This English version is provided for convenience; the Turkish version prevails.
This notice is issued by the data controller MGN Teknoloji A.Ş. ("dor.net") under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK" or the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
1. Data controller
MGN Teknoloji A.Ş.
- Address: Fenerbahçe Mah. İğrip Sk. No: 13 İç Kapı No: 1, Kadıköy/İstanbul, Türkiye
- Tax office / number: Göztepe Tax Office / 6201650498
- MERSİS: 0620165049800001
- KEP: mgnteknolojianonim@hs06.kep.tr
- E-mail: kvkk@dor.net
- Data Controllers' Registry (VERBİS) no: VERBİS no / exemption statusto be filled in
2. Definitions
The definitions in Article 3 of the Law apply. In addition:
- Data subject
- the natural person whose personal data is processed (account holder, team member, authorised representative, website visitor, person opening a support ticket).
- Customer content
- data hosted by the data subject or the customer on its servers. For that data dor.net is a processor, not a controller (see section 9).
3. Personal data we process
| Category | Examples |
|---|---|
| Identity | name, surname, Turkish ID number, date of birth; identity document image where the NVİ match cannot be made; proof of authority for representatives of legal entities |
| Contact | e-mail, phone, address |
| Customer transactions | organisation name, orders, service records, support tickets, time and version of contract acceptance |
| Finance | invoicing details, tax number, balance movements, payment transaction number, last four digits of the card, bank transfer sender details |
| Transaction security | IP address, session records, login times, browser information, two-factor status, API key usage records |
| Traffic data (Law 5651) | allocated IP addresses, connection start and end times, volume of data transferred |
| Legal proceedings | requests from authorities, dispute records |
Special categories of personal data (Art. 6) are not requested or processed. When uploading an identity document we recommend masking fields such as religion or blood group; such fields are disregarded in review.
4. How personal data is collected
Personal data is collected, partly by automated means, through the registration, order, verification and support forms in the console, the API, e-mail and KEP correspondence, phone verification, notifications from the payment institution and banks, the NVİ identity sharing system and system logs.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Opening accounts, delivering services, managing servers, providing support | Art. 5/2-c: processing directly related to the conclusion or performance of a contract |
| Billing, balance management, issuing invoices, accounting records | Art. 5/2-c and 5/2-ç: legal obligation (Tax Procedure Law, Commercial Code) |
| Identity and phone verification, prevention of fraud and abuse | Art. 5/2-ç and 5/2-f: legitimate interest (security of the service and of other customers) |
| Retaining traffic data and providing it to competent authorities | Art. 5/2-a: expressly provided by Law No. 5651, Art. 5 and the related regulation |
| Account security, attack detection, rate limiting, logging | Art. 5/2-f: legitimate interest; Art. 12 data security obligation |
| Mandatory service notices (balance, suspension, maintenance, security, contract changes) | Art. 5/2-c |
| Responding to legal claims, conducting disputes | Art. 5/2-e: establishment, exercise or protection of a right |
| Marketing e-mails | Art. 5/1: explicit consent (obtained separately under Law No. 6563; can be withdrawn at any time) |
| Anonymised usage statistics | anonymised data is outside the scope of the Law (Art. 3/1-b, Art. 28) |
6. Transfers of personal data
In accordance with Article 8 of the Law, and only to the extent required by the purpose, personal data may be transferred to the following recipients:
| Recipient | Purpose of transfer |
|---|---|
| Licensed payment institution and banks | collecting, refunding and matching payments |
| E-document integrator (Paraşüt) and the Revenue Administration | issuing and transmitting electronic invoices |
| NVİ identity sharing system | verifying identity details |
| SMS and e-mail infrastructure providers | delivering verification codes and transactional notices |
| Courts, prosecutors, the BTK, law enforcement and other competent public bodies | fulfilling requests with a legal basis (Law 5651, Criminal Procedure Code, Tax Procedure Law) |
| Legal and financial advisers | fulfilling legal and financial obligations (under confidentiality) |
Transfers abroad: Personal data and customer content are kept in Türkiye. As a rule no transfer abroad takes place. If one of the above providers operates infrastructure outside Türkiye, the transfer is made under Article 9 of the Law, to countries with an adequacy decision or with appropriate safeguards such as a standard contract notified to the Board, and is expressly stated here. [If applicable: e-mail infrastructure provider and country; data transferred: name, e-mail, message content.]
