This English version is provided for convenience; the Turkish version prevails.
This policy explains what information MGN Teknoloji A.Ş. ("dor.net") collects through its website, console and API, how it uses and shares that information and how it protects it. The formal privacy notice required by Article 10 of the Personal Data Protection Law No. 6698 (KVKK) is published separately as the KVKK privacy notice; the two documents are to be read together.
1. Data controller
MGN Teknoloji A.Ş. · Fenerbahçe Mah. İğrip Sk. No: 13 İç Kapı No: 1, Kadıköy/İstanbul, Türkiye · Göztepe Tax Office / 6201650498 · MERSİS 0620165049800001 · KEP mgnteknolojianonim@hs06.kep.tr · Privacy and KVKK requests: kvkk@dor.net · General: legal@dor.net
2. Definitions
- Personal data
- any information relating to an identified or identifiable natural person.
- Account data
- information you provide when opening and using a console account.
- Customer content
- data you host on your servers. You are the controller of that data; dor.net does not access it (see section 7).
- Traffic data
- connection records retained under Law No. 5651.
- Cookie
- a small text file placed in your browser.
3. What we collect
3.1. Information you give us
- Account
- name, e-mail, password (stored only as a one-way hash), phone number, organisation name, language preference.
- Invoicing
- invoice name, address, tax office and number or Turkish ID number.
- Verification
- Turkish ID number together with name, surname and date of birth for the civil registry (NVİ) match; an image of your identity document if the NVİ match cannot be made; for legal entities the tax identification number and, where needed, signatory circular or proof of authority.
- Support
- what you write in support tickets and files you attach.
- Team
- e-mail addresses and roles of people you invite.
3.2. Information collected automatically
- Session and security
- IP address, browser and operating system information, login times, failed login attempts, two-factor status, API key usage times.
- Service records
- records of actions such as creating, deleting or rebooting servers, hourly usage metering, balance movements.
- Traffic data
- IP addresses allocated to your servers, connection start and end times and volume of data transferred (not content).
- System logs
- error and performance logs.
3.3. Information from third parties
- Payment institution
- whether the payment succeeded, transaction number, last four digits of the card and the issuing bank. Your card number never reaches dor.net.
- Bank
- sender name, IBAN and description when you top up by bank transfer.
- NVİ (civil registry)
- whether the identity details matched.
- E-document integrator (Paraşüt)
- invoice status.
4. What we use it for
| Purpose | Data used | Legal basis (KVKK Art. 5) |
|---|---|---|
| Opening the account, delivering the service, managing servers | account, service records | performance of a contract (5/2-c) |
| Balance, billing, issuing invoices | account, invoicing, payment | performance of a contract; legal obligation (5/2-ç) |
| Identity verification and fraud prevention | verification, session | legal obligation; legitimate interest (5/2-f) |
| Account security, attack detection, rate limiting | session, system logs | legitimate interest |
| Retaining traffic data under Law 5651 and answering lawful requests | traffic data | expressly provided by law (5/2-a) |
| Support tickets and service notices (balance, suspension, maintenance, security) | account, support | performance of a contract |
| Responding to legal claims, protecting rights | relevant records | establishment and protection of rights (5/2-e) |
| Aggregated, anonymised statistics for product improvement | usage records (anonymised) | legitimate interest |
Marketing e-mails are sent only with your prior consent under Law No. 6563 and the Regulation on Commercial Communications and Commercial Electronic Messages; mandatory service notices (invoices, suspension, security) do not require consent. You can withdraw consent at any time on the account page in the console or through the link in the message.
5. Who we share it with
dor.net does not sell your personal data. Data is shared only in the following cases and only to the extent necessary:
- Payment institution
- a payment institution licensed under Law No. 6493 (card payments); banks (transfers).
- E-document integrator
- Paraşüt (Mikrogrup) for issuing electronic invoices and transmitting them to the Revenue Administration.
- Identity verification
- the NVİ identity sharing system; the SMS provider SMS providerto be filled in for phone verification.
- E-mail delivery
- the e-mail infrastructure provider e-mail providerto be filled in for transactional e-mails.
- Authorities
- courts, prosecutors, the BTK, the Revenue Administration and other public bodies, on requests with a legal basis. We review the scope and legal basis of each request and inform you where the law allows.
- Legal and accounting advisers
- under confidentiality obligations and only where needed.
