Cookie Policy

Data Controller

Within the scope of this document, your personal data is processed as the data controller under the Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and the European Union General Data Protection Regulation (GDPR) by the following organisation:

• Data Controller: VisiBack Official
• E-mail: support@visiback.com
• Web: visiback.com

What Is a Cookie?

Cookies are small text files placed on your browser when you visit our website. Cookies are used to make the site work, to remember your preferences and, subject to your consent, to measure usage statistics.

Cookie Categories We Use

• Necessary cookies: Required for the core functions of the site (session, security, balancing); they cannot be disabled. Legal basis: legitimate interest.
• Functional cookies: Remember your preferences such as language and theme. Legal basis: explicit consent.
• Analytics cookies: Measure visitor interaction in an anonymous/aggregated manner. Legal basis: explicit consent.
• Marketing cookies: May be used for interest-based content/measurement. Legal basis: explicit consent.

Managing Your Cookie Preferences

On your first visit you can set your cookie preferences and accept or reject non-necessary cookies. You can update your preferences at any time via the Cookie Settings link on the site. When the revision of our cookie policy changes, your consent is requested again. You can also delete or block cookies from your browser settings.

Retention of Cookie Data

Cookie consent records (accept/reject status, relevant policy version, IP and User-Agent) are retained for evidentiary purposes. The cookies themselves remain on your device until the end of the session or for defined periods, depending on their type.

Data Sharing, Transfer and Isolation

None of the collected data is shared, rented or sold to third parties for marketing, advertising or profit. Your data is transferred only in the following cases and only to the extent necessary:

• Where there is a lawful and duly-made request from legally authorised public authorities, courts, or judicial/administrative bodies, solely within the scope of the relevant legal obligation;
• With infrastructure providers that are technically required to deliver the service and act solely as data processors (hosting, e-mail delivery, object storage, etc.), under contractual confidentiality and data-security obligations.

Per-company isolation: All collected data is processed strictly within the scope of the company (tenant) it belongs to. Data of different companies is logically isolated from one another; no company's data is shown to or shared with any other company. Data is used only for analytics and for product/service improvement, within the scope of the company concerned.

Data Security Measures

Appropriate administrative and technical measures are taken to protect your data against unlawful access, loss, disclosure or alteration:

• TLS encryption in transit and storage encryption for sensitive fields;
• Role- and permission-based access control (RBAC) with the least-privilege (need-to-know) principle;
• Audit logging of critical operations for accountability;
• Per-company logical isolation and access gates;
• Regular security reviews, secure backups and access logging.

Retention Period and Erasure

Your personal data is retained for as long as necessary for the purposes for which it is processed and for the mandatory retention periods prescribed by applicable law. When the purpose ceases to exist or the retention period expires, your data is deleted, destroyed or anonymised in accordance with the KVKK and applicable law. Consent records that constitute legal evidence (including technical information such as IP, User-Agent and timestamp) are retained for the duration of the burden-of-proof and statutory limitation periods.

Rights of the Data Subject (KVKK art. 11 / GDPR)

Under Article 11 of the KVKK and the GDPR (access, rectification, erasure, objection to processing, portability), as a data subject you have the following rights:

• To learn whether your personal data is being processed and, if so, to request information about it;
• To learn the purpose of processing and whether the data is used in accordance with that purpose;
• To know the third parties to whom your data is transferred, domestically or abroad;
• To request rectification of incomplete or inaccurately processed data;
• To request erasure or destruction of your data under Article 7 of the KVKK (right to be forgotten);
• To request that rectification, erasure or destruction be notified to third parties to whom the data has been transferred;
• To object to any adverse result arising solely from automated analysis of your data;
• To claim compensation for damages arising from unlawful processing;
• To additionally exercise your rights of access, data portability and objection to processing under the GDPR.

Applications and Contact

To exercise the rights above or to submit requests regarding your personal data, you may contact support@visiback.com. For suspected personal-data breaches, complaints or objections, you may also apply through the Breach Notification Form available on our website. Your applications are handled free of charge, as soon as possible and in any case within the periods prescribed by law (a maximum of 30 days under the KVKK).

Notification of Changes

This text may be revised in line with changes in legislation or updates to our services. The current version is always published at visiback.com; material changes are announced through appropriate channels (in-app notification or e-mail) and, where necessary, your renewed consent is requested.

Governing Law

This text is governed by the laws of the Republic of Türkiye and is interpreted primarily in accordance with Law No. 6698 (KVKK) and related secondary legislation. For data subjects located in the European Union, the provisions of the GDPR also apply. The Istanbul (Çağlayan) Courts and Enforcement Offices have jurisdiction over any disputes arising from the application of this text.