KVKK Privacy Notice — Performance Intelligence Users and Authorized Persons

Effective date: 17 August 2026

This notice is prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) for natural persons who own a Performance Intelligence customer account or act as its authorized user, administrator, analyst or viewer, and for those who contact Dreavion Technology in connection with the service.

Lead and form data belonging to third parties, collected by our customers through their own websites, forms or other channels, is not the main scope of this notice. For those individuals the data controller may, depending on the specific processing activity, be the customer, and that customer is responsible for its own disclosure obligation.

1.1. Data controller

Official data controller name: Dreavion Teknoloji Sanayi ve Ticaret Limited Şirketi. Istanbul Trade Registry Office, registry no 1154612. MERSİS no 0313155054000001. Zincirlikuyu Tax Office, tax identification no 3131550540.
Address: Emniyet Evleri Mah. Eski Büyükdere Cad. Sapphire No: 1/1, İç Kapı No: 1B04, Kağıthane / İstanbul.
Email: info@dreaviontechnology.com

1.2. Categories of personal data processed

Depending on the processing activity, the following data may be processed:

Identity and contact: name and surname, email address and, where applicable, business contact details,
Customer and account activity: the customer account you belong to, user role, membership and authorization details, invitation records,
Transaction security: session information, technical connection data including IP address, error and security logs, synchronisation and access logs,
Integration activity: the platform the user connected, the account, property or ad account selected, and the connection status,
Performance and usage data: performance data tied to the workspace the user authorized, and information related to report usage,
Notifications and communication: support requests, notification preferences and delivery-related transaction details.

1.3. Purposes of processing and legal grounds

The processing activities below rest on the relevant KVKK processing condition, according to the nature of the specific relationship:

A. Operating the account and service relationship

Purpose: creating the Performance Intelligence account, managing user permissions, providing the service and running the features the customer has requested.
Legal ground: where the data subject is a party to the contract, necessity for the establishment or performance of that contract; where the matter concerns managing the authorized users of a corporate customer, the legitimate interest of Dreavion Technology in providing the service securely and reliably, provided this does not harm fundamental rights and freedoms.

B. Security, abuse prevention and system integrity

Purpose: preventing unauthorised access, abuse and security incidents, investigating incidents, and maintaining the security and continuity of the platform.
Legal ground: the legitimate interest of the data controller, provided this does not harm fundamental rights and freedoms; and, where applicable in the specific case, compliance with a legal obligation.

C. Legal and administrative obligations

Purpose: meeting statutory obligations, responding to requests from competent authorities and keeping legal records.
Legal ground: necessity for the data controller to fulfil a legal obligation, and/or express provision in law.

D. Establishment, exercise or protection of rights

Purpose: managing disputes, legal claims and defences.
Legal ground: necessity of processing for the establishment, exercise or protection of a right.

Ordinary use of Performance Intelligence is not intended to collect special categories of personal data. Users should not transfer special category personal data unless it has been separately agreed that the service is expressly intended for that.

1.4. How personal data is collected

Personal data may be obtained by wholly or partly automated means through:

direct electronic submission by the user during account, sign-in and contact processes,
the customer’s authorized administrator adding or inviting a user,
the APIs of connected third-party platforms,
technical and security logs generated automatically while the platform runs,
support, email and similar communication channels.

These are the routes through which data reaches us.

1.5. Recipient groups to whom personal data may be transferred, and why

Personal data may be transferred, only to the extent necessary:

to hosting, database, authentication and file storage providers: in order to run the platform and store data securely,
to third-party platforms the customer has connected: in order to carry out the integration and data exchange the user requested,
to messaging and notification providers chosen by the customer: in order to deliver reports or notifications,
to legal and financial advisers: where a legal obligation, dispute or advisory need arises,
to competent public authorities: where there is a statutory obligation or a duly made request.

Transfers are limited to these purposes.

1.6. Transfer abroad

Personal data may be transferred abroad because of some of the infrastructure services used or third-party platforms connected by the customer.

Any transfer abroad must rest on whichever of the conditions in Article 9 of the KVKK and the related legislation is applicable.

Transfer mechanism and appropriate safeguard: the applicable Article 9 mechanism will be published in this section once the infrastructure agreements and data flows are finalised.

1.7. Retention

Personal data is kept for as long as the relevant processing purpose requires and for the mandatory retention and limitation periods in the applicable legislation. Where the conditions for processing cease, deletion, destruction or anonymisation processes are applied in line with that legislation.

The product’s technically defined report file retention periods are 14 days for Basic, 30 days for Pro and 60 days for Corporate. When a user disconnects a platform, the corresponding Dreavion access credential is deleted. The same fixed period does not apply to other data categories.

1.8. Rights under Article 11 of the KVKK

Under Article 11 of the KVKK, data subjects have the right to learn whether their personal data is processed, to request information if it is, to learn the purpose of processing and whether the data is used in line with that purpose, to know the third parties to whom it has been transferred, to request correction of incomplete or inaccurate data, to request its erasure or destruction where the conditions are met, to request that any correction or erasure be notified to third parties to whom the data was transferred, to object to an adverse outcome arising from analysis carried out solely by automated systems, and to claim compensation for damage suffered as a result of unlawful processing.

1.9. How to make a request

Requests under the KVKK can be made using any suitable method set out in the Communiqué on the Procedures and Principles of Application to the Data Controller.

For example, a request may be sent:

in writing and signed, to Emniyet Evleri Mah. Eski Büyükdere Cad. Sapphire No: 1/1, İç Kapı No: 1B04, Kağıthane / İstanbul,
to the registered electronic mail (KEP) address of Dreavion Technology, if published,
to info@dreaviontechnology.com, using an email address already registered for the data subject in Dreavion Technology systems,
by any other secure application method accepted by the legislation.

These are the accepted routes.

A request must contain the identity and contact details required by the legislation, together with the subject of the request. For data security, Dreavion Technology may ask for additional verification proportionate to the nature of the request.

Requests under the KVKK are concluded as soon as possible and within thirty days at the latest, depending on the nature of the request. Requests are free of charge as a rule. Where the process involves an additional cost and the legislation permits a fee, the applicable tariff may be applied.