This Information Notice is issued by Pella CRM as data controller, under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the "Law") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
It covers people who visit our website, request a demo, contact us as a customer or partner representative, apply to us as a candidate, or use the Service.
For data our customers enter into their own workspaces, the controller is the customer company, and the obligation to inform rests with it. That distinction is explained in detail in section 2 of the Privacy Policy.
1.Identity of the data controller
Under the Law, your personal data is processed by the data controller identified below.
- Legal name: Pella CRM
- General enquiries: info@pellacrm.com
- Data protection requests: kvkk@pellacrm.com
- Security reports: guvenlik@pellacrm.com
2.Who this notice covers
This notice is addressed to the groups below. What data is processed depends on which group you fall into.
- Website visitors.
- Prospective customer representatives who request a demo.
- Representatives and employees of customers, suppliers and partners.
- People who contact our support and enquiry channels.
- Job and internship applicants.
3.Categories of personal data processed
As a controller we process the following categories of personal data.
| Category | Data processed |
|---|---|
| Identity | First name, surname |
| Contact | Email address, phone number, postal address |
| Customer transaction | Enquiry and complaint records, demo request content, support correspondence |
| Transaction security | IP address, browser and device information, sign-in and activity logs, cookie records |
| Finance | Invoice details, payment status, subscription records |
| Professional experience | Job title, employer, CV details (job applications only) |
| Marketing | Commercial electronic message consent records, newsletter subscription |
We do not set out to process special category data as a controller. Please do not enter data of that nature into free-text fields; where it reaches us anyway it is deleted, since we have no purpose for processing it.
4.Purposes of processing
Your personal data is processed for the following purposes.
- Receiving, assessing and resolving enquiries and complaints.
- Running demo, quotation and sales processes.
- Establishing and performing contracts.
- Invoicing, collection and accounting.
- Delivering the Service, managing accounts and providing technical support.
- Running information security processes and preventing abuse.
- Providing information to competent authorities where legislation requires it.
- Communication activities and, where consent has been given, marketing activities.
- Running job application processes.
5.Legal bases for processing
Your personal data is processed on the legal bases set out in Article 5 of the Law, as follows.
| Legal basis | Article | Example |
|---|---|---|
| Expressly provided for by law | art. 5/2-a | Keeping records required by legislation |
| Necessary for entering into or performing a contract | art. 5/2-c | Responding to a demo request, opening an account, invoicing |
| Compliance with a legal obligation | art. 5/2-ç | Retaining tax and accounting records |
| Establishment, exercise or protection of a right | art. 5/2-e | Retention as evidence in the event of a dispute |
| Legitimate interest | art. 5/2-f | Information security, prevention of abuse, improving the Service |
| Explicit consent | art. 5/1 | Sending commercial electronic messages and marketing communications |
6.Special category data
We do not process, as a controller, the special categories of personal data listed in Article 6 of the Law (health, criminal convictions and security measures, biometric data and the like).
Where our customers keep documents of that nature in the HR module, establishing the legal basis and providing the information notice is the responsibility of that customer company. The technical protections applied to such data are described in the sensitive data section of the Privacy Policy.
7.Method of collection
Your personal data is collected by automated and partly automated means through forms on our website, email and telephone correspondence, contracting processes, use of the application, and cookies and similar technologies.
It may also be obtained by non-automated means where the company you represent passes it to us.
8.Transfers of personal data
Your personal data may be transferred, only as far as achieving the purposes above requires, in accordance with Articles 8 and 9 of the Law.
- To our suppliers of hosting, content delivery, email delivery, notification, calling infrastructure and payment services.
- To our legal and financial advisers and independent auditors.
- On request, and within the limits legislation sets, to competent public institutions.
Your personal data is not transferred or sold to third parties for advertising, marketing or data trading purposes.
9.International transfers
Our hosting infrastructure is located in Germany, and some notification, calling, mail and payment services run through providers established abroad. Your personal data is therefore transferred abroad.
Such transfers are made under Article 9 of the Law, where an adequacy decision exists, where appropriate safeguards such as standard contractual clauses or a written undertaking are in place, or under the exceptions the article provides.
10.Retention and destruction
Your personal data is retained for as long as the purpose of processing requires and for the limitation and retention periods legislation prescribes.
Once the period expires or the conditions for processing disappear, the data is deleted, destroyed or anonymised in the first periodic destruction cycle under our retention and destruction policy.
The retention periods we apply per category are shown as a table in the retention section of the Privacy Policy.
11.Your rights under Article 11 of the Law
By applying to the data controller you may exercise the following rights.
- To learn whether your personal data is being processed.
- To request information about it if it has been processed.
- To learn the purpose of processing and whether the data is used in line with that purpose.
- To know the third parties, in Türkiye or abroad, that your data is transferred to.
- To request correction where the data is incomplete or inaccurate.
- To request erasure or destruction under the conditions in Article 7 of the Law.
- To request that corrections, erasures and destructions be notified to the third parties the data was transferred to.
- To object to a result to your detriment arising from analysis carried out solely by automated systems.
- To claim compensation for damage suffered as a result of unlawful processing.
12.How to apply
Requests must be submitted in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application must contain your name and surname, your signature if it is in writing, your Turkish identification number (nationality and passport number for foreign nationals), your address for service, any email address and telephone number for notification, and the subject of your request.
- By email: to kvkk@pellacrm.com, from the email address registered in our system.
- By registered electronic mail: our KEP address will be published in this section once it is in service.
- In writing: a wet-signed letter to our registered address (write to us for the address).
Your application is answered as soon as possible and in any event within 30 days, free of charge. Where the response entails a separate cost, the fee set by the Board may be charged. If your application is refused, if you find the response inadequate, or if no response is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the response and in any case within 60 days of your application.
13.A note for our customers' employees
If your employer uses Pella CRM, your employment and performance data may be held in its workspace. The controller of that data is your employer.
Access, correction and erasure requests should therefore be addressed to your employer first. If you contact us, we forward your request to the relevant controller and provide technical support in the process.
Our role in relation to that data is that of a processor; we do not act on it on our own initiative without our customer's instruction.
Questions about this document: info@pellacrm.com
Other legal documents: Privacy Policy · Terms of Service · Cookie Policy