Privacy Notice for Suppliers, Service Providers, Consultants
Last update: Sep 14, 2026
Last update: Sep 14, 2026
As Hipposoft Yazılım Ltd. Şti. (“Hipposoft” or the “Company”), we attach great importance to the processing and protection of the personal data of our suppliers, service providers and consultants with whom we have a business relationship, in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”).
This Information Notice has been prepared by our Company in its capacity as data controller pursuant to Article 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfillment of the Obligation to Inform. Your personal data are processed in accordance with the principles set out in Article 4 of the KVKK, including lawfulness and fairness, accuracy and being up to date where necessary, processing for specified, explicit and legitimate purposes, being relevant, limited and proportionate to the purposes for which they are processed, and retention for the period required by the relevant legislation or the purpose of processing.
1. Scope
This notice covers our individual suppliers, service providers and consultants, as well as the authorized persons, employees and representatives of our corporate suppliers and service providers (collectively, “you”).
2. Categories of Personal Data Processed
As Hipposoft Yazılım Ltd. Şti. (“Hipposoft” or the “Company”), we attach great importance to the processing and protection of the personal data of our suppliers, service providers and consultants with whom we have a business relationship, in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”).
This Information Notice has been prepared by our Company in its capacity as data controller pursuant to Article 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfillment of the Obligation to Inform. Your personal data are processed in accordance with the principles set out in Article 4 of the KVKK, including lawfulness and fairness, accuracy and being up to date where necessary, processing for specified, explicit and legitimate purposes, being relevant, limited and proportionate to the purposes for which they are processed, and retention for the period required by the relevant legislation or the purpose of processing.
1. Scope
This notice covers our individual suppliers, service providers and consultants, as well as the authorized persons, employees and representatives of our corporate suppliers and service providers (collectively, “you”).
2. Categories of Personal Data Processed
Data category
Personal data
Identity
Name, surname; Turkish national ID number for individual suppliers and where required by contract or invoicing; signature.
Contact
Email address, phone and mobile phone number, business address, residence address for individual suppliers, KEP address.
Professional Information
Title and position, employer, area of expertise for consultants, CV and references.
Finance
Tax office and tax number, bank account/IBAN details, invoice and e-invoice information, service fee, payment date and method.
Legal Transaction
Contracts, protocols, proposals, formal notices, notifications and correspondence, legal process documents.
Transaction Security
User account, access and transaction (log) records, IP address for suppliers granted system access.
Data category
Personal data
Identity
Name, surname; Turkish national ID number for individual suppliers and where required by contract or invoicing; signature.
Contact
Email address, phone and mobile phone number, business address, residence address for individual suppliers, KEP address.
Professional Information
Title and position, employer, area of expertise for consultants, CV and references.
Finance
Tax office and tax number, bank account/IBAN details, invoice and e-invoice information, service fee, payment date and method.
Legal Transaction
Contracts, protocols, proposals, formal notices, notifications and correspondence, legal process documents.
Transaction Security
User account, access and transaction (log) records, IP address for suppliers granted system access.
Our Company does not request special categories of personal data from you within the scope of the supplier relationship.
3. Purposes and Legal Grounds for Processing Personal Data
Our Company does not request special categories of personal data from you within the scope of the supplier relationship.
3. Purposes and Legal Grounds for Processing Personal Data
Data category
Identity
Personal data
Name, surname; Turkish national ID number for individual suppliers and where required by contract or invoicing; signature.
Data category
Contact
Personal data
Email address, phone and mobile phone number, business address, residence address for individual suppliers, KEP address.
Data category
Professional Information
Personal data
Title and position, employer, area of expertise for consultants, CV and references.
Data category
Finance
Personal data
Tax office and tax number, bank account/IBAN details, invoice and e-invoice information, service fee, payment date and method.
Data category
Legal Transaction
Personal data
Contracts, protocols, proposals, formal notices, notifications and correspondence, legal process documents.
Data category
Transaction Security
Personal data
User account, access and transaction (log) records, IP address for suppliers granted system access.
