Privacy Notice and Privacy Policy
Last updated: 2026-09-11
This notice explains, in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, for what purposes and on what legal bases your personal data is processed, to whom it is transferred, how long it is kept, and what your rights are.
1. Data controller
| Trade name | YouReply Teknoloji Ticaret Eğitim Danışmanlık Araştırma Organizasyon A.Ş. |
|---|---|
| Address | Hacettepe Üniversitesi Teknoloji Geliştirme Bölgesi, Beytepe Kampüsü, 6. Ar-Ge Binası C Blok, Çankaya / Ankara |
| Phone | +90 532 317 20 23 |
| info@youreply.com.tr | |
| Data protection requests | kvkk@youreply.com.tr |
| MERSIS No | 0982 1041 0030 0001 |
| Trade Registry No | 495271 |
| Tax Office / No | Doğanbey / 9821041003 |
2. Scope
This notice covers the following processes:
- the www.yousurvey.com.tr marketing site and its contact form,
- sign-up, sign-in, team and security operations at account.youreply.com.tr,
- the YouReply Survey application at app.yousurvey.com.tr,
- plan purchases, payment and invoicing,
- support and contact correspondence.
The YouReply Participant Panel (www.youreply.com.tr) is a separate service and is subject to its own privacy notice.
3. Two distinct roles
YouReply is the data controller for account, membership, security, billing, support, contact form and website data: YouReply determines the purposes and means of that processing.
The researcher is the data controller for the surveys created with YouReply Survey and the respondent answers collected through them: the researcher who creates the survey decides which data is collected and for what purpose. For that data YouReply acts only as a data processor, on the researcher's behalf and only to the extent needed to provide the service. The parties' obligations are set out in the Data Processing Agreement.
The platform provides tools that help researchers meet their obligations under the KVKK. Determining the legal basis of a survey and informing respondents is the researcher's responsibility.
4. Personal data we process
The table below shows, for each data category, how it is collected, why it is processed, the legal basis, the recipient groups, transfers and the retention criterion. On mobile devices the table scrolls horizontally.
| Data category | How it is collected | Purpose of processing | Legal basis (KVKK Art. 5 / Art. 6) | Recipient groups | Domestic / international transfer | Retention period or criterion | Deletion / anonymization |
|---|---|---|---|---|---|---|---|
| Identity: first name, last name | Sign-up form; for organization accounts, the organization's single sign-on (SSO) system; billing details entered when ordering | Creating and managing the account, providing the service, communicating with you, concluding and performing the sales contract | Art. 5(2)(c) necessary for the conclusion or performance of a contract; for invoice and order records Art. 5(2)(ç) legal obligation | Hosting provider; email delivery service; payment and invoicing providers when you make a purchase; in organization accounts, the account owner and admins; competent public authorities on request | Domestic: hosting, payment and invoicing providers. International: Amazon SES (Germany) for email delivery | For the duration of membership; names in invoice and order records for 10 years as required by law | When the account is deleted, first and last name are cleared (anonymized); invoice and order records are deleted or anonymized at the end of the retention period |
| Contact: email address, phone number (optional) | Sign-up form; account settings; billing details entered when ordering | Sign-in and authentication (password reset code, SMS code for phone sign-in), account and service notices, sending the contract copy and invoice, answering your requests | Art. 5(2)(c); for invoice and contract notices Art. 5(2)(ç) | Hosting provider; email delivery service; SMS provider (phone number and verification code only); payment and invoicing providers; in organization accounts, the account owner and admins | Domestic: hosting, SMS, payment and invoicing providers. International: Amazon SES (Germany) | For the duration of membership; after account deletion, a hashed value of the email address and phone number for 1 month; contact details in invoice and order records for 10 years | When the account is deleted, email address and phone number are anonymized; hashed values are deleted after 1 month |
| Account and transaction security: password hash, session cookies, last sign-in IP address and time, one-time verification codes, account audit log | Automatically when you sign in and when administrative actions are taken in the account | Authentication, keeping you signed in, preventing and detecting unauthorized access, traceability of actions taken in the account | Art. 5(2)(c); Art. 5(2)(ç) (data security obligation under Art. 12 KVKK); Art. 5(2)(f) legitimate interest | Hosting provider; in organization accounts, the account owner and admins who can view the audit log; competent public authorities on request | Domestic. Verification codes sent by email are delivered via Amazon SES (Germany) | Account session cookie 7 days, survey application session cookie 30 days; verification codes for their validity period; password hash and last sign-in IP address and time for the duration of membership; audit log for as long as the account it belongs to exists | When the account is deleted, the password is removed and sign-in IP records and session tokens are deleted; audit log rows remain linked to the anonymized user |
