This English text is provided for information purposes only. In the event of any discrepancy, the Turkish version prevails.
Effective date and last updated: 17 October 2026 · Version 2.0
As Bizmo Teknoloji Yatırımları A.Ş. (“Bizmo” or the “Company”), we care about processing and protecting your personal data lawfully. This Notice has been prepared pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, for natural persons who visit the bizmo.com.tr website (the “Site”), contact us through the forms on the Site or our other communication channels, or are interested in or purchase our products and services, as well as for authorised representatives and employees of our customers, prospective customers and business partners (the “data subject”).
This text is a notice; it does not constitute a request for your explicit consent. Where processing is based on explicit consent, your consent is obtained separately and on a voluntary basis.
1. Data Controller
Bizmo Teknoloji Yatırımları A.Ş.
Address: Çorum Teknoloji Geliştirme Bölgesi, B-Blok No:7-1K7, 19040 Merkez/Çorum, Türkiye
MERSİS No: 0178175585600001 · Tax Office/No: Hasanpaşa Tax Office / 1781755856
Registered e-mail (KEP): bizmoteknoloji@hs01.kep.tr · E-mail: info@bizmo.com.tr · Phone: +90 (532) 716 46 00
2. Personal Data Processed, Purposes, Legal Grounds and Retention Periods
a) Site visits and information security
Data: IP address, date and time of the visit, the address visited, browser and device information (transaction security data).
Purposes: Operating and securing the Site, detecting and preventing cyber attacks and misuse, debugging.
Legal ground: KVKK Art. 5(2)(f) (legitimate interest of the data controller) and, regarding information security obligations, Art. 5(2)(ç) (legal obligation).
Retention: Server access logs are kept for a maximum of 14 days.
b) Cookies and site usage statistics
Data: Cookie and similar technology identifiers, page view and interaction information, device/browser information, approximate location (country/city level).
Purposes: Providing the Site; if you consent to analytics cookies, measuring and improving the use of the Site.
Legal ground: For strictly necessary cookies, KVKK Art. 5(2)(c) and Art. 5(2)(f); for analytics cookies and similar technologies, your explicit consent (Art. 5(1)). You can give consent through the cookie preferences panel and withdraw it at any time via the “Cookie Settings” link in the footer. Details are in the Cookie Policy.
c) Demo, quote and contact requests
Data: Name and surname, company name, e-mail address, phone number, subject of the request, request details such as company size, module of interest, ERP in use and deployment preference, message content, IP address and the time the form was submitted.
Purposes: Receiving, assessing and responding to your request; scheduling demos; preparing quotes; pre-sales communication; managing request records.
Legal ground: KVKK Art. 5(2)(c) (taking steps prior to entering into a contract at your request) and Art. 5(2)(f) (legitimate interest).
Retention: Request records are kept for 24 months; at the end of this period the personal data in request records is automatically anonymised (it may remain in system backups for up to 30 more days). E-mail correspondence about a request is commercial correspondence and is kept for the statutory retention periods. If a request turns into a contract, the periods in paragraph (d) apply.
d) Customer relations, contracts, invoicing and support
Data: Identity and contact details, title and company information, contract and order information, invoice and payment information (excluding card details), support requests and correspondence, user account information in our products.
Purposes: Concluding and performing contracts; licence and subscription management; providing installation, training and support services; invoicing and collection; customer satisfaction; managing legal disputes.
Legal ground: KVKK Art. 5(2)(c), Art. 5(2)(ç) (obligations under tax and commercial legislation), Art. 5(2)(e) (establishment, exercise or protection of a right) and Art. 5(2)(f).
Retention: Commercial books and documents are kept for 10 years under Article 82 of the Turkish Commercial Code No. 6102 and Article 253 of the Tax Procedure Law No. 213; other records are kept for the term of the contract and the applicable limitation periods.
e) Payments
Online payments are taken through the infrastructure of the licensed payment institution iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.). Your card details are not seen or stored by Bizmo; the payment institution processes them under its own privacy notice. Legal ground: KVKK Art. 5(2)(c) and Art. 5(2)(ç).
f) Commercial electronic messages
Promotional messages about our products and services are sent with your separate approval where required by Law No. 6563 on the Regulation of Electronic Commerce and related legislation. You may withdraw your approval at any time, without giving a reason and free of charge. Legal ground: explicit consent and the approval required by law (Art. 5(1)); the statutory exceptions for messages to merchants and tradespeople are reserved.
g) Legal obligations and disputes
Responding to requests for information and documents from competent authorities, audits, conducting legal proceedings and protecting our rights. Legal ground: KVKK Art. 5(2)(ç) and Art. 5(2)(e).
