KVKK Information Notice

1. What this notice covers

This information notice covers only visitor data on the alpfitplus.com website: what you type into the demo request form, site analytics and technical server access logs.

Data processing inside the Alpfit Plus product (the management panel and the mobile app) is outside the scope of this text; the product side is described in a separate document.

The same data flow is described in everyday language in the Privacy Policy: alpfitplus.com/en/privacy

The Turkish version of this text prevails; in case of any conflict between the Turkish and English versions, the Turkish text applies.

2. Identity of the data controller

Under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data is processed by Kıvanç Karavelioğlu (Tuzla / İstanbul) as the data controller, within the scope described below.

Contact and application channels: info@kiwiailab.com · +90 535 937 59 55. These are channels we genuinely answer.

3. Personal data processed

The personal data processed on the site falls into the following categories. Special categories of personal data are not processed.

• Identity and contact: name and surname, phone and/or email address.
• Customer transaction: club/business name, number of branches, the optional message you send in the form and the language of the page you filled in.
• Transaction security: an irreversible digest of your IP address (ip_hash) — your raw IP address is never written to the demo request record —, the record time, notification status and environment information.
• Site usage: the address and title of the page visited, the referring address, campaign/click parameters, browser, operating system, device type, screen size, language and an approximate location derived from the IP address (country/region/city). No cookies are used; no IP address is stored in the analytics record.
• Technical server access logs: IP address, browser information and the request line.

4. Purposes of processing

• To respond to your demo request and get in touch with you
• To make sure your request is not lost — it is written to durable storage first, then we are notified
• To limit abuse of the form
• To measure how the site is used and improve the content
• To keep the site secure and to debug errors

5. Method of collection and legal grounds

Your personal data is collected by electronic means: what you type into the demo form is collected through the web form on alpfitplus.com, directly from you; site usage data and technical server access logs are generated automatically when you visit the site.

Within the framework of Article 5 of the KVKK, your data is processed on the following legal grounds:

• Data you submit in the demo form: your request is aimed at establishing a contract and the data is necessary in order to respond to it (art. 5/2-c).
• ip_hash, site usage data and technical server access logs: the legitimate interests of the data controller — limiting abuse of the form, site security, debugging and seeing how the site is used — provided that your fundamental rights and freedoms are not harmed (art. 5/2-f).
• Identity and contact data processed while answering a request you make under Article 11 of the KVKK: compliance with a legal obligation (art. 5/2-ç).

6. Transfers

Cross-border transfer is not a conditional possibility here: it happens with every demo request. Your request is written to our server in Germany, the notification email is sent from Ireland, and some of the providers we use store their data in the United States.

The list below shows the recipient, its role and the country where the data sits. We do not sell or rent your data to third parties for marketing.

• Lead store on our own server (PocketBase) — the primary record of the demo request — Germany (Hetzner, Nuremberg)
• Analytics on our own server (Umami) — site usage statistics — Germany (same server)
• Resend — delivery of notification emails — sending happens from Ireland, the provider stores customer data in the United States
• Google Workspace — the team mailbox the request lands in — based in the United States
• Vercel — hosting of the site and the form endpoint — a United States based provider; content is served from the region closest to you

7. Retention periods

• Demo request record: automatically deleted after 12 months.
• Analytics records: they carry no identity, because no cookies are used and no IP address is stored.
• Technical server access logs: kept for security and debugging.

8. Your rights (KVKK art. 11)

Under Article 11 of the KVKK you may:

• Learn whether your personal data is processed
• Request information if it has been processed
• Learn whether it is used for its intended purpose
• Request correction if incomplete/incorrect
• Request deletion or destruction
• Object to processing and request remedy of any damage

9. Applications

To exercise your rights, send your application to info@kiwiailab.com; for questions, phone: +90 535 937 59 55.

Including information that lets us verify your identity, together with a clear description of your request, speeds up the process.

Your applications are concluded as soon as possible and, under Article 13 of the KVKK, within thirty days at the latest.