PDA · Project Delivery Assistant
KVKK Privacy Notice
Notice under Article 10 of Turkish Law No. 6698 (KVKK): the personal data PDA processes, purposes and legal bases, recipients, retention periods and your rights.
Last updated: October 11, 2026
Data controllers and scope
This notice informs you, under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK), about the personal data processed when you use PDA · Project Delivery Assistant (PDA).
The data controllers are Hamza Taşbay and Alper Temiz, the maintainers of the open-source PDA project. Both are natural persons; PDA is not run on behalf of a company or commercial business, so there is no trade name, MERSİS number or registered e-mail (KEP) address.
You can reach the controllers through the contact form on this site or at info@pd-assistant.com. How to submit a personal-data request is described under “How to apply”.
This notice is not a request for consent. The only processing that relies on explicit consent is the optional visit analytics; you decide on it separately and freely in the cookie layer (see the Cookie Policy).
Data processed and how it is collected
Data is collected electronically and partly automatically through the registration and sign-in forms, the screens and forms of the application, the contact form, the cookie layer, project members who invite you and, if you choose it, Google or GitHub sign-in.
- Identity and contact: e-mail address and nickname; first and last name (only on accounts created through a project invitation, entered by the inviting person, and in the contact form if you write it); optional profile photo.
- Account security: a one-way hash of your password (the password itself is not stored); hashes of verification and reset codes; if you enable it, two-factor data (the secret is stored encrypted, backup codes as hashes); the ID of a linked Google/GitHub account; session records (session times, browser/device information). For administrator actions an audit log is kept that contains only account IDs, action type, time and outcome.
- Workspace content: projects, teams, organisations, tasks, comments, file attachments, project chat messages, in-app notifications, invitations, calendar entries and reminders, only for the features you use.
- Support requests: the name, (optional) last name, e-mail address, category and message you write in the contact form.
- Operational security: network address information used for request rate limiting and the bot-trap fields of the contact form.
- Visit analytics (only with your explicit consent): a randomly generated anonymous visitor and session ID, the type of page visited, the source of the visit, active time, whether certain buttons (register, sign in, contact submission, source-code link) were clicked and the type of an error that occurred in the application. No IP address or browser information is stored for analytics; only the page type is recorded, not the page address.
Do not enter special categories of personal data (health, religion, race, biometric data and the like) into PDA; it is not designed to process them.
Purposes and legal bases
Your data is processed for the following purposes on the basis of the conditions in Article 5 of the Law.
| Purpose | Data categories | Legal basis |
|---|---|---|
| Creating the account, authenticating you and providing the workspace | Identity and contact, account security, workspace content | Art. 5/2(c): necessary for the conclusion or performance of a contract (the Terms of Use) |
| Account and system security, preventing abuse (session management, authorisation checks, rate limiting, bot trap, administration audit log) | Session records, network address, audit log, bot-trap fields | Art. 5/2(f): legitimate interest (provided your fundamental rights and freedoms are not harmed) |
| Answering contact-form messages and support requests | Support request | Art. 5/2(f): legitimate interest; if your request is a personal-data application, also Art. 5/2(ç) |
| Answering personal-data applications and meeting legal obligations | Information in the application, information needed to verify identity | Art. 5/2(ç): legal obligation of the controller |
| Keeping records to establish, exercise or defend a right in possible disputes | Support request, audit log, account and transaction records | Art. 5/2(e): establishment, exercise or protection of a right |
| Anonymous measurement of how the site is used, of the sign-up flow and of errors | Visit analytics data | Art. 5/1: explicit consent (given in the cookie layer, withdrawable at any time) |
Notice and consent are separate: reading this notice or registering does not mean you have given explicit consent to analytics. Declining analytics does not affect your use of PDA.
Recipients and transfers abroad
Your personal data is not sold and not shared for advertising. It is passed on to the following recipients, for the stated purpose and to the extent necessary.
- Project members: workspace content and membership information (e-mail, nickname, profile photo) are shown to the authorised members of the project for working together; an invitation preview is shown to the recipient of the invitation.
- E-mail service (Hostinger Email): verification codes, password resets, invitations and contact-form messages are sent through the configured SMTP service. Contact-form messages are delivered to the PDA inbox (info@pd-assistant.com). The provider’s current data-processing and international-transfer terms must be assessed separately.
- Sign-in with Google and GitHub (optional): if you choose it, authentication takes place at the provider (USA); PDA receives the basic account information needed for sign-in (account ID, e-mail address, name).
- GitHub API (repository features): when you connect a public repository to a project, repository information and recent commits are read from the GitHub API (USA).
- Hosting provider: the hosting provider for PDA's production environment has not been chosen yet. Once it is chosen, this notice will be updated with its name, the data location and any transfer abroad.
