Legal

KVKK Privacy Notice

How we process your personal data and what your rights are under Turkish Personal Data Protection Law No. 6698 (KVKK).

Data controller

Rapitek Bilişim Teknolojileri Anonim Şirketi
Maslak Mah. Büyükdere Cad. Nurol Plaza Sit. No: 255/B02, Sarıyer, İstanbul, Türkiye
MERSIS: 0734159061600001
Trade registry no: 157552-5
Tax no: 7341590616
WhatsApp: +90 212 963 22 84
E-mail: info@rapitek.com

What personal data do we process?

When you submit one of the contact, demo, free trial or template download forms on our site, we record the fields we ask for (e.g. name, e-mail, phone, company, team size, your message) together with the submission time, the address of the page you submitted the form from, the page address you came from, browser information and a digest of your IP address generated with a secret key; the form record on our site does not hold your raw IP address. To prevent form abuse (bots/spam), your form submission attempts, including successful ones, are kept in a separate record together with your raw IP address for 30 days and are then deleted automatically. The copy passed to our CRM system, however, may also contain your raw IP address. If you consented on the cookie banner, the sequence and titles of the pages you visited in the same session and the campaign tags in the page address (utm) are also recorded; if you submit a form, a short summary of these, together with only the name of the external site that referred you, is added to your enquiry and passed to our CRM system; without that consent no such record is created at all. If you gave consent, the full text shown to you at that moment and the time of consent are also stored as proof of consent.

When you submit the form on the fit-check page, in addition to the fields above we also record the answers you gave in the check (team size, monthly budget per user, your region of operation, the features you treat as non-negotiable, and your go-live speed) together with the fit score calculated from them. Taking the check on its own sends nothing — your answers do not leave your browser; this record is created only if you choose to submit the form, and what will be sent is shown to you before you send it.

If you tick the optional commercial message box on a template download form, the permission you give us to send you commercial messages by e-mail is recorded together with the consent text shown to you, the date and time of your consent, and the commercial message channel your consent covers (e-mail). The box is not pre-ticked; you get the file without ticking it too. You may withdraw your permission at any time. If your free trial account is opened, your name and e-mail address for the account's administrator user, your company's name and the trial end date are recorded in your account.

For all forms, a copy of your form record is passed from our site to our company's own CRM system (Rapitek CRM) so that we can respond to your enquiry; that system is hosted in the European Union locations listed below.

Why do we process it?

To respond to your enquiry and carry out pre-contractual discussions; to schedule and hold your introductory meeting; to keep track of our e-mail correspondence with you; to deliver the file you requested; to open your trial account; if you gave permission, to send you commercial messages by e-mail; to keep the service secure by preventing form abuse (bots/spam); and to meet our legal obligations.

What is our legal ground?

Your personal data is collected through the forms on our site, the appointment page and e-mail correspondence, by automated means and in an electronic environment. The legal ground for each processing activity is as follows:

Responding to your request, delivering the file you requested and opening your trial account — our legitimate interest in reviewing your request and getting back to you (Law No. 6698, Art. 5/2-f). If a contract is formed, processing continues on the ground of the establishment and performance of that contract (Art. 5/2-c).
Scheduling and holding your introductory meeting, and keeping track of our e-mail correspondence in our CRM system — being directly related to the establishment of a contract (Art. 5/2-c) and our legitimate interest in getting back to your request (Art. 5/2-f).
Preventing form abuse (bots/spam) — our legitimate interest in keeping the service secure (Art. 5/2-f).
Meeting our legal obligations — Art. 5/2-ç.
If you gave permission, sending you commercial messages by e-mail — your consent to commercial messages (Law No. 6563, Art. 6) and your explicit consent (Law No. 6698, Art. 5/1). You may withdraw your consent at any time via the opt-out link in our messages or by writing to us.
If you consented on the cookie banner, the sequence of pages you visited in the same session — your explicit consent (Art. 5/1). Without that consent no such record is created at all, and you may withdraw your consent at any time.
Keeping the consent text and the time of consent as proof of the consent you gave — the establishment, exercise or protection of a right (Art. 5/2-e).