7. Retention periods
Personal data is retained for as long as the purpose requires and for the periods set by law; afterwards it is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Main periods:
- Identity document images: deleted no later than 90 days after the review is completed; only the verification result is kept.
- Account, contract and consent records: 10 years after account closure (Art. 146 Code of Obligations No. 6098).
- Invoice and accounting records: 10 years (Art. 253 Tax Procedure Law No. 213; Art. 82 Commercial Code No. 6102).
- Traffic data: the period set in Art. 5/3 of Law No. 5651 and the related regulation (not less than one year and not more than two years).
- Session and security logs: 1 year.
- Support tickets: 3 years after account closure.
- Commercial message consent and opt-out records: 3 years after consent ends.
8. Data security
Under Article 12 of the Law, the technical and organisational measures set out in the Personal Data Security Guide are implemented: encrypted communication (TLS), passwords stored as one-way hashes, two-factor authentication, role-based and logged access, network segmentation, firewall and DDoS protection, physical access control at the data centre, secure disk wiping, staff confidentiality undertakings and regular training. In the event of a data breach, the Board and the affected data subjects are notified within 72 hours of becoming aware of it, in accordance with Board decision 2019/10 of 24 January 2019.
9. Data on your servers: processor relationship
For personal data a customer processes on its dedicated or cloud servers, the customer is the data controller; dor.net is a processor that supplies infrastructure without accessing content. dor.net does not process such data outside the customer's instructions, does not transfer it abroad and applies the Article 12 measures at infrastructure level. The customer fulfils its own obligations towards its data subjects (information, explicit consent, VERBİS and others). A separate data processing agreement is signed on request.
10. Rights of the data subject (Art. 11)
Under Article 11 of the Law you may apply to dor.net to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether the data is used in accordance with it,
- know the third parties to whom it is transferred, in Türkiye or abroad,
- request rectification if it is incomplete or inaccurate,
- request erasure or destruction under the conditions of Article 7,
- request that rectification, erasure and destruction be notified to third-party recipients,
- object to a result to your detriment produced solely by automated analysis,
- claim compensation for damage caused by unlawful processing.
The exceptions in Article 28 (for example criminal investigations and statutory retention obligations) remain applicable.
11. Data subject requests
Under the Communiqué on the Procedures and Principles of Application to the Data Controller you may submit your request through one of the following channels:
- Console
- after signing in, from the account page or by opening a support ticket with the subject "KVKK request". Your identity is verified by your session.
- from the e-mail address registered in our system to kvkk@dor.net.
- KEP
- to mgnteknolojianonim@hs06.kep.tr by registered electronic mail.
- In writing
- to MGN Teknoloji A.Ş., Fenerbahçe Mah. İğrip Sk. No: 13 İç Kapı No: 1, Kadıköy/İstanbul, Türkiye, with wet signature and a copy of your ID, in person or through a notary.
The request must include your name, surname, signature (for written requests), Turkish ID number (nationality and passport/ID number for foreign nationals), address or e-mail for reply, phone number if any, and the subject of the request. Requests on behalf of another person are accepted only with a notarised power of attorney or proof of legal representation.
Requests are answered free of charge as soon as possible and within 30 days at the latest. If the procedure entails additional cost, the fee in the tariff set by the Board may be charged. If your request is refused, the answer is unsatisfactory or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the request (Art. 14).
12. Changes
This notice may be updated because of changes in law or in processing activities. The current version and effective date are shown at the top of the page; material changes are announced in the console.
Company details
MGN Teknoloji A.Ş. · Fenerbahçe Mah. İğrip Sk. No: 13 İç Kapı No: 1, Kadıköy/İstanbul, Türkiye · Göztepe Tax Office / 6201650498 · MERSİS 0620165049800001 · KEP mgnteknolojianonim@hs06.kep.tr · kvkk@dor.net