Privacy Notice

In short

1. Data controller

The data controller under Law No. 6698 on the Protection of Personal Data ("KVKK") is the following company:

Trade name

OnlyJS Teknoloji Anonim Şirketi

Trade registry

Istanbul Trade Registry Directorate, registry no. 497962-5

Tax ID no.

6430821222

Address

Barbaros Mah. Begonya Sk. Nidakule Ataşehir Batı No:1 İç Kapı No:2, 34746 Ataşehir/İstanbul

Email

[email protected]

In this notice, "we", "Solon" and the "Company" refer to OnlyJS Teknoloji A.Ş.

2. Scope of this notice

This notice was prepared under Article 10 of KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It covers:

• The Solon website and all of its subpages.
• The data we process when you reach us through the meeting form on the site, email, phone, a LinkedIn message or a video call.
• The data of the officers and employees of our customers, suppliers and business partners who do business with us.
• The data of people who give us consent to send commercial electronic messages.

Cookies are explained in a separate text, the Cookie Policy.

Data processed inside the Solon product is outside the scope of this notice. When our customers deploy Solon in their own companies, the customer is the data controller for the data of the employees Solon talks to and for the data in the systems Solon connects to. We are a data processor acting on the customer's behalf and on its instructions. This data is governed by the contract between us and our customer. To exercise your rights over this data, apply first to the company you work for. If your request reaches us, we forward it to them.

If we carry out any processing based on explicit consent, we ask for your consent separately from this notice. This follows the Personal Data Protection Board (the Board) principle decision No. 2026/347 dated 18.02.2026. Reading this notice does not mean that you consent to anything.

3. Whose data we process

We process your data for different purposes depending on your relationship with us. Read the one of the four sections below that fits you:

We do not process or ask for special categories of personal data (such as health, religion, ethnic origin or biometric data). Please do not share this kind of information when you write to us. If we receive it by mistake, we delete it.

4. Site visitors

When you open the site, your browser sends a request to our server. The server writes this request to a technical record (server log).

Method of collection: By automated means, by our server, when you open the site.

We do not try to identify you from these records, we do not build a profile about you, and we do not use them for marketing. The site has no analytics, advertising or social media tools. Fonts and videos also come from our own server. No request goes to a third party while you browse the site.

5. People who write to us or ask for a meeting

Method of collection: Through the meeting form on the site, email, phone, LinkedIn messages, video calls and business cards you give us at events. Partly by automated means (the meeting form, our email system) and partly by non-automated means. The meeting form accepts only business email addresses. The question about your company's AI work is optional.

We do not record video calls. If a recording is needed, we ask at the start of the call, and if you do not agree, we do not record.

Replying to you does not mean you have given us permission to send you newsletters. Promotional messages require separate permission (section 7).

6. Representatives of customers and business partners

This section is for the officers and employees of companies that use Solon, and of our suppliers and business partners, who do business with us.

Method of collection: From contract, order and invoice documents, from emails and meetings, and from information your company sends us. Partly by automated means and partly by non-automated means. We receive some of this data not from you but from the company you work for.

7. People who consent to commercial messages

We send product news, newsletters and event invitations only to people who have given the Commercial electronic message consent (in Turkish). Consent is optional. Not giving it, or withdrawing it, does not affect our communication with you or our contract.

Method of collection: Through the form, email or event registration where you gave consent; by automated or partly automated means.

Under the exemption the legislation grants for tradespeople and merchants, we may also send messages to your company's corporate address without prior consent. This also stops as soon as you opt out.

You can withdraw your consent free of charge through the link at the bottom of every message, by writing to [email protected], or through iys.org.tr. We stop sending within 3 business days at the latest.

8. Who we transfer data to

We do not sell your data and we do not share it with anyone for advertising. Under Article 8 of KVKK, we transfer only what is necessary, only to the recipients below, and only on the legal bases set out above:

9. Transfers abroad

Some of our suppliers may have servers outside Türkiye. In that case, we make the transfer under Article 9 of KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad:

• There is no adequacy decision for any country. For this reason, we sign the standard contract announced by the Board with the recipient without changing it, and we notify the Personal Data Protection Authority (the Authority) within 5 business days after signing.
• We do not rely on explicit consent for regular and repeated transfers. Explicit consent is only an option for incidental transfers.
• We do not transfer your data abroad without one of these safeguards.

10. Retention and destruction

We keep data only for as long as the purpose requires or the law provides:

When the period ends, we delete, destroy or anonymize the data under the Regulation on the Erasure, Destruction or Anonymization of Personal Data, in periodic runs no more than 6 months apart.

11. Security

Under Article 12 of KVKK, we take technical and administrative measures to protect your data. We limit access to employees whose work requires it. We sign contracts with our suppliers that include data security and confidentiality terms. We transfer data over encrypted connections.

If your data is unlawfully obtained by others, we notify the Board within 72 hours at the latest and inform you within the shortest reasonable time.

12. Your rights

Under Article 11 of KVKK, you can apply to us to:

1. Learn whether your personal data is processed.
2. Request information about it if it has been processed.
3. Learn the purpose of the processing and whether the data is used in line with that purpose.
4. Know the third parties in Türkiye or abroad to whom it has been transferred.
5. Request correction if it has been processed incompletely or inaccurately.
6. Request its erasure or destruction under the conditions in Article 7 of KVKK.
7. Request that the correction, erasure and destruction be notified to the third parties to whom the data has been transferred.
8. Object to a result against you that arises from analysis carried out solely by automated systems.
9. Request compensation for damage you suffered because of unlawful processing.

13. How to apply

You can make your application under the Communiqué on the Procedures and Principles of Application to the Data Controller in one of the following ways:

• In writing: With a petition bearing your wet-ink signature, delivered by hand to our address in section 1, or sent by post or through a notary.
• With a secure electronic signature or mobile signature: by sending your signed application to [email protected].
• By email: to [email protected] from the email address you have previously given us and that is registered in our system.

Your application must include: your first and last name, your signature if you apply in writing, your Turkish national identity number (if you are a foreign national, your nationality and passport or identity number), your residential or business address for notifications, your email address, phone and fax number if any, and your request.

We conclude your application within 30 days at the latest. As a rule, it is free of charge. If the written reply exceeds 10 pages, we may charge TRY 1 for each page. If the reply is given on a medium such as a CD or a memory stick, we may charge the cost of the medium.

If your application is rejected, if you find our reply insufficient, or if we do not reply in time, you can file a complaint with the Board within 30 days from the date you learn of our reply, and in any case within 60 days from the date of your application.

14. Visitors from the European Union

If you contact us from the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) may also apply. In that case, in addition to the rights above, you have the right to request restriction of processing, to receive your data in a portable format, to object to processing based on legitimate interest, and to lodge a complaint with the data protection authority of your country. The ways to apply are the same.

15. Changes

We update this notice when we add a new processing purpose, recipient or supplier, or when the law changes. The current version is always on this page.