Privacy Policy

Information on the processing of your personal data within the Devolay Platform

Last updated: 1 November 2026 | Devolay Yazılım Mühendislik Ticaret Limited Şirketi

This is an unofficial translation provided for information only. The Turkish version is the legally binding text and prevails in case of any discrepancy.

As Devolay Yazılım Mühendislik Ticaret Limited Şirketi (“Devolay” or the “Company”), we would like to inform you, pursuant to Article 10 of Turkish Personal Data Protection Law No. 6698 (the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, about the personal data we process through the devolay.com website, the expert panel and mobile access channels (the “Platform”).

This notice applies to our members (“Members”), to the experts who provide services on the Platform (“Experts”), and to anyone who visits the Platform without registering.

Personal data processed within expert–user messaging, the access rules specific to message content, and explicit consent for special categories of personal data are set out in a separate, more detailed notice (the Messaging Privacy Notice) and are not repeated in this section.

1. Data controller

The data controller under the Law is Devolay Yazılım Mühendislik Ticaret Limited Şirketi, located at Mustafa Kemal Mahallesi Bilişim İnovasyon Merkezi 280, D:G, 06510 Çankaya ODTÜ Teknokent Ankara, Türkiye.

2. Personal data processed

Within your use of the Platform, the following personal data may be processed:

Identity data: first name and last name; for Experts, also title, username and professional information.
Contact data: email address, telephone number.
Account data: username, a securely hashed digest of your password, and your account preferences (language, notification settings).
Customer transaction data: the courses, webinars and appointments you purchase; appointment dates/times; cart and wishlist content; your course viewing progress; your reviews and comments.
Financial data: payment amount, payment status and invoicing information. Payment instrument details such as card numbers are not stored on Devolay servers; payments are collected directly through the secure infrastructure of our payment institution, iyzico.
Transaction security data: your IP address, login times, device and browser information, and data collected through cookies (see the Cookie Policy for details).
Marketing data: where you have given explicit consent, your preferences and interaction records relating to announcement and campaign emails sent to you.
Messaging data: data processed within expert–user messaging is described separately and in detail in the Messaging Privacy Notice.

Special categories of personal data: the Platform is not designed to collect special categories of personal data, such as health data, during registration or use, and Devolay does not ask you for such data. Such data may only be processed within messaging, with your explicit consent, as described in the Messaging Privacy Notice.

3. Purposes of processing

Your personal data is processed for the following purposes:

establishing and operating your membership; authenticating you and providing access to your account;
providing the courses, webinars and appointment services you purchase; scheduling appointments and matching experts with members;
carrying out payment transactions through iyzico, and keeping invoicing and accounting records;
sending in-platform notifications and transactional email notifications;
sending announcement, campaign and marketing messages where you have given your explicit consent;
ensuring Platform security and preventing misuse, fraud and unauthorised access;
measuring service quality, carrying out statistical analysis and improving the Platform;
reviewing and resolving requests, complaints and disputes;
establishing, exercising or protecting rights in legal disputes and responding to requests from competent authorities under the legislation.

4. Method of collection and legal grounds

Your personal data is collected electronically, by partly or fully automated means, through the registration form, appointment and purchase transactions and profile settings on the Platform, and the records the system generates automatically while you use them (cookies, transaction logs).

This data is processed on the following legal grounds under Article 5(2) of the Law:

(c) — processing is necessary, provided that it is directly related to the establishment or performance of a contract, for the personal data of the parties to the contract: providing services under the Membership Agreement and the Distance Sales Agreement, and carrying out appointment and payment transactions.
(ç) — processing is necessary for the data controller to comply with a legal obligation: record-keeping obligations under tax, accounting and other legislation, and requests from competent authorities.
(e) — processing is necessary for the establishment, exercise or protection of a right: resolving requests, complaints and disputes.
(f) — processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject: ensuring Platform security, preventing misuse and measuring service quality.
(a) — your explicit consent: marketing and campaign messages, and special categories of personal data that may be processed within messaging (see the relevant notices and consent texts for details).

5. Cookies

The cookies used on the Platform, their types, retention periods and how you can manage your cookie preferences are explained in a separate notice.

Cookie Policy

Learn more about the cookies used on the Platform.

Read the Cookie Policy

6. Transfers of personal data

Your personal data may be transferred to the following recipients, limited to the purposes above:

Payment institution: to iyzico, for carrying out your payment transactions, limited to the information the transaction requires.
Expert: within your appointment or course purchase relationship, the identity and contact information the Expert needs in order to provide the service is transferred to that Expert.
Service providers: cloud infrastructure, database and file storage providers hosting the Platform, email delivery providers, and (for AI-supported interactive courses) AI service providers. Their servers may be located abroad; in such cases transfers are carried out in accordance with the procedures and principles set out in Article 9 of the Law.
Competent public authorities: under requests and obligations arising from the legislation, limited to the information requested.

7. Retention period

Your personal data is retained for the duration of your membership and for the period required by the purposes set out in section 3. After your membership ends, it continues to be retained for the statutory limitation/retention periods under tax, accounting and other legislation, so that it can be used as evidence in possible disputes; at the end of these periods your data is deleted, destroyed or anonymised.

8. Your rights

Under Article 11 of the Law, by applying to the data controller you have the right to:

learn whether your personal data is processed;
request information if your personal data has been processed;
learn the purpose of processing and whether the data is used in line with that purpose;
know the third parties to whom your personal data is transferred in Türkiye or abroad;
request rectification if your personal data is incomplete or inaccurate;
request erasure or destruction of your personal data under the conditions set out in Article 7 of the Law;
request that rectification, erasure and destruction be notified to third parties to whom your personal data has been transferred;
object to a result against you arising from the analysis of your data exclusively by automated systems;
claim compensation for damage suffered as a result of unlawful processing of your personal data.

You can submit requests regarding these rights to our Company using the methods described in the KVKK Application Form. Your application will be concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request; if the process requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

KVKK Application Form

Review the application methods and the form for exercising your rights under Article 11 of the Law.

Open the application form

Messaging Privacy Notice

Learn more about the personal data processed within expert–user messaging.

Read the Messaging Privacy Notice