KVKK Information Notice
In effect from 11 October 2026.
This is an English rendering of the information notice required by Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the “Law”). If the two versions differ, the Turkish text prevails.
1. Data controller
Your personal data are processed by [Veri sorumlusunun adı soyadı veya ticaret unvanı] (“DayBreach”) as data controller, to the extent described below. Address: [Tebligat adresi]. Email: [İletişim e-posta adresi].
2. Personal data processed, purposes and legal grounds
| Category of data | Purpose of processing | Legal ground |
|---|---|---|
| Identity and contact: email address, display name | Creating the account, signing in, sending notices about the account | Formation and performance of a contract (Art. 5/2-c) |
| Account security: an irreversible hash of the password, the two-step verification record, the Google account identifier when signing in with Google | Verifying identity and protecting the account against unauthorised access | Performance of a contract (Art. 5/2-c), legitimate interest (Art. 5/2-f) |
| Transaction security: IP address, browser and device information, session and sign-in records, count of failed sign-ins | Ensuring information security, preventing abuse, evidence in the event of a dispute | Legitimate interest (Art. 5/2-f), legal obligation (Art. 5/2-ç) |
| Usage preferences: follow list, saved items, saved filters, notification and language settings, personal technology inventory | Personalising the service and producing the alerts requested | Performance of a contract (Art. 5/2-c) |
| API usage: a hash of the key, request counts | Providing the API service and applying usage limits | Performance of a contract (Art. 5/2-c), legitimate interest (Art. 5/2-f) |
| Usage statistics: the page visited, a random session number valid for the life of the browser tab | Measuring and improving the operation of the service | Legitimate interest (Art. 5/2-f) |
| Requests and complaints: feedback messages, correspondence about applications | Answering requests and concluding applications | Legal obligation (Art. 5/2-ç), legitimate interest (Art. 5/2-f) |
| Organisation panel: email address, name and role of the organisation’s representative and members; names and email addresses of system owners in the inventory the organisation uploads | Providing the organisation panel service and notifying the owners of affected systems | Performance of a contract (Art. 5/2-c), the organisation’s legitimate interest (Art. 5/2-f) |
No special categories of personal data are processed. For data that an organisation itself uploads to the organisation panel, that organisation is the data controller and DayBreach acts as data processor; requests concerning such data should be addressed to the organisation in the first instance.
3. Method of collection
Your personal data are collected electronically and by wholly automated means: through the forms you complete when creating an account and using the service, through the information Google supplies if you sign in with Google, and through the records our servers keep during your visit.
4. Transfers of personal data
Your personal data may be transferred, limited to the purposes above and in accordance with Articles 8 and 9 of the Law, to the following groups of recipients:
- Suppliers from whom we obtain server hosting, email delivery and backup services, solely so that the service can be provided technically.
- Google LLC, if you choose to sign in with Google, in order to carry out authentication.
- Public authorities and judicial bodies empowered by law, in order to fulfil a legal obligation and limited to what is requested.
Some of our suppliers may have servers outside Türkiye. Transfers abroad are carried out in accordance with the conditions laid down in Article 9 of the Law. Your personal data are not sold or rented to third parties for marketing purposes.
For AI-generated summaries, only public vulnerability records are sent to the service providers. Your personal data and organisations’ inventories are not transferred to AI providers.
5. Retention period
Account data are kept for as long as your account remains open and are erased, destroyed or anonymised when the account is deleted. Transaction security records are kept for no longer than two years, having regard to the periods laid down in the relevant legislation and to the burden of proof in possible disputes. Copies held in backups are erased automatically when the backup cycle completes.
6. Your rights under Article 11 of the Law
By applying to the data controller you have the right to:
- learn whether your personal data are processed,
- request information about the processing if they are,
- learn the purpose of the processing and whether the data are used in accordance with it,
- know the third parties, in Türkiye or abroad, to whom the data are transferred,
- request rectification if the data are incomplete or inaccurate,
- request erasure or destruction under the conditions of Article 7 of the Law,
- request that rectification, erasure and destruction be notified to the third parties to whom the data were transferred,
- object to a result to your detriment arising from analysis of the data exclusively by automated systems,
- claim compensation if you suffer damage as a result of unlawful processing.
7. How to apply
You may send your request, in accordance with the Communiqué on the Principles and Procedures for Applications to the Data Controller and together with information establishing your identity, in writing to the address above or from the email address registered to your account to [İletişim e-posta adresi]. Your application is concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. Where the operation entails a separate cost, the fee in the tariff set by the Personal Data Protection Board may be charged.
If your application is refused, if you find the reply insufficient, or if no reply is given in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the reply and in any event within sixty days of the date of application.