LEGAL

Privacy Policy and KVKK Disclosure Notice

LAST UPDATED: 25 JULY 2026

This notice explains how personal data is processed on tucoapps.com, the website operated by TUCOAPPS YAZILIM TEKNOLOJİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ (“TUCO”, “the Company”, “we”). It is prepared to fulfil the data controller's duty to inform under the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

1. Data Controller

TUCO is a software studio established in Türkiye that builds mobile applications and delivers end-to-end software solutions, including web, SaaS and automation. This policy covers the data processing activities carried out through the Company's website.

2. Personal Data We Process

2.1. Data you send us via the contact form or e-mail

If you use the contact form on the site or write to us directly, the following data is processed:

• Identity data: first and last name (only to the extent you choose to provide it)
• Contact data: e-mail address
• Message content: any information you choose to share with us in the message body

The form on the site does not store your message on our server; when you submit it, your details are sent to us through the e-mail application on your own device. Your message therefore exists only in the Company's e-mail account.

2.2. Server logs

Every request made to the site is automatically recorded on our hosting server for security and technical operation purposes:

• IP address
• date and time of the request, the address requested
• browser and operating system information (user agent), referring address

2.3. Cookies and analytics

This site does not use cookies, and as of the publication date of this notice there is no analytics or advertising tracking tool on the site. Should such a tool be added in the future, this policy will be updated and your consent will be obtained where required.

2.4. Fonts (Google Fonts)

The typefaces used on the site are loaded from Google Fonts, operated by Google LLC. Because of this technical requirement your browser sends a request to Google's servers, and in doing so your IP address is transmitted to Google. This constitutes a transfer of data abroad. Google Fonts does not set cookies for these requests. For Google's data practices see policies.google.com/privacy.

3. Purposes of Processing

• Responding to the requests, questions and collaboration proposals you send us, and maintaining communication
• Conducting pre-contractual discussions and establishing business relationships
• Keeping the website secure and available, and detecting misuse and attacks
• Fulfilling legal obligations and providing evidence in potential disputes

4. Legal Grounds

Your personal data is processed on the following legal grounds under Article 5 of the KVKK:

• Art. 5/2-c: directly related to the conclusion or performance of a contract (collaboration and proposal discussions)
• Art. 5/2-ç: necessary for the Company to fulfil its legal obligations
• Art. 5/2-e: necessary for the establishment, exercise or protection of a right
• Art. 5/2-f: necessary for the legitimate interests of the Company (site security, server logs)

5. Method of Collection

Data is collected electronically by wholly or partly automated means through the contact form on the website, e-mail correspondence and the server's automatic logging systems.

6. Transfers, Including Transfers Abroad

Your personal data is never sold or transferred to third parties for marketing purposes. It is shared only in the following cases and only to the extent necessary:

• Hosting provider: the site is hosted on a server located in the United States, provided by Contabo GmbH (Germany). Server logs are held on this infrastructure.
• E-mail service provider: messages you send us are processed and stored on the infrastructure of the Company's e-mail provider.
• Google LLC: IP address only, solely for font loading and as described in section 2.4.
• Authorised public authorities: where there is a request or obligation arising from legislation.

These transfers are carried out under Article 9 of the KVKK and only to the extent required to obtain the services listed above.

7. Retention Periods

• Correspondence: kept for as long as necessary for potential legal claims after the communication concludes; where a business relationship is established, for the periods prescribed by the applicable legislation.
• Server logs: kept for as long as required for security and technical operation, then deleted or overwritten.

Data whose retention period has expired is deleted, destroyed or anonymised.

8. Data Security

All traffic between the site and your browser is encrypted with a TLS certificate (HTTPS). Access to the server is restricted to key-based authentication, and firewall and intrusion prevention measures are in place. The Company takes the technical and administrative measures necessary to prevent unlawful processing of and access to data.

9. Our Mobile Applications

Data processing carried out by the mobile applications published by TUCO falls outside the scope of this policy. Each application has its own privacy policy, presented on that application's App Store page and within the app itself. Purchases, subscriptions and payments made through the app store are handled by Apple Inc.; the Company has no access to your payment card details.

10. Your Rights Under the KVKK

Under Article 11 of the KVKK you have the right to apply to the Company and:

• learn whether your personal data is being processed and, if so, request information about it
• learn the purpose of processing and whether the data is used in line with that purpose
• know the third parties, in Türkiye or abroad, to whom the data is transferred
• request correction of data that is incomplete or inaccurate
• request deletion or destruction of the data within the conditions of Article 7 of the KVKK
• request that correction, deletion and destruction operations be notified to third parties to whom the data was transferred
• object to an adverse outcome arising from analysis carried out exclusively by automated systems
• claim compensation if you suffer damage due to unlawful processing

11. How to Apply

You may send requests concerning your rights, together with information establishing your identity, to hello@tucoapps.com. Applications are concluded free of charge within thirty days at the latest, depending on the nature of the request; where the process incurs an additional cost, the fee set by the Personal Data Protection Board may be charged.

If your application is rejected or not answered in time, you retain the right to file a complaint with the Personal Data Protection Board.

12. Changes

This policy may be updated in line with changes in legislation or in our services. The current version is always published on this page and the “last updated” date above is revised accordingly.

13. Contact

For any question regarding this notice: hello@tucoapps.com