Privacy Policy
How personal data and customer data are processed, protected and retained across the website and the Axon platform.
Version: 3.0 (Taslak)Last updated: 29 September 2026
This document is a draft. Fields in square brackets (address, registry/MERSIS and VERBIS details, retention periods, transfer mechanisms) must be completed and counsel must approve before it goes live.
1. Data controller and scope
Synapse Soft Yazılım Teknolojileri ("Synapse Soft"). [Address, trade registry/MERSIS number and VERBIS registration to be entered before launch]
We are the data controller under Turkish Law No. 6698 (KVKK) and the GDPR for website visitors and people who submit request forms. For B2B SaaS and on-premise solutions (e.g. Axon) we act as data processor for our customers' operational, validation and personnel data, under the Data Processing Agreement (DPA) signed with the customer.
2. Categories of personal data
- Identity and corporate contact details (name, work email, company, role)
- Demo requests, project summaries and technical requirements (message content, deployment preference)
- Technical security data (IP address, browser type, operating system, request timestamps)
- Axon platform audit records (customer data; sealed with SHA-256 and under the customer's control)
3. Ownership of customer data
Customer data belongs to the customer. Synapse Soft does not sell, lease or commercially transfer customer data to third parties, and does not use it to train AI models or feed public algorithms. [This commitment is to be verified by counsel against the contract and the technical architecture]
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering requests and demo enquiries, scheduling calls | Pre-contractual steps (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)) |
| Keeping internet access and traffic logs | Legal obligation (Law No. 5651, GDPR Art. 6(1)(c)) |
| Improving service quality, preventing cyber threats and abuse | Legitimate interest (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)) |
| Analytics and measurement (currently off) | Explicit consent (KVKK Art. 5/1, GDPR Art. 6(1)(a)) |
5. Security measures
The following technical and organizational measures protect your data:
- TLS 1.3 encryption in transit
- AES-256 encryption at rest
- Role-based access control (RBAC) and two-factor authentication
- Web application firewall (WAF) and regular penetration tests
- Tamper-evident audit trail
- Confidentiality agreements for employees
6. Transfers
Personal data may be shared with technology partners providing cloud infrastructure and email services, on ISO 27001 and SOC 2 Type II compliant secure servers in the EU (Frankfurt) or Turkey. Information may be disclosed to competent administrative and judicial authorities on a valid legal request. [The provider list and the international-transfer mechanism (KVKK Art. 9, GDPR SCCs) will be finalized before launch]
7. Retention
Data is retained only for the 10-year limitation periods under the Turkish Commercial Code, Code of Obligations and Tax Procedure Law, then securely deleted or anonymized. [A separate retention period for request-form data will be defined]
9. Your rights
Under KVKK Art. 11 and GDPR Arts. 15–22 you have the right to access, rectify, erase, restrict processing of, port and object to processing of your data. Requests are answered within 30 days at most.
10. Changes
When this policy is updated its version number and date change. Significant changes are announced on the site.
Contact channels
- Privacy
- privacy@synapsesoft.studio
- General
- info@synapsesoft.org