Purpose of processing
Supplier selection, receiving and evaluating proposals
Data categories
Identity, Contact, Professional Information
Legal ground
Establishment of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)
Purpose of processing
Establishing and performing contracts, managing procurement processes
Data categories
Identity, Contact, Professional Information, Legal Transaction
Legal ground
Establishment or performance of a contract (Art. 5/2-c)
Purpose of processing
Making payments, processing invoices, maintaining accounting and current account records
Data categories
Identity, Contact, Finance
Legal ground
Performance of a contract (Art. 5/2-c); expressly provided for by law and legal obligation (Art. 5/2-a and ç) – Tax Procedure Law, Turkish Commercial Code
Purpose of processing
Maintaining communication, tracking requests and complaints, document exchange
Data categories
Identity, Contact
Legal ground
Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)
Purpose of processing
Ensuring information security and managing access to Company systems
Data categories
Transaction Security
Legal ground
Compliance with a legal obligation (Art. 5/2-ç); legitimate interest (Art. 5/2-f)
Purpose of processing
Responding to requests from authorized public institutions and ensuring regulatory compliance
Data categories
All relevant categories
Legal ground
Expressly provided for by law (Art. 5/2-a); compliance with a legal obligation (Art. 5/2-c)
Purpose of processing
Managing legal disputes, establishing, exercising and protecting rights
Data categories
Identity, Contact, Finance, Legal Transaction
Legal ground
Establishment, exercise or protection of a right (Art. 5/2-e)
Purpose of processing
Data categories
Legal ground
Supplier selection, receiving and evaluating proposals
Identity, Contact, Professional Information
Establishment of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)
Establishing and performing contracts, managing procurement processes
Identity, Contact, Professional Information, Legal Transaction
Establishment or performance of a contract (Art. 5/2-c)
Making payments, processing invoices, maintaining accounting and current account records
Identity, Contact, Finance
Performance of a contract (Art. 5/2-c); expressly provided for by law and legal obligation (Art. 5/2-a and ç) – Tax Procedure Law, Turkish Commercial Code
Maintaining communication, tracking requests and complaints, document exchange
Identity, Contact
Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)
Ensuring information security and managing access to Company systems
Transaction Security
Compliance with a legal obligation (Art. 5/2-ç); legitimate interest (Art. 5/2-f)
Responding to requests from authorized public institutions and ensuring regulatory compliance
All relevant categories
Expressly provided for by law (Art. 5/2-a); compliance with a legal obligation (Art. 5/2-c)
Managing legal disputes, establishing, exercising and protecting rights
Identity, Contact, Finance, Legal Transaction
Establishment, exercise or protection of a right (Art. 5/2-e)
Purpose of processing
Data categories
Legal ground
Supplier selection, receiving and evaluating proposals
Identity, Contact, Professional Information
Establishment of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)
Establishing and performing contracts, managing procurement processes
Identity, Contact, Professional Information, Legal Transaction
Establishment or performance of a contract (Art. 5/2-c)
Making payments, processing invoices, maintaining accounting and current account records
Identity, Contact, Finance
Performance of a contract (Art. 5/2-c); expressly provided for by law and legal obligation (Art. 5/2-a and ç) – Tax Procedure Law, Turkish Commercial Code
Maintaining communication, tracking requests and complaints, document exchange
Identity, Contact
Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)
Ensuring information security and managing access to Company systems
Transaction Security
Compliance with a legal obligation (Art. 5/2-ç); legitimate interest (Art. 5/2-f)
Responding to requests from authorized public institutions and ensuring regulatory compliance
All relevant categories
Expressly provided for by law (Art. 5/2-a); compliance with a legal obligation (Art. 5/2-c)
Managing legal disputes, establishing, exercising and protecting rights
Identity, Contact, Finance, Legal Transaction
Establishment, exercise or protection of a right (Art. 5/2-e)
Service provider
Microsoft 365
Service and purpose of transfer
Corporate email, correspondence and document management
Data categories
Identity, Contact, Professional Information, Finance, Legal Transaction
Service provider
Microsoft Azure
Service and purpose of transfer
Hosting and backup of Company systems and records
Data categories
Identity, Contact, Finance, Transaction Security
4. Method of Collecting Personal Data
Your personal data are collected through e-mail, Registered Electronic Mail (KEP), telephone and meetings; offer and contract documents; invoices and the e-invoice system; business cards; documents delivered by post and courier; and legal documents transmitted through UYAP and formal notification procedures, by fully or partially automated means or by non-automated means provided that they form part of a data filing system. The collection is carried out on the legal grounds specified for each purpose in Section 3.
