are not obliged to sign. If you do not wish to proceed, you may reject the signature; in that case the process stops and the document is treated as unsigned. If phone verification is enabled for the contract, the rejection action is also verified with an SMS code.

If you participate as an approver, you give your decision by choosing Approve, Request Changes, or Reject Permanently. Writing a reason is mandatory for the Request Changes and Reject Permanently decisions. Reject Permanently ends the signing process for that contract and this decision cannot be undone. Until your change request is resolved, you cannot give approval and the signers cannot proceed to the signing stage; when the party that sent you the contract updates the document and resolves your request, your approval is requested again. If the sending party updates the content while an open change request exists on a contract that some approvers have already approved, and no one has yet signed or given a document decision, previously given approvals are reset with that update and a decision is requested again from the approvers; if a party has already signed or given a decision, the content can no longer be changed.

The party that sent you the contract may also make a change to the document by preparing and sending a new version of the contract. While the new version is being prepared, no approval or digital signature is collected on the previous version. When the new version is sent, the approval and digital signature process for the previous version is closed on İmzala.org and the process starts again for the new version; any approval or signature you gave on the previous version is not carried over to the new version and is kept as the record of the previous version. The link for the previous version can no longer be used for any action; if you are also included in the new version, you will be sent a new link when it is your turn.

Translation version: 1.23-en.1. Source: Turkish version 1.23 (2026-10-24.1). Earlier versions and the change log are available in the Turkish version.

Translation change (1.22-en.1, 22 October 2026): translation of Turkish version 1.22 (version identifier 2026-10-22.1). It was explained that the sending party may prepare and send a new version of the contract; that the identity and contact details recorded for you (including those you entered during identity verification) are carried over, while the verification result and the records of the previous version are not; how a change to your details is recorded as the same person or another person, and why, and that this matching and the transaction records of the previous version are also used to calculate the service fee of the sending party (§2); how parties are notified when a new version is sent (§2); the purpose and legal bases (§3, §4); that no separate retention period is run for previous versions, the retention of the notification tracking record and the comparison report produced for the sending party and not sent to you (§5); and that no approval or digital signature is collected on the previous version while a new version is being prepared and the process for the previous version is closed when the new version is sent (§8). There is no new data category, recipient or transfer abroad.

Translation change (1.21-en.1, 21 October 2026): translation of Turkish version 1.21 (version identifier 2026-10-19.1). It was stated that, if documents have been requested from you, the information on document collection and the authorisation statement are shown at the first step of the signing process and that your confirmation at this step is also recorded as your document confirmation (§2). There is no new data category, recipient or transfer abroad.

Translation change (1.20-en.1, 18 October 2026): translation of Turkish version 1.20 (version identifier 2026-10-18.1). It was stated that a separate result page link of the signed document is created for each delivery and is valid for 90 days; that result links sent before this change, links the sending party obtained through the API and links sent in exceptional cases where a time-limited link could not be created due to a technical failure are not time-limited; that the document is not shown through an expired or invalidated link; that if the link is registered in your name a new link can be requested within 30 days after the end of its validity to the contact details registered in the contract through a limited request that passes a security check (Cloudflare Turnstile), and in other cases the new link is to be requested from the person who sent the document; and, in §8, that a PDF copy of the signed document is sent to the registered e-mail address (§2, §8). It was stated that openings by the link preview servers of messaging apps and social networks are not recorded as views, and that previously recorded views matching a known preview tool are flagged without being deleted or altered and are shown in the sender's control panel with the note "May have been opened by a link preview tool" (§2, §6); it was added that this note appears only in the sender's control panel and that correction of the viewing record on a Completion Certificate already issued can be requested under KVKK art. 11 (§6). It was stated that the result page link record is among the records for which the sending party is the data controller and which İmzala.org keeps on the sender's behalf, and that the short-lived request counters kept for new link requests are among the records for which İmzala.org is an independent data controller (§1); the legal bases for this record and for the new link request (§4), deletion of the record 30 days after the end of its validity and deletion of the request counters within 24 hours at the latest (§5), and the data sent to Cloudflare, headquartered in the United States, for the security check, with the basis of this transfer abroad stated on the Sub-processors page (§6), were added. Cloudflare is an existing infrastructure provider on the sub-processor list; no new recipient arises.

Translation change (1.19-en.1, 15 October 2026): translation of Turkish version 1.19 (version identifier 2026-10-15.1). The evidence files added to the completed signed document were described: for each signer, the part of the signing record shared with the parties (fields without personal data and an integrity digest of the part kept separately on the platform, created with a random value), the TÜBİTAK KamuSM timestamp of this part, verification instructions and, when added, the original document (as uploaded, including metadata and earlier editing versions) (§2); their legal bases (§4); that the separately kept part of the signing record is retained together with the signature and evidence data and that the attachments remain in the parties' copies (§5); and that the attachments are given with the signed document to the sending party and the other parties (§6). No new recipient or transfer abroad arises.

