Ahi EvrakPersonal data protection
Data Protection Notice
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) to inform you about the personal data processed through the Ahi Evrak website and platform.
Last updated: 23 September 2026
1. Data controller
- Data controller
- Şafak Birol (sole proprietorship), operating under the Ahi Evrak brand
- Address
- Cevizli Mah. Zühal Cad. A Ticari Blok Apt. No: 46/50, 34844 Maltepe / İstanbul
- destek@ahievrak.com
- Registered e-mail (KEP)
- safak.birol@hs01.kep.tr
2. Personal data processed, purposes and legal grounds
Your personal data is processed only through the channels below, for the stated purposes and only to the extent necessary for those purposes.
Demo request form
- Data
- Full name, business email address, company name, phone number and your request note.
- Purpose
- Evaluating the demo request, contacting you and, where the request is accepted, creating a demo account.
- Legal ground
- Processing directly related to the conclusion of a contract (KVKK Art. 5/2-c) and the legitimate interest of the data controller (KVKK Art. 5/2-f).
Compliance score survey
- Data
- Email address, survey answers and the resulting score, language preference, consent records (time of consent and notice version).
- Purpose
- Preparing the compliance report you request and sending it to your email address. If you opt in, also informing you about regulatory developments and Ahi Evrak services.
- Legal ground
- Fulfilling your request for the report (KVKK Art. 5/2-c). For informational emails, your explicit consent (KVKK Art. 5/1) and your approval under Law No. 6563. This consent is optional and can be withdrawn at any time.
Platform users and supplier portal
- Data
- Full name, email address, password (stored only in irreversibly hashed form), company and role, KVKK consent record, session and security logs (IP address, browser information, time of action).
- Purpose
- Creating the account, authentication and authorisation, password reset, providing the service and keeping the account secure.
- Legal ground
- Conclusion and performance of a contract (KVKK Art. 5/2-c) and the legitimate interest in information security (KVKK Art. 5/2-f).
Security checks and technical logs
- Data
- IP address, browser and device information, time of access and page accessed.
- Purpose
- Preventing automated abuse of forms, site security and service continuity.
- Legal ground
- Legitimate interest of the data controller (KVKK Art. 5/2-f).
Email correspondence
- Data
- Your email address and the content of your message.
- Purpose
- Responding to your requests, questions and applications.
- Legal ground
- Legitimate interest of the data controller (KVKK Art. 5/2-f).
Until you enter your email address, your survey answers are kept only in your browser and are not sent to the server.
Digital product passport pages opened via QR code do not ask visitors for any personal data. Only the technical logs described above are created on these pages.
For data that customer companies enter into the platform in the course of their own business (such as supplier contacts and product and production records), the relevant customer company is the data controller. Ahi Evrak processes such data as a data processor on the customer company's instructions.
3. Method of collection
Personal data is collected electronically and by automated means through the website forms, platform accounts, email correspondence and the security infrastructure.
4. Transfers of personal data
Personal data is not sold, rented or shared with third parties for advertising. The following service providers are used as data processors to deliver the service.
| Service provider | Service | Data location |
|---|---|---|
| Supabase | Database and authentication | European Union (Frankfurt, Germany) |
| Cloudflare | Hosting, content delivery, security checks and email routing | Global server network |
| Resend | Email delivery | European Union (Ireland) sending region |
| Receiving email sent to ahievrak.com addresses | Global server network |
As the servers of these providers are located outside Türkiye, your personal data is transferred abroad. Such transfers are carried out in accordance with the rules set out in Article 9 of the KVKK.
Personal data may also be disclosed to competent public authorities where required by law and upon request.
5. Cookies and browser storage
No advertising, analytics or tracking cookies are used on the site. Only the following entries, which are necessary for the site to function, are used.
| Name | Purpose | Duration |
|---|---|---|
| NEXT_LOCALE | Remembering the language preference | Browser session |
| sb-*-auth-token | Keeping signed-in users signed in | For the duration of the session |
| ae_lead_email | Carrying the email address entered in the survey over to the demo form | 1 day |
| ae-uyum-skoru-v1 | Keeping survey answers across page transitions (browser session storage) | Deleted when the tab is closed |
During security checks, Cloudflare processes the technical signals needed to distinguish automated software.
6. Retention
- Demo requests and compliance score records are kept for 2 years. Expired records are deleted automatically every month.
- Platform account data is kept for the duration of the service relationship and, after it ends, for the periods required by applicable law.
Personal data whose retention period has expired is deleted, destroyed or anonymised.
7. Your rights under the KVKK
Under Article 11 of the KVKK, you may apply to the data controller to:
- Learn whether your personal data is processed
- Request information if your personal data has been processed
- Learn the purpose of the processing and whether the data is used in line with that purpose
- Know the third parties in Türkiye or abroad to whom your personal data is transferred
- Request correction of incomplete or inaccurate data and notification of the correction to third parties to whom the data was transferred
- Request deletion or destruction of your personal data under the conditions in Article 7 of the KVKK and notification of this to third parties to whom the data was transferred
- Object to a result against you arising exclusively from analysis of the processed data by automated systems
- Claim compensation for damage suffered as a result of unlawful processing of your personal data
8. How to apply
You can send your application from the email address registered in our system to destek@ahievrak.com, by KEP to safak.birol@hs01.kep.tr, or in writing to the address above. Your application should include information verifying your identity and a clear description of your request.
Applications are concluded free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request. If the action involves an additional cost, the fee schedule set by the Personal Data Protection Board may apply.
If your application is rejected, the response is insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board.