Privacy notice (KVKK information notice and cookie notice)

1. Data controller

1.1. Under Law No. 6698 on the Protection of Personal Data (the “KVKK”), the data controller is Muhammed Emin Keskin, a licensed Turkish CPA (Serbest Muhasebeci Mali Müşavir, SMMM) trading under the business name ETITAX (“ETITAX”).

• Tax identification number: 5470615848
• Professional chamber: Erzurum Chamber of Certified Public Accountants (Erzurum Serbest Muhasebeci Mali Müşavirler Odası), registration no. 487
• Address: Rabia Ana Mah. Menderes Cad. No: 8/7, Yakutiye, Erzurum, Türkiye
• E-mail: info@etitax.com
• Telephone: +90 442 213 94 04

1.2. This notice has been prepared under Article 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

2. Persons covered by this notice

• Visitors to the website www.etitax.com (the “Website”);
• Persons who contact ETITAX by WeChat, WhatsApp, e-mail or telephone;
• Persons who place orders and make payments through the Website or through a payment link;
• Clients, and the shareholders, managers, authorised signatories and attorneys of client companies;
• Persons whose data appear in documents that clients send to ETITAX (for example, employees of companies for which payroll services are provided).

3. Personal data processed

Category	Examples
Identity	Name, nationality, date of birth, passport or identity document details and copies, tax identification number, foreigner identity number, Turkish identity number (T.C. kimlik numarası)
Contact	Telephone number, e-mail address, WeChat and WhatsApp account details, address
Customer transaction	Order, service and amount details, payment result, invoice or receipt details, correspondence, approved documents and time of approval
Legal transaction	Powers of attorney, articles of association, signature declarations, correspondence with authorities
Finance and accounting	Bank account details, invoices, ledger entries, tax returns, salary information
Professional	Title, role and shareholding in the company
Transaction security	IP address, date and time, pages visited, browser information (server logs)
Special categories	Only for the payroll service and where a legal obligation requires it, health data of employees, such as sick-leave reports

Card details (card number, expiry date, security code) are not processed by ETITAX; they are entered only on the bank’s payment page. ETITAX receives from the bank only information on the result of the payment (approval status, transaction number, amount and currency).

4. Purposes of processing

• To answer your enquiries and prepare quotations and document lists for you;
• To take orders, verify payments and issue invoices or receipts;
• To perform the contract: company formation, tax number and other applications, bookkeeping, tax returns and notifications, payroll processing;
• To fulfil obligations under tax, commercial, social security, anti-money-laundering and professional legislation, and to respond to requests from competent authorities;
• To handle cancellation, refund and complaint requests and to protect rights in disputes;
• To keep the Website secure and working, to remember your language preference and to prevent misuse.

Your personal data are not processed for advertising, profiling or marketing purposes and are not sold.

5. Legal grounds

5.1. Your personal data are processed on the following legal grounds in Article 5(2) of the KVKK:

• (a) Expressly provided for by law: in particular Tax Procedure Law No. 213, Turkish Commercial Code No. 6102, Law No. 5549 on the Prevention of Laundering Proceeds of Crime, Law No. 5510 on Social Insurance and General Health Insurance, Law No. 3568 on Certified Public Accountancy and Sworn Financial Advisory, Law No. 6502 on Consumer Protection and Law No. 6563 on the Regulation of Electronic Commerce: issuing invoices or receipts, verifying identity, keeping books and documents, and keeping records of orders and approvals;
• (c) Necessary and directly related to the formation or performance of a contract: answering your enquiries, taking the order, verifying the payment, carrying out the service and corresponding with you for these purposes;
• (ç) Necessary for the data controller to comply with its legal obligations: filing tax returns and notifications, responding to requests from competent authorities and complying with statutory retention periods;
• (e) Necessary for the establishment, exercise or protection of a right: handling cancellation, refund and complaint requests, and disputes;
• (f) Necessary for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject: server logs kept for Website security, and choosing the Website language based on country information.

5.2. Health data are processed only for the payroll service, on the legal grounds in Article 6(3) of the KVKK that the processing is expressly provided for by law and is necessary to fulfil legal obligations in the fields of employment and social security, and with the adequate measures determined by the Personal Data Protection Board under Article 6(4).

5.3. Your explicit consent is not requested for the processing described in this notice. If any processing requires explicit consent, you will be informed separately and asked for your consent before the processing takes place.

6. Method of collection

Personal data are collected:

• Directly from you: through WeChat, WhatsApp, e-mail and telephone conversations, the order and payment form, and the documents you send;
• From the company that is our client (for example, information on shareholders, managers and employees);
• While the service is being performed, from the systems of public authorities and from public registers (for example, the Turkish Trade Registry Gazette);
• From the bank that reports the payment result;
• By automated means: server logs and the language preference cookie.