- Business transfer
- in a merger, demerger or transfer, to a successor that assumes the same confidentiality obligations; you are informed in advance.
As a rule your data is not transferred outside Türkiye. If one of the above providers operates infrastructure outside Türkiye, the transfer is made only under the conditions of Article 9 KVKK (adequacy decision, standard contract notified to the Board, or explicit consent) and is stated in the KVKK privacy notice.
6. How long we keep it
| Data | Period | Basis |
|---|---|---|
| Account and consent records | 10 years after account closure | limitation period, Art. 146 Code of Obligations; evidence |
| Invoice and payment records | 10 years | Art. 253 Tax Procedure Law; Art. 82 Commercial Code |
| Identity document images | at most 90 days after review | Art. 4 KVKK (purpose limitation) |
| Verification result (date, method, result) | with the account record | legitimate interest; Law 5651 |
| Traffic data (Law 5651) | the period set in the regulation (at least 1 year, at most 2 years) | Art. 5/3 Law 5651 |
| Session and security logs | 1 year | legitimate interest |
| Support tickets | 3 years after account closure | protection of rights |
| Commercial message consent records | 3 years after consent ends | Art. 13 Commercial Communications Regulation |
| Deleted server disks and snapshots | deleted with the deletion action (not recoverable) | contract |
When a period expires the data is deleted or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
7. Data on your servers
- dor.net does not access the content of your dedicated or cloud servers and does not scan, analyse or profile it.
- Access takes place only (a) at your express request for support, (b) under a court or competent authority order, (c) where technically necessary to protect network security (for example during an ongoing attack), and in the narrowest possible scope; every such action is logged.
- For personal data you process on your servers you are the controller and dor.net is the processor. Your data is kept in the data centre in Türkiye.
- When a service ends, the data is irreversibly deleted; taking backups is your responsibility.
8. Security
Under Article 12 KVKK dor.net applies the following measures: TLS-encrypted communication; passwords stored as one-way hashes; two-factor authentication; role-based access; logging of staff access; network segmentation; firewall and DDoS protection; physical access control at the data centre; secure wiping of dedicated server disks between customers; regular security updates. No system is completely secure; if we become aware of a data breach affecting you, we notify the Board and you as soon as possible and within 72 hours at the latest, as required by Board decisions.
9. Cookies
9.1. Cookies we use
The dor.net website and console use only cookies that are strictly necessary for the service to work. No advertising, tracking or third-party analytics cookies are used.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| Session cookie | Keeps you signed in to the console | session (deleted on sign-out) | strictly necessary |
| Two-factor cookie | Completes the TOTP step after the password is verified | 5 minutes | strictly necessary |
| Language preference | Remembers your language (TR/EN) | session | strictly necessary (functional) |
9.2. Legal basis
Under the Personal Data Protection Board's Guidelines on Cookie Practices, explicit consent is not required for cookies strictly necessary for a function the user has explicitly requested; these cookies rely on Art. 5/2-c (performance of a contract) and 5/2-f (legitimate interest) KVKK. If a non-essential cookie is ever added, this policy will be updated and the cookie will be activated only with your explicit consent through a cookie preference tool.
9.3. Managing cookies
You can delete or block cookies in your browser settings. If strictly necessary cookies are blocked you cannot sign in to the console.
10. Your rights
Under Article 11 KVKK you have the right to learn whether your data is processed, to request information, to learn the purpose and whether it is used accordingly, to know the third parties to whom it is transferred, to request rectification and erasure, to request that these actions be notified to recipients, to object to a result produced solely by automated analysis and to claim compensation for damage. The application procedure is described in the "Data subject requests" section of the KVKK privacy notice. Most account data can be viewed and corrected directly on the account page in the console.
11. Children
dor.net services are not directed at persons under 18. We close the accounts of persons we learn to be under 18 and delete their data.
12. Changes
Material changes to this policy are announced at least 30 days before they take effect, in the console and by e-mail. The current version and date are shown at the top of the page.
Company details
MGN Teknoloji A.Ş. · Fenerbahçe Mah. İğrip Sk. No: 13 İç Kapı No: 1, Kadıköy/İstanbul, Türkiye · Göztepe Tax Office / 6201650498 · MERSİS 0620165049800001 · KEP mgnteknolojianonim@hs06.kep.tr · kvkk@dor.net · legal@dor.net