1. Scope and identity of the controller
This Privacy Policy is also our privacy notice under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”). It applies to ayaRemote websites, accounts, software agents and related support interactions. The data controller for ayaRemote’s own account, commercial, website and security processing is ESPO BİLİŞİM, at the registered address listed below.
When a customer organization determines why and how employee, client or endpoint data is processed through ayaRemote, that organization is normally the controller and ayaRemote acts as its service provider or processor. Users should first direct organization-controlled data requests to their employer or ayaRemote account owner.
2. Data we collect
Depending on how you use ayaRemote, we may process:
- Account and organization details, such as name, business email, company, role and login information.
- Subscription, billing and transaction references. Payment card details are collected and processed by iyzico, not stored by ayaRemote.
- Device and inventory information, such as device identifiers, hardware and software inventory, agent status, health metrics, assigned user or organization and operational records.
- Remote-support and security records, such as connection readiness, session metadata, commands, alerts and audit events.
- Website, diagnostic and communication data, including IP address, browser information, logs, form submissions and support messages.
3. Purposes of processing
We use data to establish and perform user and subscription agreements; provide and secure the service; authenticate users; maintain device inventory; enable authorized support workflows; administer subscriptions; respond to requests; troubleshoot failures; keep audit records; prevent fraud and abuse; comply with tax, accounting and legal obligations; establish or defend legal claims; and improve ayaRemote.
4. Collection methods and legal bases
Data is collected electronically through account and contact forms, software agents, application interfaces, cookies or local storage, system and security logs, support communications and transaction notices received from iyzico. Where applicable, we rely on necessity to enter into or perform a contract, compliance with legal obligations, establishment or protection of a right, and our legitimate interests in operating and securing the service where those interests do not override individual rights. We request consent where the law requires consent.
Organizations using ayaRemote are responsible for selecting a lawful basis and providing notices for endpoint monitoring and employee or customer data they direct us to process.
5. Sharing and processors
We do not sell personal data. We may share limited data with service providers that support hosting, infrastructure, email delivery, security, analytics and customer support. iyzico processes payment and fraud-prevention information, while Paraşüt processes customer and invoice information required for billing and accounting. Data may also be disclosed when required by law or to protect users, the service and legal rights.
6. Transfers and recipients
Personal data may be transferred, to the extent necessary for the stated purposes, to authorized personnel, hosting and infrastructure providers, email and support providers, cybersecurity vendors, payment and invoicing providers, professional advisers and competent public authorities. We do not sell personal data.
Some providers may process data outside Türkiye or your country. Where required, transfers are based on an adequacy decision, an approved standard contract or another safeguard or statutory exception recognized under applicable law, including KVKK Article 9.
7. Retention
We retain personal data for as long as necessary to provide the service, maintain security and audit records, resolve disputes and meet legal, accounting or contractual obligations. Retention periods vary by data type and account status. Data is deleted or anonymized when no longer required, subject to backup and legal-retention cycles.
8. Security
We use reasonable technical and organizational safeguards designed to protect data. No online system can guarantee absolute security. Customers must configure roles appropriately, protect credentials and use remote-access features only on authorized devices.
9. Your privacy rights
Subject to applicable law, you may ask whether your data is processed; request information about processing; learn the purpose and whether data is used accordingly; learn the recipients in Türkiye or abroad; request correction of incomplete or inaccurate data and notification to recipients; request deletion or destruction when legal conditions are met and notification to recipients; object to a result arising exclusively from automated analysis that is adverse to you; and claim compensation where unlawful processing causes damage. Other jurisdictions may also provide rights to restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority.
Send a signed written request to our registered address or email info@ayaremote.com from an address that allows us to verify your identity. State your name, contact details, relationship with ayaRemote, the right exercised and sufficient detail to locate the data. We respond as soon as possible and no later than thirty days where KVKK applies, normally without charge unless the request creates a legally chargeable cost.
10. Cookies and local storage
Our website and application may use essential cookies or local storage for authentication, security, language and session continuity. Optional analytics or marketing technologies, if introduced, will be handled in accordance with applicable consent requirements.
11. Children
ayaRemote is a business software service and is not directed to children. We do not knowingly collect personal data from children through direct account registration.
12. Complaints and updates
If you are dissatisfied with our response, you may complain to the Turkish Personal Data Protection Authority or the competent supervisory authority in your country, subject to applicable procedures. We may update this policy as the service or legal requirements change. The effective date above identifies the current version.