| Customer transaction: selected plan and period, order number, amount, payment method, order and payment dates, trial use, contract approvals (Preliminary Information Form, Distance Sales Agreement and consent to immediate performance) | The plan purchase screen in your account; payment result | Concluding and performing the sales contract, activating the plan and tracking the usage period, evidencing approvals, accounting | Art. 5(2)(c); Art. 5(2)(ç) (Law No. 6502, Regulation on Distance Contracts, tax and commercial legislation); Art. 5(2)(e) establishment, exercise or protection of a right | Hosting provider; payment and invoicing providers; email delivery service (contract copy); in organization accounts, the account owner and users with the billing role; competent public authorities on request | Domestic. The contract copy email is delivered via Amazon SES (Germany) | For the retention periods set by the applicable legislation (10 years under tax and commercial legislation) | Deleted or anonymized at the end of the period; deleting the account does not delete these records before the period ends |
| Financial: billing name or company name, billing address, Turkish ID number or tax number and tax office, invoice amount, confirmation of bank transfer payments. Card details are processed by iyzico and never reach YouReply | The billing details step of the plan purchase screen; iyzico payment page; bank account movements | Collecting payment, issuing e-archive or e-invoices, matching bank transfers to orders, meeting tax and accounting obligations | Art. 5(2)(c); Art. 5(2)(ç) (Tax Procedure Law No. 213, Turkish Commercial Code No. 6102) | Payment service provider (iyzico); e-invoicing provider (Paraşüt); the banks through which payment is made; Revenue Administration; hosting provider; competent public authorities on request | Domestic | 10 years (retention periods under tax and commercial legislation) | Deleted or anonymized at the end of the period |
| Contact form content: full name, email, phone (optional), subject, message | The form on the www.yousurvey.com.tr contact page | Answering your request; assessing demo or quote requests | For demo and quote requests Art. 5(2)(c); for general enquiries Art. 5(2)(f) legitimate interest | Email delivery service; company mailbox provider; authorized employees handling the request | International: Amazon SES (Germany); Google Workspace (Google data centres, including the United States) | Not stored in the website's database. Kept in the mailbox until the request is resolved and the period needed to evidence it in a possible dispute has passed | Deleted from the mailbox when the period ends |
| Support correspondence: requests, complaints and refund applications you send by email or phone, the content of the correspondence, files you attach | Emails you send to destek@ and info@; phone calls | Answering requests, resolving technical issues, assessing complaints and refund applications | Art. 5(2)(c); for consumer complaints Art. 5(2)(ç); Art. 5(2)(f) legitimate interest | Company mailbox provider; authorized employees handling the request; in a dispute, legal advisers and competent authorities | International: Google Workspace (Google data centres, including the United States) | After the request is resolved, for the limitation periods under the applicable contract and consumer legislation | Deleted or anonymized when the period ends |
| Website preference and consent records: language preference (yr-locale cookie), cookie preferences and decision date (yr-consent local storage key) | Written to your browser when you use the language switcher or the cookie preferences window | Remembering your chosen language and cookie decision; not loading content you have not allowed | Art. 5(2)(f) legitimate interest (strictly necessary cookies and records) | None: yr-consent stays in your browser; yr-locale is sent only to our site | None | yr-locale 1 year; yr-consent until you delete it, decisions older than 365 days are asked again | You can delete them in your browser and change your decision via the Cookie Settings link in the footer |
| Analytics | Not currently used: no analytics tool is configured on the site | If enabled, only for site usage statistics | If enabled, Art. 5(1) explicit consent | If enabled, Google LLC | If enabled, international: Google LLC (United States) | Not applicable | Not applicable |
| Email delivery records: recipient email address, email type and subject, time and result of delivery, email content (for one-time code, invitation, contract and password reset emails the content is hidden in the record) | Automatically when the platform sends you an email | Tracking deliveries, resolving delivery problems, evidencing that a notice was sent | Art. 5(2)(c); Art. 5(2)(e); Art. 5(2)(f) legitimate interest | Hosting provider; email delivery service | International: Amazon SES (Germany) | For as long as needed to evidence the delivery | Deleted when the period ends |
| Survey data (YouReply as processor): survey content, respondent answers, response times, IP address, country and time zone in non-anonymous surveys, browser and device details if a meta information question is used, hidden field values, uploaded files and signatures | Through the survey link published by the researcher | Presenting the survey, collecting, storing and exporting responses on the researcher's behalf | Determined by the researcher (data controller) | The researcher and the team members they authorize; hosting provider; file storage service | Domestic: hosting. International: Amazon S3 (Germany) for survey images, uploaded files and signatures | According to the researcher's instructions, for as long as the researcher uses the service | The application has no delete function for surveys or responses; they are deleted on the researcher's written request. Details: Data Processing Agreement |
Your personal data is processed only for the purposes above; it is not sold and is not shared with third parties for advertising. If you choose to contact support via WhatsApp, your messages are transmitted subject to WhatsApp's own terms.
