KVKK & GDPR Privacy Policy

Last update: September 2026

As Erbaş Yazılım ("the Company"), we take the security of your personal data seriously under Law No. 6698 on the Protection of Personal Data ("KVKK") and the European Union General Data Protection Regulation ("GDPR", EU 2016/679). This notice has been prepared to inform you about the personal data processed when you visit our website erbasyazilim.com and when you use the services of our EM&CA Otomasyon product.

1. Personal Data Processed

The following personal data may be processed in connection with our services:

• Identity and contact details (first name, last name, email, phone, company/hotel name)
• Request and message contents you share through the contact form
• Anonymous technical data about website visits (city/country, browser and device type — IP address is not stored)
• User records of hotel staff within the scope of product usage (EM&CA; the customer keeps these in its own hosting environment)

2. Purposes of Processing Personal Data

• Responding to your demo, quote and contact requests
• Providing the services and fulfilling contractual obligations
• Running technical support and customer satisfaction processes
• Complying with legal obligations and ensuring security

3. Legal Bases

Your personal data is processed on the legal bases set out in Article 5 of the KVKK and Article 6 of the GDPR: entering into or performing a contract (demo/quote process), legal obligation, legitimate interest and explicit consent. Website statistics tracking (Article 6 of this notice) is carried out only with your explicit consent, which you may withdraw at any time.

4. Data Transfers

Your personal data is not shared with third parties without your consent, except where required by law. Our hosting and technical infrastructure providers are located in Turkey; no transfer to a third country takes place under the GDPR. The geolocation service used to provide city/country information is invoked only while your tracking consent is active.

5. Data Security

Technical and administrative measures such as role-based access control, session security, login logs, encryption and regular automated backups are applied to keep your data secure. EM&CA Otomasyon can be configured to keep most of the data in the customer's own hosting environment.

6. Cookies, Local Storage and Tracking Preferences

Our site uses no tracking cookies and no third-party advertising cookies. The values below are kept in <strong>your browser's local storage</strong> (localStorage) or in a strictly necessary session cookie:

• ev_sid — anonymous, randomly generated 32-character visitor ID — created only with your consent — page statistics — deleted via "Cookie Preferences → Decline"
• ev_geo — city/country cache (7 days) — created only with your consent — geographic statistics
• ev_consent — your tracking consent preference — strictly necessary to remember your choice (the consent itself)
• ev_lang — your language preference — strictly necessary for the site to run in your chosen language
• PHPSESSID — form spam protection and session security — strictly necessary (no consent required)

In addition: Google Fonts are served from our own servers (no request goes to Google); no analytics service, ad network or tracking pixel is used; the WhatsApp live support button is simply a link and is passed on to Meta when you click it. "Do Not Track" (DNT) in your browser fully disables tracking. City/country information is sent from your browser to the ipwho.is service only while your consent is active; your IP address is not stored on our site in the process.

You can change your tracking preference at any time via the "Cookie Preferences" link in the footer; the "Decline" option deletes your current visitor ID and stops tracking.

7. Retention Periods

• Contact form messages: until your request is fulfilled, up to 1 year
• Statistics data: up to 120 days (deleted automatically)
• Consent and language preference: until you change it or clear your browser data

8. Your Rights (KVKK and GDPR)

Under Article 11 of the KVKK and Articles 15–22 of the GDPR:

• Find out whether your personal data is processed and request information (GDPR Art. 15 — right of access)
• Learn the purpose of processing and whether it is used accordingly
• Request rectification if processed incompletely or inaccurately (GDPR Art. 16)
• Request deletion or erasure (GDPR Art. 17 — right to be forgotten)
• Request restriction of processing and object to processing (GDPR Art. 18 and 21)
• Request data portability (GDPR Art. 20)
• Withdraw your explicit consent at any time (GDPR Art. 7)

You can send your requests to info@erbasyazilim.com; your applications are concluded within 30 days at the latest. You may lodge a complaint with the Personal Data Protection Authority or, if you are an EU resident, with your competent supervisory authority. Our site carries out no automated decision-making and no profiling.

9. Contact

For questions about KVKK, GDPR and privacy, you can reach us through our contact page or at info@erbasyazilim.com.