1. Scope and data controller
This notice covers visitors to the Veternis marketing website and people sharing their email address to receive launch and early access notifications. It does not cover patient, pet owner or employee records in the clinic application.
Data controller: Reha Ömer Gürsel (Veternis). Data protection requests: kvkk@veternis.com. General enquiries: info@veternis.com. Product and support questions: support@veternis.com. Veternis is a brand name. If you prefer to apply in writing, you can request the postal address by writing to kvkk@veternis.com.
2. Data collected and collection methods
The form collects your email address, page language (Turkish or English), a source value identifying the marketing website and the time the record was created, directly from you through automated electronic means. It does not request your name, phone number, clinic details or patient records.
As proof of consent we also record the server time the consent was given and the version of the consent wording and of this notice shown at that moment. Signing up again with the same address does not erase earlier consent records; each consent is stored separately.
Hosting and security services may process technical information such as IP address, request time and browser details when you access the website. We keep no access log of our own and monitoring (Application Insights) is not enabled. Microsoft keeps system-generated logs in pseudonymised form to operate the service and sets their retention to the minimum needed for that purpose. See the Cookie Policy for analytics information.
To prevent abuse of the form, your IP address is not stored: an hourly request count is kept against a value derived from your address that cannot be turned back into it. These counters are deleted automatically every day.
3. Purposes and legal grounds
Your email, language and source information are used to manage the notification list and send the launch and early access information you request in the appropriate language. This list relies on your explicit consent under Article 5(1) of Turkish Law No. 6698 (KVKK). Consent is taken through a tick box that sits apart from this notice and starts empty; the form cannot be submitted until it is ticked. Reading this notice does not constitute consent or commercial email approval.
Security logs are processed for the legitimate interest of protecting the website and form, subject to your fundamental rights and freedoms (Article 5(2)(f)). Data rights request records are processed to comply with legal obligations (Article 5(2)(ç)); necessary dispute records are processed to establish, exercise or protect a right (Article 5(2)(e)).
The form does not create an account, paid subscription or purchase. Other marketing campaigns fall outside this request. Applicable commercial electronic message approval and opt-out requirements must be handled separately.
4. Recipients and international transfers
Data may be shared with authorised hosting, signup storage and email delivery providers only to the extent needed to provide these services. It may also be disclosed to competent public bodies or courts where required by law.
The server component handling the form request and the table holding signup records run on Microsoft Azure in the West Europe (Netherlands) region. The static pages are served from Microsoft's global distribution network for speed; that content holds no personal data, but your IP address may be processed by a server in your region when you access it. In all cases your data is processed outside Türkiye. Our relationship with Microsoft is governed by the Microsoft Products and Services Data Protection Addendum (DPA). That addendum carries the EU standard contractual clauses, and under the EU Data Boundary commitment Microsoft stores and processes customer data for Azure services deployed in EU regions within the EU/EFTA, apart from limited cases. These arrangements belong to EU law and do not replace the safeguard required by KVKK Article 9.
The overseas providers are used for the hosting and communication purposes described in this section. Consent to join the notification list and the legal conditions for international transfers are assessed separately. You can request information about data recipients and transfer arrangements at kvkk@veternis.com.
When you write to info@veternis.com, support@veternis.com or kvkk@veternis.com, your message is processed and stored on the infrastructure of our email provider, Google (Google Workspace), under the Google Workspace terms and data processing amendment. Mail content is processed and stored on Google's global infrastructure, with no commitment that it stays in a particular country. Correspondence is kept for as long as it takes to resolve the request.
No separate email service is used for bulk launch notifications; signup records live only in the table described above. If such a service is introduced, its name, recipient group, country and transfer safeguards will be added here and separate consent will be obtained where required.
5. Retention and deletion
Your signup record (email address, language, source and signup time) is kept for 24 months from the signup date and is deleted automatically at the end of that period.
Consent records are kept for 36 months from the date the consent was given. That period can outlast the signup record itself; the records exist to meet the obligation to prove that explicit consent was given and what it covered, and to serve as evidence in any audit or dispute.
If you withdraw your request, your record is marked as opted out and mailing stops; the record is deleted when its own 24 months are up, while the consent record stays until its own period ends. Keeping the record after withdrawal serves to prevent the same address from being reactivated through the form and to show that the withdrawal was carried out; that processing rests on compliance with a legal obligation (KVKK Article 5(2)(ç)) and the record is used for nothing else. If you ask for your record to be deleted entirely, the signup record and its consent records are removed together. Expired records are cleared by an automated daily job.
We run no separate backup process for the signup table. The storage service's replication within the same region is not a restore point we can use. Exports taken for administration (such as CSV) are managed separately and deleted once no longer needed. Records needed for a dispute are retained only for the relevant purpose and necessary period.
6. Your rights
Under Article 11 of KVKK, you may:
- Learn whether your personal data is processed and request information about that processing.
- Learn its purpose, whether it is used accordingly, and the third parties receiving it in Türkiye or abroad.
- Request correction of incomplete or inaccurate data; request deletion or destruction when legal conditions are met; and request notification of these actions to recipients.
- Object to an adverse outcome resulting exclusively from automated analysis and seek compensation for damage caused by unlawful processing.
7. Withdrawal and requests
You may withdraw your notification request and consent at any time by writing to kvkk@veternis.com. Your record is then marked as opted out and no notifications are sent; the consent record showing when and under which wording consent was given is kept until its retention period ends, for proof only. To request notifications again, contact kvkk@veternis.com; reactivation requires verification of address ownership and fresh consent. The form does not perform this automatically. If you would rather have the record deleted entirely, just say so. An automated unsubscribe link will be added once notification emails start going out. Withdrawal does not affect the lawfulness of earlier processing.
Submit KVKK requests using the methods in the Communiqué on the Principles and Procedures for the Request to Data Controller, including a written request to the controller’s address or an email to kvkk@veternis.com from an address previously provided to us and registered in our system. Include the required identity and contact details, your request and relevant supporting information. Do not send unnecessary identity documents or sensitive data. Requests are resolved as soon as possible, within 30 days, without charge unless additional costs justify a fee under the Board’s tariff.