- Authorities: public bodies and authorities, where a legal obligation arises.
Transfers abroad (Art. 9): personal data is transferred to the following recipients in the USA: Google LLC (optional Google sign-in) and GitHub, Inc. (GitHub API and optional GitHub sign-in). Verification and reset codes and notifications about contact-form messages are sent through Hostinger Email; processing locations and transfer terms for the e-mail service are assessed separately against the provider agreement; your sign-in identifiers go to Google or GitHub only if you choose that sign-in; repository metadata requests go to GitHub when you use the repository feature.
The optional Google/GitHub sign-in and the repository features can be avoided; you can also register with e-mail and password. Sending e-mail, however, is necessary for the service to work. The controllers track compliance of these transfers with Article 9 of the Law (appropriate safeguards such as standard contracts and the notification to the Board) and will update this text as these safeguards are put in place. This text does not state that any specific safeguard or contract is already in place.
Retention periods
Data is kept for as long as the purpose requires and is then deleted or anonymised. Deletions run automatically.
| Data | Period | At the end |
|---|---|---|
| Account data and workspace content | Until you delete the account | The account is anonymised the moment it is deleted: e-mail address, name, nickname and password hash are erased, sessions are closed, project and organisation memberships end. An owner of a project or organisation must transfer ownership or delete it before deleting their account. |
| Revoked or expired session records | 30 days | Deleted automatically. |
| Contact-form status records and stored support messages (name, e-mail, category, message) | 12 months | Deleted automatically. The e-mail copies delivered to the PDA inbox (Hostinger Email) are cleaned up manually by the controllers at least once a year: messages older than 12 months are deleted at the latest in the yearly cleanup, and immediately on request (data request via the contact-form category “KVKK / data request” or by e-mail). |
| Visit analytics (sessions, page views, button clicks and error events) | 12 months | Deleted automatically. The anonymous visitor ID is renewed in your browser every 12 months and removed at once when you withdraw your analytics consent. |
| Administration audit log (account IDs, action type, time and outcome only) | 24 months | Deleted automatically. |
Deleting your account does not by itself remove other users' project records (for example task history); these records may remain with an anonymised account ID. If a legal retention duty arises, the relevant information is kept for that period. The backup and hosting arrangements will be added to this notice once the hosting provider is chosen.
Your rights under the Law
Under Article 11 of the Law you can apply to the controller to exercise the following rights.
- To learn whether your personal data is processed and, if so, to request information.
- To learn the purpose of processing and whether the data is used in line with that purpose.
- To know the third parties in Türkiye or abroad to whom the data is transferred.
- To request correction of incomplete or inaccurate data.
- To request deletion or destruction of the data under the conditions of the Law, and to request that corrections and deletions be notified to recipients.
- To object to a result against you that arises solely from analysis by automated systems.
- To claim compensation for damage caused by unlawful processing.
You can update your profile yourself on the account screen and delete your account there. Exporting your data is not yet a feature inside the application; it is provided on request.
How to apply
To exercise your rights, choose one of two ways: select the category “KVKK / data request” in the contact form, or send an e-mail to info@pd-assistant.com.
State your name, the e-mail address linked to your account and your request clearly. Sending from the e-mail address linked to your account is usually enough to confirm the application is yours; if necessary we may ask for proportionate additional verification. Do not send passwords, verification codes or invitation links.
We conclude your application, depending on its nature, as soon as possible and at the latest within 30 days, free of charge. If the process requires a separate cost, the fee in the tariff set by the Board may be charged.
If you find the answer insufficient, you can complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the application date.
Data security and breach notification
Passwords are stored as one-way hashes, session tokens are kept in HttpOnly cookies, two-factor secrets are encrypted, project permissions are checked on the server and administrator access is protected by a separate two-factor sign-in. These measures are not an absolute security guarantee.
If personal data is obtained unlawfully by others, we notify the Board and the data subjects affected as soon as possible under Article 12 of the Law (within 72 hours, as required by a Board decision).
VERBİS registration
The data controllers are natural persons and run PDA as a non-commercial open-source project. The controllers (Hamza Taşbay and Alper Temiz) have no employees and no company or commercial revenue, so they are below the thresholds set by the Personal Data Protection Board for registration (fewer than 50 employees per year and an annual financial balance-sheet total below the amount set by the Board).
Accordingly, there is currently no obligation to register in the Data Controllers' Registry (VERBİS), and there is no VERBİS registration number. If the obligation arises, it will be fulfilled within the legal period and this notice will be updated.
Updates and GDPR information
This notice is updated when the processing conditions change, and the “Last updated” date at the top of the page changes.
If you are in the European Union or the European Economic Area, the GDPR information (legal bases, transfers, rights, complaints) is in the GDPR sections of the Privacy Policy.