5. International transfers
The service providers below are located outside Türkiye or process data outside Türkiye. These transfers rely on one of the transfer mechanisms provided for in Article 9 of the KVKK (for example, the standard contract published by the Personal Data Protection Board).
| Provider | Service | Data processed | Location | Transfer abroad |
|---|---|---|---|---|
| Amazon Web Services (Amazon S3) | File storage: survey images, files and signatures uploaded by respondents | Images added to surveys; answers to file upload and signature questions | Germany (Frankfurt, eu-central-1) | Yes |
| Amazon Web Services (Amazon SES) | Email delivery | Recipient email address and name, email content (account notices, contract copies, contact form messages) | Germany (Frankfurt, eu-central-1) | Yes |
| Google (Google Workspace) | Company mailboxes: contact form and support correspondence | Emails you send us and contact form messages | Google data centres (including the United States) | Yes |
In addition, Google Maps on the contact page loads only when you allow external media or choose to load the map; Google LLC then receives your IP address and browser details directly.
6. Special categories of personal data
As a data controller, YouReply does not intend to process special categories of personal data and does not ask for such data in account, order or support processes. Please do not share such data in support correspondence either.
Researchers may decide to collect special category data such as health, religion, ethnic origin or political opinion in their surveys. In that case meeting the conditions of Article 6 of the KVKK and informing respondents is the researcher's responsibility. Details: Researcher Responsibilities: Special Category Data and Child Participants.
7. Data security
The main technical and organizational measures we take under Article 12 of the KVKK are:
- Access to the site and applications is provided over HTTPS (TLS); browsers are required to use secure connections via HSTS.
- Session cookies are set so that JavaScript cannot read them (httpOnly); the account session cookie is sent only over secure connections.
- Passwords are stored as hashes, not in plain text.
- Role-based access applies within the account: account roles (Owner, Billing, Admin, Member) and product roles (Admin, Editor, Viewer).
- Organization accounts can use enterprise single sign-on (SSO) via SAML 2.0 or OIDC after domain verification.
- Administrative actions in the account are written to an audit log; in organization accounts the owner and admins can view it.
- The database is backed up regularly and backups are pulled to a separate backup machine.
- Logging is kept limited: the web server keeps no per-request access logs and the applications keep error logs only.
No method provides absolute security. If we find that your data has been obtained by others unlawfully, we will notify the persons concerned and the Personal Data Protection Board as soon as possible, in accordance with Article 12(5) of the KVKK. For details, see the Security page.
8. Your rights
Under Article 11 of the KVKK, by applying to the data controller you have the right to:
- learn whether your personal data is processed,
- request information about the processing if it has been processed,
- learn the purpose of processing and whether data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom your personal data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction of your data under the conditions of Article 7 of the KVKK,
- request that correction, deletion or destruction be notified to third parties to whom the data was transferred,
- object to a result against you arising from analysis of the data exclusively by automated systems,
- claim compensation for damage suffered due to unlawful processing.
9. How to apply
Application methods and the information your application should contain are set out on the Data Subject Request Form page. For questions, write to kvkk@youreply.com.tr. Applications are answered free of charge within 30 days at the latest.
If you answered a survey and have a request about your answers, please contact the researcher who ran the survey first, because the researcher is the data controller for that data. We forward such requests we receive to the researcher concerned.
10. Related notices
- Membership and Account Privacy Notice
- Customer and Subscription Privacy Notice
- Contact Form Privacy Notice
- Data Processing Agreement
- Sub-processor List
- Account and Data Deletion
- Researcher Responsibilities: Special Category Data and Child Participants
11. Cookies
The cookies and local storage keys used on the site are listed in the Cookie Policy. You can change your preferences at any time via the Cookie Settings link in the footer.
12. Changes
This notice is updated when our processing activities or the legislation change. The current version is published on this page and the date of the last update is shown at the top of the page.