3. Method of Collecting Personal Data
Your personal data is collected directly from you (through Site forms, e-mail, phone, meetings and contracts), by automated means (server logs, cookies and similar technologies) and — for employees of our customers or business partners — through the organisation you work for, in electronic or physical form.
4. Transfer of Personal Data
Within Türkiye: Your personal data may be transferred, limited to and proportionate with the purposes above, to our hosting and technical service providers based in Türkiye, the payment institution, the financial advisers, accounting, legal and audit professionals we work with, and to legally authorised public institutions and judicial authorities.
Abroad: We use the following providers to deliver our services:
- Cloudflare, Inc. (USA): Delivering Site traffic, protecting it against attacks and cookieless performance measurement; IP address and request information.
- Google LLC / Google Ireland Limited: Corporate e-mail infrastructure (including request notifications and correspondence) and — only if you consent to analytics cookies — Google Analytics.
Transfers abroad are carried out under KVKK Article 9, relying on one of the appropriate safeguards listed in the law, such as the standard contract announced by the Personal Data Protection Board, or, where these are not available and provided that the transfer is incidental, on one of the cases listed in Article 9(6) (such as the performance of a contract between you and us or your explicit consent).
5. Data Our Customers Process in Our Products
When Bizmo software is used by our customers on their own servers (on-premise) or under a cloud subscription, the customer is the data controller for the personal data it enters into the system. Bizmo processes this data solely in accordance with its contract with the customer and the customer's instructions, as a data processor to the extent it provides support or hosting services. For notices and requests regarding such data, please contact the relevant customer as the data controller.
6. Retention and Destruction
Personal data is kept for the periods stated above and the retention and limitation periods provided in the relevant legislation. When these periods expire or the conditions for processing no longer exist, it is deleted, destroyed or anonymised ex officio in accordance with KVKK Article 7 and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
7. Data Security
Under KVKK Article 12, we apply reasonable technical and organisational measures such as SSL/TLS encryption, role-based access authorisation, two-step verification for administrative access, access logging, attack protection, regular backups, hosting data on servers in Türkiye and confidentiality obligations of our employees. In the event of a data breach, notifications are made to the data subjects and the Board in accordance with KVKK Article 12(5).
8. Your Rights as a Data Subject (KVKK Art. 11)
- To learn whether your personal data is processed,
- To request information if it has been processed,
- To learn the purpose of processing and whether data is used in line with that purpose,
- To know the third parties to whom it is transferred in Türkiye or abroad,
- To request rectification if it is incomplete or inaccurate,
- To request deletion or destruction under the conditions set out in KVKK Article 7,
- To request that rectification, deletion and destruction be notified to third parties to whom the data has been transferred,
- To object to a result against you arising from the analysis of the processed data exclusively by automated systems,
- To claim compensation for damages if you suffer damage due to unlawful processing of your personal data.
9. How to Apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests regarding your rights:
- with a wet-signed petition, in person or through a notary, to our address above,
- with a secure electronic signature or mobile signature to our KEP address bizmoteknoloji@hs01.kep.tr,
- from the e-mail address you have previously notified to us and that is registered in our system, to info@bizmo.com.tr.
Your application must include your name and surname, your signature for written applications, your Turkish ID number (for foreigners, nationality and passport or ID number), your residential or business address for notifications, your e-mail address and phone number if any, and the subject of your request. We may request additional information to verify your identity. Your application will be concluded free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request; if the action requires an additional cost, the fee in the tariff set by the Board may be charged. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board under KVKK Article 14 within 30 days of learning of the response and in any case within 60 days of the application date.
10. Changes
This Notice may be updated due to changes in legislation or in our processing activities. The current version takes effect on the date it is published on the Site.