The Turkish-language KVKK Privacy Notice is the authoritative version (the obligation arises from Turkish law). This English summary is provided for convenience only. The full Turkish text is available at /kvkk.
1. Data Controller
Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by EKSENOVA TEKNOLOJİ ANONİM ŞİRKETİ ("Company") as the data controller, in accordance with the principles of lawfulness and fairness.
- Address: ERCİYES TEKNOPARK-2 NO: 5 MELİKGAZİ / KAYSERİ, Türkiye
- MERSIS No: 0329250110100001
- D-U-N-S No: 448901052
This notice covers personal data collected during identity verification processes performed through the EksenGOLD application.
2. Personal Data Processed
During identity verification we process:
Identity Information: Turkish ID number, name and surname, date of birth, ID document details (serial number, validity date, document type), ID document photo/image.
Biometric Data: The photograph on your ID document.
Transaction Information: Date and time of verification, operator user, transaction reference, verification result.
3. Purposes of Processing
- Fulfilling customer identity verification obligations under Law No. 5549 on the Prevention of Laundering Proceeds of Crime
- Carrying out identity verification under MASAK (Financial Crimes Investigation Board) regulations
- Mandatory identity-verification processes for the jewelry sector
- Record-keeping and reporting obligations under applicable law
- Disclosure to authorized public bodies when required
4. Legal Basis
Processing is based on KVKK Article 5, in particular:
- Explicit statutory authorization (Art. 5/2-a) - Law No. 5549 and related secondary legislation
- Compliance with legal obligations of the data controller (Art. 5/2-ç)
- Establishment, exercise or protection of a right (Art. 5/2-e)
5. Data Sharing
Your data may be shared with: MASAK (statutory reporting), courts and prosecutors (legal requests), law enforcement (criminal investigations), and other competent public authorities where legislation requires. Otherwise your data is not shared with third parties without explicit consent and is not transferred abroad.
6. Security and Storage
We apply highest-level technical and administrative measures:
- AES-256 application-layer encryption for sensitive personal data
- TLS for data transit
- Signed audit log for tamper-evident integrity of critical records (identity verification, invoicing, MASAK operations)
- All data stored on servers located within the Republic of Türkiye
- Regular security monitoring and security audits
- Role-based access control, audit logs, MFA
7. Retention
- Identity verification records: at least 8 (eight) years from the last transaction date (Law No. 5549)
- Transaction records: at least 8 (eight) years
- ID document images: for the period mandated by law, in encrypted form
Data exceeding retention is securely deleted, destroyed or anonymized in accordance with KVKK Article 7.
8. Consent Mechanism During Identity Verification
During verification you receive a confirmation code. Sharing/confirming this code constitutes acknowledgement that you have read this notice and that your personal data will be processed for the purposes and on the legal bases stated above. Sharing the code is necessary to complete mandatory identity verification under Law No. 5549; the processing does not require explicit consent under KVKK Art. 5/2.
9. Your Rights (KVKK Article 11)
You have the rights to learn whether and how your data is processed, to be informed about transfers, to request correction or deletion, to object to fully automated decisions affecting you, and to claim compensation for damages from unlawful processing. To exercise these rights, write to [email protected].
10. How to Apply
- Email: [email protected]
- Subject: KVKK Information Request
Include your full name and signature (for written applications), Turkish ID number, address for service, notification email, and a clear description of your request. Applications are answered within 30 (thirty) days.
11. Updates
This notice may be revised in response to legislative changes or operational updates. The current version is always published on this page; material changes will be communicated to users.