7. Transfers within Türkiye

Personal data may be transferred, for the purposes in clause 4 and to the extent necessary, to the following groups of recipients:

• Competent public authorities: the Revenue Administration and tax offices, the Ministry of Trade and trade registry offices, the Social Security Institution, the Financial Crimes Investigation Board (MASAK) where the law requires it, judicial authorities and enforcement offices;
• Persons and organisations involved in performing the service: notaries, sworn translators, banks to which account-opening applications are made, TÜBİTAK Kamu SM (financial seal), electronic document (e-Invoice, e-Ledger) service providers, the virtual office operator, courier companies and, where necessary and with your knowledge, lawyers or sworn financial advisers;
• Payment: Türkiye İş Bankası A.Ş.; transaction details such as the order number and amount are sent to the bank, while you enter your card details directly on the bank’s page;
• Technical service providers: acting as data processors, the provider of the accounting software and providers of server and backup services located in Türkiye. Service providers located abroad are listed separately in clause 8.

8. Transfers abroad

8.1. Hosting: The Website and the records of orders placed through the Website are hosted on a server in Hong Kong. This transfer is based on the legal grounds in Article 5(2)(c) and (ç) of the KVKK and on the standard contract announced by the Personal Data Protection Board, signed with the server service provider under Article 9(4)(c) of the KVKK. The standard contract is notified to the Personal Data Protection Authority within five business days of its signature.

8.2. Communication channels: When you correspond with us through WeChat, WhatsApp or an e-mail service located abroad, your messages may pass through the servers of the relevant service provider abroad. You choose the channel. Transfers through these channels are made on an incidental basis under Article 9(6) of the KVKK and rely on the ground that they are necessary for the performance of the contract between you and us or for taking pre-contractual measures at your request (point (b)). If you do not wish to use these channels, you can contact us by telephone or send your documents by post.

8.3. Order notifications: Orders placed through the Website and payment results are notified to ETITAX via Telegram. These notifications contain no information that directly identifies you, such as your name, e-mail address or telephone number; they contain only the order number, the service and the amount.

8.4. Card payments: In card payments, the transactions that the bank carries out with card schemes (Visa, Mastercard, UnionPay and similar) are the bank’s responsibility and are subject to the bank’s own privacy notice.

9. Retention periods

Data	Period
Client files, accounting, tax and company records	For the periods required by the Tax Procedure Law, the Turkish Commercial Code and Law No. 5549; generally 10 years from the start of the year following the year in which the contract ends
Order, payment and approval records	10 years
Correspondence with persons who are not clients	2 years from the last correspondence
Server logs	Up to 90 days
Language preference cookie	1 year in your browser, or until you delete it

When the period expires, personal data are deleted, destroyed or anonymised under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

10. Cookies

10.1. The Website uses no advertising, measurement (analytics) or third-party cookies, and no tool tracks your visit.

10.2. The Website uses only one first-party cookie, named “lang”. It is set when you choose the Website language yourself from the menu, remembers the language you chose (English, Simplified Chinese or Traditional Chinese) and is kept for 1 year. It contains no information that identifies you and is not used for any other purpose. As this cookie is used to provide a function you have expressly requested, your consent is not requested separately.

10.3. If you have not chosen a language, the language in which the Website opens is selected automatically on the server based on the country determined from your IP address. No cookie is used for this, and the country information is not stored anywhere other than in the server logs.

10.4. In the payment steps, ETITAX uses no cookies for advertising or measurement; only the technical data strictly necessary to complete the transaction securely are used. The bank’s own cookie and privacy rules apply on the bank’s payment page.

10.5. You can delete or block cookies in your browser settings. If you block the language cookie, you can continue to use the Website; only your language choice will not be remembered.

11. Data security

ETITAX takes appropriate technical and administrative measures to keep personal data secure. The Website and the payment steps are served over an encrypted connection (HTTPS); card details do not reach ETITAX’s systems; access to personal data is limited to the persons whose work requires it; and backups are stored in encrypted form.

12. Your rights

Under Article 11 of the KVKK, you have the right to apply to ETITAX to:

1. Learn whether your personal data are processed,
2. Request information if they have been processed,
3. Learn the purpose of the processing and whether the data are used in line with that purpose,
4. Know the third parties in Türkiye or abroad to whom the data are transferred,
5. Request correction if the data are incomplete or inaccurate,
6. Request deletion or destruction of the data under the conditions in Article 7 of the KVKK,
7. Request that correction, deletion and destruction be notified to the third parties to whom the data have been transferred,
8. Object to a result against you arising from the analysis of the processed data exclusively by automated systems,
9. Claim compensation if you suffer damage because your personal data have been processed unlawfully.

13. Applications

13.1. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application in writing, as a letter bearing your handwritten signature, to the address in clause 1; or with a secure electronic signature or mobile signature; or from an e-mail address you have previously given to ETITAX and that is in our records, to info@etitax.com.

13.2. The application must include your name; your signature, for written applications; your Turkish identity number if you are a Turkish citizen or, if you are a foreign national, your nationality and your passport number or foreigner identity number; your address for notifications; your e-mail address and telephone number, if any; and the subject of your request.

13.3. Applications are concluded free of charge within 30 days at the latest. If the action involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

13.4. If your application is rejected, if you find the answer insufficient or if no answer is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the answer and, in any case, within 60 days of the application date.

14. Changes

This notice may be updated. The current text is published on the Website with the date of the last update. The English and Chinese translations of this notice are for information; in case of conflict, the Turkish text prevails.