Privacy notice (KVKK)

1. Data controller and scope of this notice

1.1. This notice has been prepared by SERHAN YILDIRIM "SEALINGO" ("Sealingo") as data controller, in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

• Address: Yakuplu Mah. 65. Sk. No: 35 İç Kapı No: 7, 34500 Beylikdüzü / İstanbul
• Tax office and number: Beylikdüzü · 9590626265
• MERSİS: 2647397864600013
• Trade registry: İstanbul Ticaret Sicil Müdürlüğü · 946570
• Email: hello@sealingo.co
• Telephone: 0212 642 99 64

1.2. This notice covers the following persons:

• visitors to sealingo.co;
• persons who fill in the contact form and persons who send email to Sealingo;
• notary office representatives who fill in the pilot service survey;
• business account admins of translation agencies that apply to become partner agencies;
• business customer representatives who apply for a business account and manage the business account;
• self-employed professionals who create an individual account (individual customers);
• students and other persons who create an individual account for personal use (consumer customers), and persons whose personal data is contained in the documents these customers upload (Clause 8);
• users invited to a business customer's team;
• persons designated, in sworn or notarized delivery, as the delivery recipient or as the person from whom the original document is to be collected;
• representatives, users and sworn translators of partner agencies.

1.3. For persons whose personal data is contained in the documents commercial customers (business customers and persons who create an individual account for professional use) upload for translation (the customer's own clients and other persons named in the documents), the data controller is the business or individual customer that uploads the document. This clause does not apply to consumer customers; Sealingo is the data controller for their documents and content (Clause 8). The same applies to the terms the customer enters in the account glossary; no personal data is entered in the account glossary. Information in the folders the customer creates (folder name, note, folder glossary) may contain names of persons and companies; the customer is the data controller for this as well. Sealingo processes this data on the customer's instructions as data processor (Data Processing Agreement). Informing these persons is the obligation of the relevant customer. Requests received by Sealingo in this context are forwarded to the relevant customer. If the customer chooses sworn or notarized delivery, these documents are transferred to the partner agency handling the job and, in notarized delivery, submitted to a notary; the customer is the data controller for these as well.

2. Personal data processed

2.2. The individual customer's Turkish identification number, full name and address are requested in order to issue invoices (e-invoice or e-archive invoice) in their name and to fulfill obligations under tax legislation. The Turkish identification number is not used other than for these purposes and the payment transactions in Clause 5.2. An individual customer that is a sole proprietorship is asked for its tax identification number and tax office instead of the Turkish identification number. If a sole proprietorship that creates a business account provides the owner's Turkish identification number instead of a tax identification number, this number is also processed for the same purposes and subject to the same limit. A consumer customer is asked for their full name, Turkish identification number and address for the invoice; no tax office or tax identification number is requested.

2.3. Sealingo does not request special categories of personal data, such as health or criminal convictions, from the persons covered by this notice (for data contained in documents uploaded by consumer customers, see Clause 8.4). Please do not share document content in your support and contact messages. In sworn & notarized delivery, Sealingo does not request an identification number from the recipient or from the person from whom the original document is to be collected.

3. Purposes of processing and legal grounds

3.1. Personal data is processed for the purposes below on the basis of the legal grounds in Article 5(2) of KVKK. Explicit consent is not requested for this processing.

3.2. Sealingo does not use this data for marketing, advertising or profiling and does not sell it to third parties. The referral source is used only for aggregate counts by channel; no individual assessment is made. If it needs to send commercial electronic messages, it requests separate consent. Delivery and pickup information for sworn & notarized delivery is also not used for offers, marketing or profiling; the partner agency is prohibited by contract from using this information for any other purpose.

4. Method of collection

Personal data is collected electronically: through registration, invitation, contact, support and partner agency application forms; records generated automatically during use of the platform; where you came to the site from (the referring site's domain name and campaign tags in the link; cookie policy, section 2); and email correspondence. In sworn & notarized delivery, delivery and pickup information is collected from the order form, and delivery records are collected through the partner agency.

5. Transfer

5.1. Within Türkiye, personal data may be transferred to the following recipients: public authorities and institutions legally authorized for legal obligations and the protection of rights (tax administration, courts, enforcement offices, the Personal Data Protection Authority); legal and financial advisors bound by a duty of confidentiality; the bank through which payments are received; for card payments, the licensed payment institution iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico); and, under the e-invoice and e-archive invoice obligation, for the information on the invoice (for individual customers, full name, Turkish identification number or tax identification number and address; for a business customer that is a sole proprietorship, the Turkish identification number), the Revenue Administration and, if used, a private integrator authorized by the Revenue Administration.