5. Transfer of Personal Data
5.1. Domestic Transfers
• Suppliers and business partners: certified public accounting and accounting service providers, banks and payment institutions, e-invoice integrators, legal advisers and independent auditors, for the purposes of carrying out payment, accounting and legal processes.
• Authorized public institutions and organizations and judicial authorities: within the scope of our statutory obligations and where requested.
5.2. Cross-Border Transfers
4. Method of Collecting Personal Data
Your personal data are collected through e-mail, Registered Electronic Mail (KEP), telephone and meetings; offer and contract documents; invoices and the e-invoice system; business cards; documents delivered by post and courier; and legal documents transmitted through UYAP and formal notification procedures, by fully or partially automated means or by non-automated means provided that they form part of a data filing system. The collection is carried out on the legal grounds specified for each purpose in Section 3.
5. Transfer of Personal Data
5.1. Domestic Transfers
• Suppliers and business partners: certified public accounting and accounting service providers, banks and payment institutions, e-invoice integrators, legal advisers and independent auditors, for the purposes of carrying out payment, accounting and legal processes.
• Authorized public institutions and organizations and judicial authorities: within the scope of our statutory obligations and where requested.
5.2. Cross-Border Transfers
Service provider
Service and purpose of transfer
Data categories
Microsoft 365
Corporate email, correspondence and document management
Identity, Contact, Professional Information, Finance, Legal Transaction
Microsoft Azure
Hosting and backup of Company systems and records
Identity, Contact, Finance, Transaction Security
Service provider
Service and purpose of transfer
Data categories
Microsoft 365
Corporate email, correspondence and document management
Identity, Contact, Professional Information, Finance, Legal Transaction
Microsoft Azure
Hosting and backup of Company systems and records
Identity, Contact, Finance, Transaction Security
Cross-border transfers are carried out pursuant to Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, based on an adequacy decision concerning the country, international organization or sector to which the transfer will be made, where such a decision exists, or, where no such decision exists, on one of the appropriate safeguards listed in Article 9/4 of the KVKK, in particular the standard contracts published by the Personal Data Protection Board. In incidental cases where there is no adequacy decision and none of the appropriate safeguards can be provided, the transfer is made on the basis of your separately obtained explicit consent (KVKK Art. 9/6-a), provided that you have been informed of the potential risks.
6. Retention Period for Personal Data
Your personal data are retained for the period necessary for the purposes for which they are processed and for the retention periods prescribed by the applicable legislation. In this context, for example, invoice and accounting records are retained for the periods prescribed by the Tax Procedure Law and the Turkish Commercial Code, while contract-related records are retained for the limitation periods applicable to potential disputes following termination of the contract. Processing based on your explicit consent is discontinued if you withdraw your consent. Data whose retention period has expired are deleted, destroyed or anonymized in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.
7. Your Rights under the KVKK
Pursuant to Article 11 of the KVKK, by applying to our Company, you have the right to:
a) learn whether your personal data are being processed,
b) request information if your personal data have been processed,
c) learn the purpose of processing your personal data and whether they are used in accordance with that purpose,
ç) know the third parties to whom your personal data are transferred in Türkiye or abroad,
d) request correction of your personal data if they have been processed incompletely or inaccurately,
e) request the deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
f) request that the actions taken pursuant to items (d) and (e) be notified to third parties to whom your personal data have been transferred,
g) object to any outcome against you resulting from the analysis of processed data exclusively by automated systems,
ğ) request compensation for damages if you suffer damage due to the unlawful processing of your personal data
as provided under the KVKK.
8. Application Procedure
You may submit requests concerning the rights listed above to our Company through any of the following methods in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
• In writing, in person or through a notary public, to our address stated in Section 9, together with documents identifying you,
• From your Registered Electronic Mail (KEP) address to [email protected],
• To [email protected], signed with a secure electronic signature or mobile signature,
• From the e-mail address that you previously notified to our Company and that is registered in our systems, to [email protected].
Your application must include your name and surname and, if the application is in writing, your signature; your Turkish Republic identification number if you are a Turkish citizen; your nationality and passport number or, if any, identification number if you are a foreign national; your residential or workplace address for service of notices; your e-mail address and telephone number for notifications, if any; and the subject of your request. Information and documents relating to your request must be attached to the application.
