International Data Transfer Notice

Scope and purpose of transfers

Some technical services, such as hosting, content delivery, notifications, app-store verification, video communication, security, artificial intelligence, or OCR, may involve a provider established abroad or remote access from abroad. A transfer is limited to data necessary to provide the feature requested by the user, operate the system securely, or comply with a legal duty.

The categories of data depend on the feature. Direct identifiers and health data must not be sent where unnecessary, and actual use of pseudonymization, masking, separation, and least-privilege controls must be operationally verified in each suitable flow. No particular provider country, data center, or permanently unchanged infrastructure is promised before it has been verified.

A regular transfer is not started until a primary mechanism such as an adequacy decision or appropriate safeguard under the KVKK has been established and operationally verified. Explicit consent does not generally cure the absence of that mechanism and may be considered separately only for a specific, occasional transfer that meets the statutory conditions.

Safeguards and user rights

• Provider selection, purpose limitation, confidentiality, access controls, incident notification, deletion or return duties, audits, and subprocessor management must be completed in a contract or data-processing addendum and operationally verified.
• Risk-proportionate encryption, authentication, logging, and data-minimization controls must be verified in the actual transfer and storage flow; absolute security is not guaranteed.
• Users may request information about recipient categories and the applicable transfer mechanism, withdraw consent where relevant, and exercise KVKK rights through [email protected].