KVKK privacy notice

Last updated: 5 November 2026

Data controller

This notice is issued under article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) and the related Communiqué. Data controller: [legal entity name] (trading as PipeMonday), MERSİS number [MERSİS number], address [registered address], email [notice email address], KEP address [KEP address], phone [phone number]. VERBİS registration status: [VERBİS kayıt durumu tamamlanacak].

Two separate roles

• PipeMonday is the controller for account, invoice, order and consent records, contact form messages and technical logs, which this notice covers.
• For the CRM and prospect data customers enter into their workspaces, the customer is the controller and PipeMonday the processor, acting only on the customer's instructions; requests about that data are forwarded to the customer.

Categories of personal data

• Identity and contact: name, email address, phone number (if given), organization and job title.
• Billing and transactions: billing details (name or company name, address, tax office and tax number), plan, orders, invoices, payment status, last four card digits and iyzico transaction number; we never hold the full card number.
• Consent and legal records: timestamp, IP address, browser and text version of each checkout consent; withdrawal, cancellation and complaint correspondence.
• Technical logs: IP address, browser type, access time, pages and features used, error reports, and the session, theme and language cookies.
• Contact form: name, email address, company and message.

We do not process special categories of data (KVKK article 6); do not enter them into the service.

Purposes of processing

To run your account and send login codes, notifications and replies; to take orders, activate plans, invoice and collect payment; to keep contract and consent records as evidence; to secure the service, prevent abuse and fix errors; to answer support requests; to comply with tax, commercial and other legislation and lawful requests from authorities.

Legal bases

Your data is processed on these bases in KVKK article 5(2):

• Direct relation to the conclusion or performance of a contract (account, order, payment, support).
• Compliance with our legal obligations (invoicing, accounting, tax and e-commerce legislation, record keeping).
• Express provision in law (retention of commercial and financial records).
• Establishing, exercising or protecting a right (consent records, disputes, chargeback objections).
• Our legitimate interests, where your fundamental rights and freedoms are not harmed (security, troubleshooting).

Where none applies, your explicit consent is obtained separately and can be withdrawn at any time.

Collection method

Data is collected electronically, by fully or partly automated means, through the forms, sign-up and checkout screens, cookies and server logs of pipemonday.com and app.pipemonday.com, your emails and iyzico's payment result reports.

Recipients and transfers abroad

Your data is transferred, only as far as the purpose requires, to:

• iyzico Ödeme Hizmetleri A.Ş. (Turkey): payment, card storage and refunds.
• Hetzner (Germany): hosting and database; your data is stored in Germany.
• Resend (USA): email delivery of login codes, notifications and contact form messages.
• OpenAI (USA, API): AI text generation and scoring; the content sent to the model may include company descriptions and the customer's draft texts.
• Accountants and legal advisers: invoicing, accounting and disputes.
• Public authorities: requests under legislation.

Transfers to Germany and the USA rely on KVKK article 9: the Personal Data Protection Board's standard contract, signed and notified to the Board, another appropriate safeguard in article 9, or an adequacy decision where one exists; exceptionally, without any safeguard, on your explicit consent. UN Comtrade is a public source we only read.

Retention periods

• Account and contact data: while your account exists, then deleted or anonymized.
• Order, consent and contract records: at least three years (Regulation on Distance Contracts, article 20).
• Invoice and accounting records: as long as tax and commercial legislation require.
• Contact form messages: as long as needed to handle the request.
• Technical logs: as long as needed for security and troubleshooting.
• Backups: 30 days.

Your rights (KVKK article 11)

By applying to us you may:

• a) learn whether your personal data is processed;
• b) request information if it has been processed;
• c) learn the purpose of processing and whether the data is used in line with it;
• ç) know the third parties to whom the data is transferred, in Turkey or abroad;
• d) request correction of incomplete or inaccurate data;
• e) request deletion or destruction under the conditions in KVKK article 7;
• f) request that the operations under (d) and (e) be notified to the third parties that received the data;
• g) object to a result arising against you from the analysis of processed data exclusively by automated systems;
• ğ) claim compensation for damage suffered because of unlawful processing.

How to apply

Apply, in line with the Communiqué on application to the data controller, through the contact form on pipemonday.com, by email to [notice email address], by KEP to [KEP address] or in writing to [registered address]. State your name, email address and request; we may ask for more information to verify your identity. Applications are answered free within 30 days at the latest; where an operation has a separate cost, the Board's tariff fee may be charged. If your application is rejected, answered insufficiently or late, you may complain to the Personal Data Protection Board.