Following identity verification, your applications will be concluded free of charge as soon as possible and no later than thirty (30) days, depending on the nature of the request. If the process requires an additional cost, the fee specified in the tariff determined by the Personal Data Protection Board may be charged. If your application is rejected, you find the response insufficient, or no response is provided within the prescribed period, you may lodge a complaint with the Personal Data Protection Board within thirty (30) days from the date you learn of the response and, in any event, within sixty (60) days from the date of your application.
9. Contact Details of the Data Controller
Cross-border transfers are carried out pursuant to Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, based on an adequacy decision concerning the country, international organization or sector to which the transfer will be made, where such a decision exists, or, where no such decision exists, on one of the appropriate safeguards listed in Article 9/4 of the KVKK, in particular the standard contracts published by the Personal Data Protection Board. In incidental cases where there is no adequacy decision and none of the appropriate safeguards can be provided, the transfer is made on the basis of your separately obtained explicit consent (KVKK Art. 9/6-a), provided that you have been informed of the potential risks.
6. Retention Period for Personal Data
7. Your Rights under the KVKK
Pursuant to Article 11 of the KVKK, by applying to our Company, you have the right to:
a) learn whether your personal data are being processed,
b) request information if your personal data have been processed,
c) learn the purpose of processing your personal data and whether they are used in accordance with that purpose,
ç) know the third parties to whom your personal data are transferred in Türkiye or abroad,
d) request correction of your personal data if they have been processed incompletely or inaccurately,
e) request the deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
f) request that the actions taken pursuant to items (d) and (e) be notified to third parties to whom your personal data have been transferred,
g) object to any outcome against you resulting from the analysis of processed data exclusively by automated systems,
ğ) request compensation for damages if you suffer damage due to the unlawful processing of your personal data
as provided under the KVKK.
8. Application Procedure
• In writing, in person or through a notary public, to our address stated in Section 9, together with documents identifying you,
• From your Registered Electronic Mail (KEP) address to [email protected],
• To [email protected], signed with a secure electronic signature or mobile signature,
• From the e-mail address that you previously notified to our Company and that is registered in our systems, to [email protected].
Your application must include your name and surname and, if the application is in writing, your signature; your Turkish Republic identification number if you are a Turkish citizen; your nationality and passport number or, if any, identification number if you are a foreign national; your residential or workplace address for service of notices; your e-mail address and telephone number for notifications, if any; and the subject of your request. Information and documents relating to your request must be attached to the application.
Following identity verification, your applications will be concluded free of charge as soon as possible and no later than thirty (30) days, depending on the nature of the request. If the process requires an additional cost, the fee specified in the tariff determined by the Personal Data Protection Board may be charged. If your application is rejected, you find the response insufficient, or no response is provided within the prescribed period, you may lodge a complaint with the Personal Data Protection Board within thirty (30) days from the date you learn of the response and, in any event, within sixty (60) days from the date of your application.
9. Contact Details of the Data Controller
Trade name
HİPPOSOFT YAZILIM LİMİTED ŞİRKETİ
Address
AKAT MAH. HARE SK. 2 SÖLTAŞ K-10 BLOK NO: 12 BEŞİKTAŞ/ İSTANBUL
Phone
0850 288 32 30
KEP address
Website
www.hrplan.net
10. Amendments to this Notice
This notice may be updated in line with changes in the legislation and in our personal data processing activities. The current version of the notice is always published at www.hrplan.net; the “Last Updated” date at the beginning of the notice indicates the most recent amendment.
10. Amendments to this Notice
Trade name
HİPPOSOFT YAZILIM LİMİTED ŞİRKETİ
Address
AKAT MAH. HARE SK. 2 SÖLTAŞ K-10 BLOK NO: 12 BEŞİKTAŞ/ İSTANBUL
Phone
0850 288 32 30
KEP address
Website
www.hrplan.net
Trade name
HİPPOSOFT YAZILIM LİMİTED ŞİRKETİ
Address
AKAT MAH. HARE SK. 2 SÖLTAŞ K-10 BLOK NO: 12 BEŞİKTAŞ/ İSTANBUL
Phone
0850 288 32 30
KEP address
Website
www.hrplan.net