Measurement in our e-mails

If we e-mail you in response to your enquiry, we measure whether those messages are opened and whether the links inside them are clicked. To do this, a small invisible image is placed in the message and links are routed through our measurement address. In the process we record the time of opening, your IP address and information about the e-mail program you use.

The purpose is to see whether the message reached you and to avoid sending you unnecessary follow-ups. This processing rests on our legitimate interest under article 5(2)(f) of Law No. 6698.

For any request about this measurement you can write to us using the contact details above; if you prefer, we will stop sending you e-mail altogether.

Recording of WhatsApp calls

When you make a voice call to our WhatsApp line, our representative tells you at the start of the call that it will be recorded. Recording starts only after this notice has been given. If you do not want the call to be recorded, simply say so at the start of the call; the call is then not recorded.

Data processed: the audio recording of the call, the transcript of the audio recording, your phone number, the time and duration of the call, and the CRM record the call is linked to (e.g. your name and your company).

Purpose: to follow up your request accurately and completely, to keep a record of what was discussed in the call, and to improve the quality of our service.

Legal ground: our legitimate interest in following up your request and improving the quality of our service (Article 5(2)(f) of Law No. 6698); where a contract has been formed, the establishment and performance of that contract (Article 5(2)(c)). You may object to this processing.

How it is processed: During the call, the audio is carried over WhatsApp's infrastructure (Meta); Meta does not record the call. The recording is made on our side, and the audio file is stored in DigitalOcean's storage in Frankfurt (Germany), in a closed area that belongs only to us. The audio recording is transcribed on our own server in Helsinki (Finland); no external speech recognition service is used for this. The transcript and the names in the record the call is linked to are transferred to Anthropic PBC (United States) to produce a call summary and action items and for call analysis. These transfers are transfers abroad within the meaning of Article 9 of Law No. 6698.

Access: only the representative who answered the call and our authorised managers can access the recording.

Retention: Call recordings and their transcripts are kept for 365 days and are deleted automatically at the end of that period. You may ask us to delete them earlier at any time.

Introductory meeting, calendar and e-mail

When you request an introductory meeting through the link on our site or in our e-mails, the first name, last name, e-mail, phone, company and note you enter on the appointment page are recorded. Together with these, the time you choose, your time zone, the language of the page, the time at which you confirmed the privacy notice and the channel you chose for verification (e-mail or WhatsApp) are also recorded.

We send you a code so that you can verify your request. The code is valid for 10 minutes; only a digest of the code is stored, not the code itself. Codes sent by e-mail and appointment notifications are sent from the infrastructure of Amazon Web Services (AWS SES) in Frankfurt (Germany). If you choose to verify with WhatsApp, the code is delivered through Meta's infrastructure. Your IP address is not stored permanently on this page: it is kept for 1 hour to limit abuse and, if the limit is exceeded, written to the security log.

When you verify your request, a lead record is opened in our CRM system. If a record with the same e-mail or phone already exists, your request is linked to that record. Your note is written to the request record.

Google Calendar and Google Meet: When your appointment is confirmed, it is entered as an event in the calendar of the Google Workspace account of our representative who will hold the meeting. The event title contains the service name and your name, and its description contains your company, phone, e-mail and note; your e-mail address is added as an attendee. A Google Meet link is created for the meeting and the invitation is sent to you by Google. The available times on the appointment page are determined from the busy times in our representative's calendar. The Meet meeting is not recorded.

E-mail correspondence: We conduct our sales and introductory correspondence through Google Workspace (Gmail). The e-mail correspondence we have with you and the related events in our representative's calendar are copied to our CRM system so that we can follow your request in one place.

Google LLC is a company headquartered in the United States. This processing for calendar, Meet and e-mail is a transfer abroad within the meaning of Article 9 of Law No. 6698.

How long do we keep it?

