PIYZI KVKK DATA PROTECTION NOTICE
This is a courtesy translation provided for convenience. In case of any discrepancy, the Turkish version of this document prevails.
KVKK (Law No. 6698 on the Protection of Personal Data) is Turkey's comprehensive data protection legislation, equivalent to the EU's GDPR.
1. Data Controller
Piyzi Technology Inc. (Piyzi Teknoloji A.S.) Address: GOSB Teknopark (Gebze Technology Park), Kemal Nehrozoglu Cad. 41480 Gebze, Kocaeli, Turkey Email: hi@piyzi.com
2. Personal Data We Process
- Identity information
- Contact details
- Appointment records
- Technical usage data
- Security data: IP address, session and log records, a device signature derived from your device's technical characteristics, and a device identifier stored in your browser (see 4.1)
- Ad application data: your answers on our ad application form (business type, team size, main priority), your business or brand name if given, the source of the ad you came from (UTM tags, ad click ID) and Meta cookie identifiers (
_fbp,_fbc) (see 4.2) - Acquisition source: how you reached Piyzi — link tags (UTM), ad click IDs, only the domain name of the referring site, the first page you opened and the date; your answer to "Where did you hear about Piyzi?" at sign-up and, if given, the name of the person or creator who referred you (see 4.3)
3. Purposes of Data Processing
- Providing our services
- Managing appointments and communications
- Fulfilling legal obligations
- Operating the in-app AI help assistant, measuring answer quality and improving help content (questions and answers are stored; phone numbers and e-mail addresses are automatically masked before storage)
- Producing a fast first reply to your support requests: the message text and any screenshots you attach are sent to our AI service provider (OpenAI) for evaluation
- Detecting multiple accounts that may belong to the same person, and protecting the platform against misuse (see 4.1)
- Recording ad applications, contacting you for a free demo and measuring the results of our ad campaigns (see 4.2)
- Measuring which promotion channel (ads, search engines, referrals, our sales team, etc.) brought you to Piyzi and the sign-up and subscription results of these channels, and reporting sign-ups and first subscription payments to Meta (see 4.3)
4. Legal Basis
Under KVKK Articles 5 and 6 (Kanun madde 5 ve 6):
- Performance of a contract (Sozlesmenin ifasi)
- Legal obligations (Yasal yukumlulukler)
- Legitimate interests (Mesru menfaat)
- Your consent (Onay / Acik riza) — e.g. analytics cookies (including storing your acquisition source in your browser, see 4.3), commercial electronic messages and ad measurement on our ad application pages (see 4.2)
4.1. Device Signature and Multiple-Account Detection
To keep accounts secure and protect the platform against misuse, we process certain technical characteristics of your device when you register for or sign in to the business panel: screen dimensions, operating system and browser family, language and time zone, processor and memory class, and the drawing behaviour of your graphics unit. We also store a random device identifier in your browser that only Piyzi can read.
These values are not stored individually. They are irreversibly hashed into a device signature used solely to compare one record with another; raw values are not kept in our database.
For this processing activity:
- No decision is made solely by automated means. The system only surfaces possible links. No decision that would close or restrict your account, or otherwise affect your rights, is taken automatically; a Piyzi employee always makes the assessment.
- It is never used for advertising or marketing, never shared with third parties and never sold.
- It is not transferred abroad. The device signature is generated and stored on Piyzi's own infrastructure; no data is sent to any external provider for this purpose.
- It applies only to business accounts. No such processing takes place on the online booking pages you use as a customer of a business.
See section 7 regarding your right to object to this processing.
4.2. Ad Application Pages
On the application pages you reach from our Instagram and Facebook ads (piyzi.com/quiz/...), your personal data is processed as follows:
- Application record: Your answers, name, phone number and, if given, your business name are written to our application records so that we can contact you. New applications made with the same phone number within 30 days are added to the existing record instead of creating a new one.
- Consent to commercial electronic messages: By submitting the form you accept, as stated on the page, to be informed about Piyzi's campaigns and news by SMS and phone. You can withdraw this consent free of charge at any time by writing to hi@piyzi.com or through the Message Management System (IYS).
- Ad measurement (Meta Pixel): Meta Pixel by Meta Platforms Ireland Ltd. loads on your first interaction with the page. It reports to Meta that the page was opened, which steps were completed and that the application was submitted, together with the codes of the answers you chose; these reports do not contain your name or phone number. The cookies used are listed in the Cookie Policy.
- Application report (Meta Conversions API): After your application is recorded, our server sends an "application" report to Meta so that the application can be matched to the ad it came from and is not counted twice. In this report, your phone number, first name, last name, country and application number are sent hashed with SHA-256, as Meta requires; your IP address, browser information and Meta cookie identifiers are sent as they are. The report also includes the codes of the answers you chose; your business name is not sent to Meta.
- Meta uses this data for ad measurement under its own terms. As Meta's servers are located abroad, this processing involves a transfer abroad (see section 5).
If you do not want this measurement, you can stop using the page or block cookies in your browser. You can ask for your application record to be deleted at any time at hi@piyzi.com.
4.3. Acquisition Source and Reports to Meta
To measure which channel brought you to Piyzi:
- Acquisition source: If you consented to analytics cookies on piyzi.com, the source of your first and last visit to the site is stored in your browser for up to 90 days from your last visit (see the Cookie Policy). Without consent nothing is stored; only the source of your current visit (the tags in the page link and the name of the referring site) is added to the sign-up link and to the form you send. When you sign up, this information is saved to your account together with your answer to "Where did you hear about Piyzi?".
- Matching with applications: If you previously filled in an ad application, demo or contact form, your application is matched to your account through your phone number.
- Our sales team: Your new business registration, together with its acquisition source and your "where did you hear" answer, is transferred to our own customer relationship management (CRM) system used by our sales team.
- Reports to Meta (Meta Conversions API): To measure the results of our Meta ads, our server sends a report to Meta when your sign-up is completed and on your first subscription payment. Your phone number, country and account number are sent hashed with SHA-256, as Meta requires. If you came to the site from a Meta ad, the ad click ID is added; if the action took place in the web panel, your IP address and browser information are added as they are. The payment report includes the amount, currency and plan name. Your name and e-mail address are not sent. Meta uses this data for ad measurement under its own terms; as Meta's servers are located abroad, this processing involves a transfer abroad (see section 5).
For your right to object to this processing, see section 7.
5. Data Transfers
Piyzi does not sell your personal data. Data is shared only to the extent necessary to deliver the service — with infrastructure/hosting providers, messaging (SMS, e-mail, WhatsApp Business) providers and licensed payment institutions, and with Meta Platforms Ireland Ltd. for ad measurement (on our ad application pages, see 4.2, and for sign-up and first subscription payment reports, see 4.3) — and with competent authorities where required by law. Where a provider's servers are located abroad, transfers are carried out in accordance with Article 9 of the KVKK.
6. Data Retention
Data is retained for the duration of the service. When an account is closed, data is deleted or anonymized.
Specific periods apply to security data: your IP address is kept in readable form for at most 90 days, after which it is irreversibly hashed and can only be used for comparison. Device signatures and session records are kept for at most 1 year.
7. Your Rights as a Data Subject
Under KVKK Article 11 (Kanun madde 11), you have the right to:
- Request information about your data
- Request corrections
- Request deletion
- Object to processing