Turkish Law No. 6698

KVKK Policy

Pitbull's obligations as data controller under Turkish Personal Data Protection Law No. 6698, processing purposes and application procedures.

Legal & Compliance KVKK · GDPR
Data residencyTR
Log separationOK
AuditACTIVE
SLA99.99%
Art. 10
Disclosure duty
30 days
Application response
VERBIS
Registry obligation
Turkey
Data residency priority

1. Data controller identity

Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), the data controller is Pitbull Secure Gateway. This policy fulfils the disclosure obligation under KVKK Art. 10.

2. Personal data processed

Identity, contact, customer transaction, security logs, email metadata and marketing preferences. Email body is not archived by default except quarantine or legal requirement.

3. Processing purposes

Email gateway service, account management, support and NOC, billing, security and abuse prevention, legal compliance, marketing with explicit consent.

4. Legal grounds (KVKK Art. 5)

Explicitly provided by law, contract performance, legal obligation, establishment/exercise of rights, legitimate interest (without harming fundamental rights), explicit consent for marketing.

5. Transfers (Art. 8–9)

Domestic sharing with data center, payment provider and support under contract. Cross-border transfers under Art. 9 with adequate protection, Board consent, explicit consent or commitment mechanisms; GDPR-aligned tools for EU customers.

6. Retention

Account data for contract term plus limitation; operational logs 30–90 days; invoices per tax law (typically 10 years).

7. Data subject rights (Art. 11)

Learn whether data is processed, request information, learn purpose and recipients, request rectification, erasure under Art. 7, notification to third parties, object to automated adverse decisions, claim damages for unlawful processing.

8. How to apply

Via contact form subject "KVKK Data Subject Application" or registered email/notary for enterprise. Response within 30 days, free unless additional cost applies per Board tariff.

9. Technical and administrative measures (Art. 12)

Access control, RBAC, TLS, no credential logging, backups, employee confidentiality, Tier III physical security.

10. VERBIS registry

VERBIS registration obligations fulfilled as required by regulation.

11. Complaint to the Board

Right to complain to the Personal Data Protection Authority (kvkk.gov.tr).

Last updated: June 2026