Form records on our site are kept for 24 months from the date the form was submitted and are deleted automatically at the end of that period. The copy passed to our CRM system is not covered by this automatic deletion, and no separate automatic retention period applies to it; you may ask us to delete it at any time. The same applies to introductory meeting requests and the lead records opened from them. The appointment verification code is valid for 10 minutes. The appointment event in the calendar and e-mail correspondence remain in our Google Workspace account until we delete them. Deleted records do not leave backups at once: they remain in our site's backups for up to about 6 months under our backup cycle and in the local backups on our CRM server for 30 days; our CRM's encrypted off-server backups are deleted automatically after 90 days; the unencrypted backups there are not covered by this automatic deletion.

Where is your data stored? (transfer abroad)

Your form records and CRM data are hosted within the European Union: our site's forms and form records are kept on our website server in Germany (Falkenstein), and their backups are also kept in Germany. Our CRM system's database is in Finland (Helsinki), uploaded files and images are in Germany (Frankfurt), and CRM database backups are in Germany (Falkenstein). Each customer's data sits in a separate database, and connections from your browser are encrypted with TLS; the TLS connection terminates at an edge server in Cloudflare's global network (a US-headquartered provider), whose location varies by request.

There is one exception to this separation and we state it plainly: the application's technical error logs are kept in a table shared by all customers. These records may contain personal data relating to the request at the moment the error occurred. They are kept solely for troubleshooting purposes and are not the content of your CRM itself.

This hosting constitutes a transfer abroad within the meaning of article 9 of Law No. 6698. The Board has issued no adequacy decision for the countries involved; below we name every component, the country it sits in and the provider that holds it. You may ask us to delete your data at any time — follow the steps on the Data Deletion Instructions page or write to us using the contact details above.

Who is your data transferred to? (our service providers)

To provide the service we use the following providers. Each of them processes data only for the task written next to it, and only to the extent that task requires:

Cloudflare, Inc. — content delivery network, TLS termination (traffic, including form contents, passes through this point decrypted and is re-encrypted on its way to our servers), web application firewall and bot protection · edge server nearest the visitor / United States
Hetzner Online GmbH — website server and form records · Falkenstein, Germany
Hetzner Online GmbH — backups of the website and form records · Germany
Hetzner Online GmbH — CRM application server and database · Helsinki, Finland
Hetzner Online GmbH — CRM database backups · Falkenstein, Germany
DigitalOcean — storage of uploaded files, images and voice recordings · Frankfurt, Germany
Amazon Web Services (AWS SES) — outgoing e-mail delivery (including appointment verification codes and notifications) · Frankfurt, Germany
Google LLC (Google Workspace) — e-mail (Gmail) through which we conduct our sales and introductory correspondence, the calendar (Google Calendar) in which introductory meetings are entered, and video meetings (Google Meet) · United States
Functional Software, Inc. (Sentry) — application error monitoring · Germany
Anthropic PBC — AI assistant (Rapi), the AI tools our team uses on our own CRM records, our WhatsApp pre-qualification assistant, and producing summaries and analysis from transcripts of recorded calls · United States
Meta Platforms Ireland Ltd. — WhatsApp Business and Instagram messaging, WhatsApp voice calls · Ireland / United States

In our customers' CRM accounts the AI assistant is off by default. Unless you turn it on, the data in those accounts is not sent to any AI provider. Your form records from our site, however, may be processed with AI in our own CRM: our team uses Anthropic's AI tools (Claude and the in-app assistant Rapi) on our CRM records. If you write to our WhatsApp line, your messages are passed to Anthropic PBC so that our pre-qualification assistant can reply to you. When you write to or call our WhatsApp line, your messages and the call audio pass through Meta's infrastructure. In our customers' CRM accounts, Meta is involved only when they connect their own WhatsApp Business or Instagram accounts to the CRM.

When something on this list changes, we update this page.

Your rights (KVKK art. 11)

You have the right to learn whether your personal data is processed, to request information about it, to learn the purpose of processing, to know the third parties it is transferred to, to request correction if it is incomplete or inaccurate, to request erasure where the conditions are met, to object to a result reached against you solely through automated analysis, and to claim compensation for damage. You can send your requests using the contact details above; we respond within 30 days at the latest.