Translation change (1.18-en.2, 14 October 2026): translation of Turkish version 1.18 (version identifier 2026-10-14.1). It was stated that, in multi-document submissions, the decision given for each document (accepted, confirmed reading, declined, gave consent or did not give consent) and its time are recorded; that for the decision on an explicit consent text the data controller is the sending party that presents the text and İmzala.org keeps this record on behalf of the sending party; that not giving consent does not prevent signing the contract; and that a request to withdraw consent must be sent to the sending party (§2). It was stated explicitly that document decisions and their times are shown to the party that sent the contract in the control panel and through API integrations, that the decision on an explicit consent text is not shown to the contract's other parties (including the Completion Certificate and documents sent to them) or on the public result page and is shown only to the person deciding and to the sender, and that whether the confirmation step on the signing screen was completed is shown to the sender in the control panel (§6). This information is kept within the existing transaction security / signature evidence scope and, for explicit consent decisions, so that the sending party can prove the consent; no new recipient or transfer abroad arises. With these additions the version identifier was updated from 2026-10-13.2 to 2026-10-14.1; the identifier 2026-10-13.2 was not published in the production environment.

Translation change (1.18-en.3, 14 October 2026): translation of Turkish version 1.18 (version identifier 2026-10-14.2). The §6 sentence on explicit consent decisions was narrowed: the decision is not shown to the contract's other parties (including the Completion Certificate and documents sent to them) or on the public result page, and is shown only to the person deciding and to the sender. Identifiers 2026-10-13.2 and 2026-10-14.1 were never published in production.

Translation change (1.18-en.1, 13 October 2026): translation of Turkish version 1.18. The Sign Now flow of the dashboard (uploading your own document and signing it as the only signer) was described: the data controller and data processor layers in this flow, the requirement of Terms of Use acceptance in your account instead of a separate checkbox, and that no additional verification step is offered in the dashboard (§1); the records specific to the flow (uploaded file information, declaration and confirmation records, signing capacity, upload transaction record, Turkish ID number for the secure electronic signature, copying of the verified profile phone, completion notification) (§2), their legal bases (§4) and retention periods (§5). The flow has been in use since September 2026; this version describes the records specific to the flow in detail. No new recipient or transfer abroad arises; notifications are sent through the existing channels listed in §6.

Earlier translation change (1.17-en.1, 13 October 2026): translation of Turkish version 1.17. The verification and signing steps that take place on the server were added to the interaction record (§2, §4, §5, §6). There is no new data category, recipient or transfer abroad; this falls within the existing transaction security / signature evidence purpose and the retention period of up to 10 years. The biometric data item in §5 was clarified: the 1-year period applies to face images, liveness frames, match details and score; the record showing that verification took place and its result status contains no biometric data and is retained for up to 10 years together with the interaction record.

Earlier translation change (1.16-en.1, 12 October 2026): translation of Turkish version 1.16. The Mobile Signature item now states that this method also applies when you choose it while signing your own document, not only when the sending party has enabled the secure electronic signature option; the wording was aligned with the KVKK Privacy Notice (§2). Signing a document you uploaded yourself was added to the scope sentence (introduction). The information shown to the other parties of the contract in the party list on the signing screen is now stated explicitly: your name and surname, your transaction status, the time you signed or approved, the type of signing or approval method you used (digital signature, secure electronic signature or approval without a signature) and, if you rejected the contract or reported that you are not its intended recipient, only the "rejected" status; this list does not include your e-mail address, your phone number or your Turkish ID number. The purpose and legal basis of this display (KVKK art. 5/2-c and art. 5/2-f) were stated. As in the previous version, your time of rejection and your reason text are not shown to the other parties (§6). The data sent to the operator, the purpose, the legal basis and the retention period are unchanged; no new recipient or transfer abroad arises.

Earlier translation change (1.15-en.1, 6 October 2026): translation of Turkish version 1.15. Decision reasons were added as processed data (§2); a "Decision reasons (rejection and change request)" row was added to the legal basis table: art. 5/2-c and art. 5/2-f (§4); the retention wording now reads "together with the contract record" and covers decision and rejection reasons, so it applies to the records of rejected contracts as well (§5); the reason text and the time of rejection are shown only to the party that sent you the contract (control panel, e-mail and the API and webhook integrations set up by the sending party), SMS notifications do not include the reason text, and they are not shown to the other parties, and the time of rejection was removed from the items shown to the other parties (§6); approver decisions (Approve / Request Changes / Reject Permanently) were explained, including that Reject Permanently ends the process and cannot be undone (§8). No new retention period was introduced.

Earlier translation change (1.14-en.1, 6 October 2026): translation of Turkish version 1.14. The GSM operator item now states that the Mobile Signature channel is in use today with Turkcell, Türk Telekom and Vodafone (it previously said Turkcell and Türk Telekom, and that the Vodafone channel was not yet in use). The operators were already named; no change to the data sent to the operator, its role as independent data controller, purpose, legal basis or retention; no new recipient.

Earlier translation change (1.13-en.1, 4 October 2026): translation of Turkish version 1.13. The GSM operator item now states that the Mobile Signature channel is in use today with Turkcell and Türk Telekom (it previously said only Turkcell). The operators were already named; no change to the data sent to the operator (the description of that data was made more detailed), its role as independent data controller, purpose, legal basis or retention; no new recipient. The Vodafone channel is not yet in use.

Earlier translation change (1.12-en.1, 29 September 2026): translation of Turkish version 1.12. The transaction security / signature evidence item now states that the language (Turkish or English) in which the signing page and the texts shown on it were displayed is recorded. No new purpose, legal basis, recipient or retention period.

Earlier translation change (1.11-en.3, 29 September 2026): wording corrections only, the Turkish text did not change. The masked IP address, the confirmation step and confirmation record, the phone verification sentence, and the first mentions of KVKK and KPS were aligned with the Turkish text.