This privacy notice is issued under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU General Data Protection Regulation (GDPR), by Opsida Teknoloji Yazılım Bilgisayar ve Danışmanlık Ltd. Şti., which operates the CarbonTrex platform as data controller.

This notice applies to the account, contact, transaction-security, support, billing and web-usage data that Opsida processes in its capacity as data controller. With respect to the activity, emission, report and evidence data that a corporate customer uploads to its tenant workspace, the relevant corporate customer is the data controller; Opsida processes such data solely as a data processor, on the customer's instructions and within the scope of the service agreement and the DPA.

1. Data Controller

Legal name: Opsida Teknoloji Yazılım Bilgisayar ve Danışmanlık Ltd. Şti.
Address: Adalet Mah., Manas Bulvarı, Folkart Towers B Kule, No:39, Kat:34/3408, 35530 Bayraklı/İzmir
Trade registry (MERSİS) No: 0644095195700001
Email: info@carbontrex.com

2. Categories of Personal Data Processed

Identity data: name, surname
Contact data: email address, (if provided) phone
Transaction security data: IP address, session and access logs, browser/device information
Billing data: billing address, tax details, corporate contact person and quotation/invoice records. No payment-card data is processed other than manual invoicing.
Customer transaction data: activity and emission data entered into the platform, calculation results and reports. This data is predominantly corporate in nature and is treated as personal data only insofar as it can be associated with an individual.

3. Purposes of Processing

Creating the membership record and managing the account
Providing platform services (emission calculation, reporting)
Communicating with the user and providing support
Ensuring information and platform security, preventing misuse
Fulfilling legal obligations and responding to legal claims

4. Legal Bases

Your personal data is processed on the following legal bases (KVKK Art. 5):

Art. 5/2-c — Necessity for the conclusion or performance of a contract (performance of the service agreement, account creation and management)
Art. 5/2-ç — Compliance with a legal obligation of the controller (keeping access logs, financial and legal retention)
Art. 5/2-f— Legitimate interests of the controller, provided they do not harm the data subject's fundamental rights (platform security, service improvement)
Explicit consent — For other exceptional cases such as, if any, commercial communications and the incidental cross-border transfers under KVKK Art. 9/6

Legal bases mapped by purpose:

Account and user management: KVKK Art. 5/2-c
Support and customer communication: Art. 5/2-c and Art. 5/2-f
Billing, accounting and statutory retention: Art. 5/2-ç
Security, logging and abuse prevention: Art. 5/2-f and, where applicable, Art. 5/2-ç

5. Collection Method

Your personal data is collected electronically during registration and use of the platform, through information you enter and records generated automatically by the system.

6. Transfers and International Transfers

Your data is shared with processors that provide the platform infrastructure:

Hosting and database: Supabase (infrastructure: Amazon Web Services, eu-central-1 / Frankfurt — European Union)
Application hosting: Vercel

Servers are located in the European Union. Under Article 9 of the KVKK, international transfers rely primarily on a Board adequacy decision where one exists; failing that, on appropriate safeguards under KVKK Art. 9/4 such as standard contractual clauses, binding corporate rules or an undertaking. Where standard contractual clauses are used, the Board is notified within the prescribed period. Explicit consent may be relied upon only exceptionally, in the incidental transfer cases under Art. 9/6 and provided that you are informed of the potential risks. Your data is never sold to third parties for marketing purposes.

7. Retention Periods

Account and identity/contact data: throughout membership and, thereafter, for the applicable statutory limitation periods
Access logs: for the period required by applicable legislation
Emission calculation and report data: reporting period + the period required for verification/audit

At the end of these periods your data is deleted, destroyed or anonymized in accordance with Article 7 of the KVKK.

8. Your Rights (KVKK Art. 11 / GDPR)

To learn whether your personal data is being processed
To request information if it has been processed
To learn the purpose of processing and whether it is used appropriately
To know the third parties to whom data is transferred, domestically or abroad
To request correction of incomplete or inaccurate data
To request erasure or destruction under Article 7
To request that corrections/erasures be notified to third parties
To object to results arising solely from automated analysis
To claim compensation for damages due to unlawful processing

9. How to Apply

To exercise your rights, you may submit your requests to info@carbontrex.comby e-mail, or in writing to the address stated above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Electronic applications are accepted through methods that allow verification of your identity and comply with that Communiqué. Your request is concluded, depending on its nature, as soon as possible and in any event within thirty days at the latest, free of charge (a fee per the Board's tariff may apply if the process entails additional cost).

10. Cookies

The platform uses only essential cookies (session management) and functional cookies (language preference). Usage statistics are collected through an anonymous, cookieless measurement (Vercel Analytics). For this reason the platform does not display a separate cookie consent banner.

Privacy Notice (KVKK)