KVKK and Privacy Policy

Last updated: September 21, 2026

1. Data Controller

Your personal data may be processed by Onay360, acting as the data controller, within the scope described below in relation to the SMS verification services available at https://onay360.com.

2. Purpose of Processing Personal Data

Within the scope of our SMS verification services, your personal data is processed for the following purposes:

  • Provision of SMS verification services.
  • Creation, management, and security of user accounts.
  • Processing of payments and maintenance of financial records.
  • Management of customer relations and handling user requests.
  • Provision of technical support services.
  • Fulfillment of legal obligations.
  • Improvement of service quality and system development.

3. Categories of Processed Personal Data

Within the scope of our SMS verification services, the following categories of personal data are processed:

Identity Data

Basic user information such as name, surname, and email address.

Contact Data

Email address and information enabling communication with the user.

Customer Transaction Data

SMS verification transactions, transaction history, payment details, and invoice records.

SMS Content Data

SMS verification codes and message content (processed temporarily).

Technical Data

IP address (retained for security and fraud-prevention purposes for a maximum of 48 hours).

4. Method and Legal Basis for Collecting Personal Data

Your personal data is collected through the following methods:

  • Membership processes carried out via the website.
  • Data generated during the use of the SMS verification service.
  • Information obtained during payment and billing processes.
  • User support requests and contact forms.
  • Data obtained through cookies and similar technologies.

This data is processed in accordance with the legal grounds set out in Articles 5 and 6 of the Personal Data Protection Law No. 6698, on the basis that it is directly related to the establishment or performance of a contract for the provision of the SMS verification service and the processing of payments, that it is necessary for the fulfillment of legal obligations (tax, accounting, and the record-keeping obligation under Law No. 5651), and that Onay360 has a legitimate interest in ensuring the security of the service.

5. Transfer of Personal Data

Your personal data may be transferred to the following parties within the scope of service requirements and legal obligations:

SMS operators and communication service providers.

Payment institutions and financial service providers.

Legal authorities (courts, prosecutors, and authorized public institutions).

As a rule, your personal data is processed and stored within Türkiye. Should Onay360 begin using a service provider established abroad in the future (for example, for payment infrastructure, security verification, or notification services), any resulting transfers will be carried out with the appropriate safeguards required under Article 9 of Law No. 6698 and the relevant Board regulations, and this policy will be updated and announced to our users accordingly.

Technical infrastructure providers (hosting, security, and software services).

6. Processing of SMS Data

Within the scope of the SMS verification service:

  • SMS verification codes are processed for the purpose of carrying out the verification transaction.
  • SMS content is used solely for the purpose of carrying out the verification transaction.

SMS verification codes are retained for a reasonable period to ensure transaction security and to enable a defence against potential allegations of fraud or misuse, and are deleted at regular intervals.

SMS verification data retained during this period is not shared with third parties unless legally required.

7. Data Security

The following technical and administrative measures are implemented to ensure the security of your personal data:

  • Secure data transmission using SSL encryption technology.
  • Use of secure and up-to-date server infrastructure.
  • Regular system updates and security checks.
  • Access control, authorization, and logging mechanisms.
  • Data backup and disaster recovery systems.

8. Rights of the Data Subject

Pursuant to Article 11 of the Personal Data Protection Law No. 6698, data subjects have the following rights:

  • To learn whether their personal data is being processed.
  • To request information if their personal data has been processed.
  • To learn the purpose of processing and whether it is used in accordance with its purpose.
  • To know the third parties to whom personal data is transferred domestically or abroad.
  • To request correction of incomplete or incorrectly processed data.
  • To request deletion or destruction of personal data.
  • To object to the analysis of processed data through automated systems.
  • To request that the correction of incomplete or incorrectly processed data, or the deletion or destruction of personal data, be notified to third parties to whom the personal data has been transferred.
  • To request compensation for damages suffered due to unlawful processing of personal data.

9. Cookies

Cookies are used on our website to improve user experience and to collect statistics on site usage. For detailed information on the types of cookies used, their purposes, and how to manage your cookie preferences, please see our Cookie Policy.

10. Data Retention Periods

Your personal data is retained for the following periods:

Membership information: As long as the user account remains active.

SMS verification data: Retained for a reasonable period to ensure transaction security and to enable a defence against potential allegations of fraud or misuse, and deleted at regular intervals; during this period, it is not shared with third parties unless legally required.

Payment and invoice information: For the periods required by applicable legislation.

Technical log records: At least 1 year and at most 2 years, pursuant to Law No. 5651.

11. Contact

You can use the following contact information to exercise your rights under KVKK and submit your requests:

Email: info@onay360.com

Website: https://onay360.com

12. Policy Changes

Onay360 reserves the right to amend this privacy policy. Changes that expand the purposes or scope of personal data processing will be separately announced on the site, and users will be informed again where deemed necessary. The updated policy shall become effective as of the date it is published on the website.