Data Protection Notice

01Data controller

Under KVKK (Türkiye’s Personal Data Protection Law No. 6698), the data controller is Rightyon Yazılım Teknoloji A.Ş. (“Sayiyo”). Address: Cumhuriyet Mah. Şişecam Yolu Sk. ARGE 11 No:52 İç Kapı No:12, 41400 Gebze / Kocaeli, Türkiye. Email: info@sayiyo.com.

This notice is provided under Article 10 of the KVKK to people who visit the sayiyo.com website, fill in our forms or use our live chat.

02Personal data processed

• Forms (demo, contact, newsletter and resource requests): full name, email, phone, company name, company size and number of stores, topic and message content, your consent choices; as well as the page the form was sent from, language, campaign (UTM) parameters where present, the ad click identifier (gclid, fbclid) if you have consented to marketing cookies, and the country derived from your IP address.
• Security and technical data: IP address, browser and device information, request logs (for hosting the site, preventing abuse and the Cloudflare Turnstile bot check on form submission).
• Live chat: if you start the live chat yourself, message content, contact details you share, session identifiers and browser/device information.
• Cookies (only with your consent): pages visited, on-site interactions such as clicks and scrolling, session replay (excluding what you type into forms), ad click identifiers, online identifiers and browser/device information.

Sayiyo PEOPLE devices use an AI camera; images are processed only on the device, are never recorded or stored, and no person recognition is performed. Visitors are not individually identified; only anonymous, aggregate entry counts are produced. Sayiyo PASS devices use radar technology to produce only movement, direction and count data; no images are collected.

03Method of collection

Your personal data is collected electronically, partly by automated means, through the forms and live chat window on our website, when you contact us by email, phone or WhatsApp, and through the technical tools used during your visit.

04Purposes of processing

Receiving and responding to your demo, quote, information and resource requests; responding to your live chat requests; carrying out contract processes; sending commercial electronic messages (newsletter) where you have given explicit consent, and, with your consent, analysing how the site is used and measuring the results of our ads; hosting the website, ensuring information security and preventing abuse (spam, bots); fulfilling legal obligations.

05Legal grounds

KVKK art. 5/2 (c) processing being directly related to the establishment or performance of a contract (your demo, quote and support requests), (ç) compliance with a legal obligation of the data controller, (f) the legitimate interest of the data controller, provided that it does not harm your fundamental rights and freedoms (site security, bot protection, keeping records of requests), and art. 5/1 explicit consent (sending commercial electronic messages; analytics and marketing cookies).

06Service providers and transfers

Your personal data may be transferred to the following providers from whom we receive services, limited solely to the purposes above and with the necessary security measures in place:

• Cloudflare, Inc. — The server application that receives website forms (forms.sayiyo.com, a Cloudflare Worker) and the Cloudflare Turnstile bot check on form submission. Data processed: form content, IP address, browser/device signals.
• Twilio SendGrid (Twilio Inc.) — Delivering form content to Sayiyo as a notification email. Data processed: form content.
• Google — Storing form records in a Google Sheets spreadsheet (form content), hosting the website on Firebase Hosting (IP address, browser information, request logs) and, only with your cookie consent, Google Analytics 4, Google Ads and Google Tag Manager (visit and interaction data, online identifiers, browser/device information).
• Meta Platforms Ireland Ltd. — Ad measurement with the Meta Pixel, only if you consent to marketing cookies. Data processed: pages visited, the form submission event, online identifiers, IP address, browser/device information.
• Microsoft (Microsoft Corporation) — Heatmaps and session replay with Microsoft Clarity, only if you consent to analytics cookies; what you type into forms is not recorded. Data processed: page interactions (clicks, scrolling, mouse movement), online identifiers, IP address, browser/device information.
• Crisp IM SAS — Live chat; used only when you start the live chat by clicking the chat bubble. Data processed: message content, contact details you share, IP address, browser/device information, session identifiers.

Some of these providers may process data on servers outside Türkiye. Transfers abroad are carried out within the framework of Article 9 of the KVKK; for transfers through analytics and marketing cookies (Google, Meta, Microsoft), the explicit consent you give in your cookie preferences applies, and you can withdraw it at any time.

If you write to us via WhatsApp, the conversation takes place on WhatsApp (Meta) infrastructure and is subject to that service’s own terms. Your personal data may also be shared with authorized public institutions where required under our legal obligations.

07Retention period

Form requests are retained for a maximum of 2 years. Other personal data is retained for as long as the purpose of processing requires and for the retention periods set out in the applicable legislation; at the end of that period it is deleted, destroyed or anonymized.

08Your rights

Under Article 11 of the KVKK, you may apply to the data controller to exercise the following rights:

• to learn whether your personal data is being processed;
• to request information about the processing if your personal data has been processed;
• to learn the purpose of the processing and whether your data is used in line with that purpose;
• to know the third parties in Türkiye or abroad to whom your personal data is transferred;
• to request the correction of your personal data if it is incomplete or inaccurately processed;
• to request the deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
• to request that the correction, deletion or destruction be notified to the third parties to whom your personal data has been transferred;
• to object to a result to your detriment arising from the analysis of the processed data exclusively through automated systems;
• to claim compensation for damages if you suffer loss due to the unlawful processing of your personal data.

You may submit your requests in writing to the postal address above or to info@sayiyo.com. Requests are concluded free of charge as soon as possible and within 30 days at the latest, depending on their nature; if the action requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.