TaxKolay

KVKK Privacy Notice

Version 1.1

On this page

This notice explains how your personal data is processed under Law No. 6698 on the Protection of Personal Data ("KVKK"). It is provided for information; it is not a consent or approval statement.

1. Data controller and representative

TaxKolay LLC's data controller representative in Türkiye: Ferhat Şahin.

2. Categories of personal data processed

Identity. Name and surname, date of birth, nationality, passport and ID details, images of identity documents, selfie, tax identification numbers, SSN or ITIN, and other identity details required for the service.

Contact. Phone, e-mail, address, proof of residence or address, and communication preferences.

Customer transactions. Service requests, orders, contract and consent records, payment, refund and chargeback details, portal and support records.

Company and professional details. Company name, registration details, shareholder, director and beneficial owner details, field of activity, company documents and authority details.

Financial and accounting. Bank account details, bank statements, sales and payment platform reports, income and expense records, invoices, accounting records and information relating to tax filings.

Transaction security. IP address, browser information, session, login and security event logs, contract version records.

Risk and compliance. Identity verification results, sanctions and fraud risk notes, requested source of funds or proof of activity.

Marketing and preferences. Commercial electronic message consent and opt-out records, and cookie preferences.

3. Purposes of processing

Your personal data may be processed to:

  • manage membership and accounts;
  • verify identity and customers;
  • carry out the purchased company formation, tax, accounting, address, Registered Agent and other compliance services;
  • prepare and submit official and third-party applications;
  • provide application support for banks, fintechs and payment platforms;
  • manage payment, refund, fraud prevention and chargeback processes;
  • prepare tax and filing files and obtain customer approval;
  • handle customer requests, complaints and support communication;
  • ensure information security and access control and prevent misuse;
  • meet legal obligations;
  • establish, exercise or protect a legal right;
  • respond to requests from competent authorities;
  • send marketing communications where you have expressly chosen to receive them;
  • carry out analytics and advertising measurement where the necessary permission exists.

4. Method of collection

Your personal data may be obtained wholly or partly by automated means — and in some cases by non-automated means forming part of a filing system — through:

  • forms on the website and customer portal,
  • file uploads,
  • e-mail,
  • WhatsApp Business and telephone,
  • the Stripe payment process,
  • sign-in with Google,
  • responses to official and third-party applications,
  • system logs created while the service is performed,
  • other sources you authorise or that are necessary for the service.

Depending on the specific data and processing activity, personal data is processed on the legal grounds set out in Article 5 and, where applicable, Article 6 of the KVKK. The main grounds are:

  • being directly related to the conclusion or performance of a contract;
  • compliance with the data controller's legal obligation;
  • being mandatory for the establishment, exercise or protection of a right;
  • being necessary for the legitimate interests of the data controller, provided this does not harm your fundamental rights and freedoms;
  • processing compatible with the purpose of disclosure where the data has been made public by the data subject;
  • being expressly provided for by law;
  • explicit consent, only for activities where no other processing condition exists and legislation requires consent.

Where special categories of personal data are processed, the current conditions in Article 6 of the KVKK are assessed separately. If a new system is introduced in which a selfie or photograph would be used for technical biometric matching, it is not deployed without a separate assessment of its special-category nature and legal basis.

6. Recipient groups

To the extent required by the service and by law, your personal data may be transferred to:

  • public authorities in the US, the UK and other countries where services are provided;
  • Registered Agent, address and filing service providers;
  • banks, fintechs and payment platforms;
  • Stripe, for payment processing;
  • Railway and related infrastructure providers, for hosting and data infrastructure;
  • Cloudflare, for files, CDN and security;
  • Google, for e-mail and productivity;
  • Meta, for WhatsApp communication;
  • independent professional service providers required for the service;
  • competent public authorities, courts and other bodies where legally required.

7. Transfers abroad

Because TaxKolay LLC is established in the United States and the technology and business partners used may be located abroad, your personal data may be transferred outside Türkiye.

Transfers abroad are carried out under the current framework of Article 9 of the KVKK, through an adequacy decision, appropriate safeguard mechanisms, or one of the incidental cases permitted by law. Relying solely on general explicit consent is not the preferred model for routine and continuous cloud and operational transfers.

8. Retention and destruction

Data is retained for the purpose of processing and for the applicable legal period. Once that period ends and no other legal ground remains, the data is erased, destroyed or anonymised in line with TaxKolay's retention and destruction policy.

A request to delete an account does not mean the immediate deletion of records still subject to a mandatory retention period for tax, filing, contract, payment, identity verification, risk or legal dispute purposes.

9. Your rights under Article 11 of the KVKK

To the extent the conditions are met, you have the right to:

  • learn whether your personal data is processed;
  • request information if it has been processed;
  • learn the purpose of processing and whether the data is used in line with that purpose;
  • know the third parties to whom the data is transferred, in Türkiye or abroad;
  • request correction if the data is incomplete or inaccurate;
  • request erasure or destruction where the conditions apply;
  • request that correction, erasure or destruction be notified to the recipients to whom the data was transferred;
  • object to an adverse outcome arising from analysis carried out solely by automated systems;
  • claim compensation if you suffer loss due to unlawful processing.

10. Applications

For the application procedure and form, see the KVKK Application Form. General contact: privacy@taxkolay.com.

Applications are concluded within 30 days at the latest, following identity verification and in accordance with the procedure set out in legislation. Where the process entails a cost, the fee permitted by legislation may be applied.

11. Governing language

The Turkish version of this document prevails. The English translation is provided for information purposes only; in the event of any discrepancy between the two, the Turkish version applies.