5.2. When a card payment is made, the following data is transferred to iyzico so that it can receive the payment, prevent fraud and fulfill its legal obligations: the full name, email address, telephone number, tax or Turkish identification number, address and IP address of the person making the payment; the trade name or full name and billing address of the customer; and the order number and amount. Card details are entered directly on iyzico's payment page and do not reach Sealingo. iyzico processes this data in accordance with its own privacy policy (iyzico.com/gizlilik-politikasi).

5.3. Sealingo operates the platform on the systems of infrastructure service providers established abroad. Personal data is therefore transferred to the following providers:

5.4. These transfers are carried out in accordance with Article 9 of KVKK: the standard contracts published by the Personal Data Protection Board are signed with the providers and notified to the Authority within 5 business days of signature.

5.5. This notice is updated when the list of providers changes.

5.6. In sworn and notarized delivery:

• Delivery and pickup information, the customer's delivery note, the job number and document types are transferred to the partner agency handling the job. The partner agency does not see the customer's account and billing information.
• The name, telephone number and address of the recipient and of the person from whom the original document is to be collected are transferred to the courier making the delivery (an employee of the partner agency or a courier company engaged by Sealingo or the agency).
• These transfers take place within Türkiye and are based on the purposes and legal grounds in Clause 3 (KVKK Article 8).
• The documents and the translation are submitted to a notary. The customer is the data controller for these (Clause 1.3).

6. Retention periods

Personal data is kept for the period necessary for the purpose for which it is processed and for the statutory retention periods; when the period expires, it is deleted, destroyed or anonymized.

7. Your rights and how to apply

7.1. Under Article 11 of KVKK, you have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of processing and whether it is used in accordance with that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• request correction if it is incomplete or inaccurate;
• request its deletion or destruction under the conditions in Article 7 of KVKK;
• request that correction, deletion and destruction be notified to the third parties to whom the data has been transferred;
• object to an outcome to your detriment resulting from analysis exclusively by automated systems;
• request compensation if you suffer damage due to unlawful processing.

7.2. You may send your application, together with information identifying you, by one of the following means: in writing to Yakuplu Mah. 65. Sk. No: 35 İç Kapı No: 7, 34500 Beylikdüzü / İstanbul; by email to hello@sealingo.co from the email address you previously provided to Sealingo and that is registered in our system.

7.3. Applications are concluded free of charge within 30 days at the latest. If the process requires an additional cost, the fee schedule set by the Personal Data Protection Board may apply.

7.4. If your application is rejected, the response is found insufficient or no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days from the date you learn of the response and in any case within 60 days from the date of application (KVKK Article 14).

8. Documents and content in consumer customer accounts

8.1. Scope. This clause applies to consumer customers who create an individual account for personal use (Terms of Service, clause 18) and to persons whose personal data is contained in the documents they upload. The Data Processing Agreement does not apply to consumer customer accounts; Sealingo is the data controller for the following data:

• uploaded documents and everything produced from them: translations, page images, working files, flagged items, the Quality Control Report and the delivery note;
• job information: job title, purpose of use, special requests;
• Seal conversations: the messages you write on the Work with Seal screen, Seal's answers and the records Seal reads for these answers;
• the terms you enter in the account glossary and the information in the folders you create (folder name, note, folder glossary).

8.2. Data categories. Sealingo does not select document content; whatever is in the document you upload is processed. This may include identity, contact, family and civil registry, education (diploma, transcript, thesis, article), professional, financial, legal transaction and visual record (photo, signature, seal) data. Do not upload documents that are not needed for the translation or unnecessary personal data of others.

8.3. Purposes and legal grounds:

8.4. Special categories of personal data. Sealingo does not request special categories of personal data. If a document you upload contains special categories of data, such as health, criminal convictions, religion or biometric data, this data is processed only to produce the translation you request, on the basis of Article 6(3)(d) of KVKK (processing is necessary for the establishment, exercise or protection of a right) and with the adequate measures determined by the Personal Data Protection Board.

8.5. Transfer. Documents and content are processed on the systems of the following sub-processors; Sealingo enters into data processing agreements with these providers:

Transfers abroad are made, as in Clause 5.4, in accordance with Article 9 of KVKK, using the standard contracts published by the Board. Only the content required for the job is sent to the AI service provider; this content is not used for model training, and processing logs are deleted as soon as the job step ends. Sealingo does not use documents to train AI models. In notarized delivery, the notary processes the documents as an independent data controller within its statutory duties. Transfers to competent public authorities are as in Clause 5.1.

8.6. Retention and deletion. Documents and content are permanently deleted from the platform within the following periods:

You can delete a job's documents from the job page, and the documents of all jobs from settings, at any time. A deletion record for each deletion can be downloaded from the job page. Sealingo does not provide an archiving service; download the delivery files before they are deleted.

8.7. Rights. The rights in Clause 7 also apply to the data in this clause, and applications are made in the same ways. Other persons whose personal data is contained in the documents you upload may also apply to Sealingo under Clause 7.