Your account information, projects, shares and comments, and support tickets are stored on our servers on Cloudflare infrastructure (see 05 Transfer of personal data). Only temporary copies for faster loading and your preferences are kept in your browser.
01Data controller
[COMPANY NAME] (“Nodaform”, the “Company” or “we”) is the data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) with respect to your personal data processed in connection with the nodaform.com website and the browser-based floor plan drawing service (the “Service”).
This privacy notice has been prepared pursuant to Article 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to explain for what purposes, on what legal grounds and by what methods your personal data is processed, to whom it may be transferred, and your rights.
| Company name | [COMPANY NAME] |
|---|---|
| Address | [ADDRESS] |
| MERSİS number (Turkish central trade registry) | [MERSİS NO.] |
| Tax office / tax number | [TAX OFFICE / NO.] |
| info@nodaform.com | |
| KEP address | [KEP ADDRESS] |
| Phone | [PHONE] |
02Categories of personal data processed
Depending on how you use the Service, the following personal data may be processed. The Service is not designed to collect special categories of personal data (health, biometric data, religion, ethnic origin, etc.); we ask that you do not include such data in your plans or support tickets.
| Category | Data |
|---|---|
| Identity | The first name (and surname, if any) you provide in your account. If you sign in with Google, the name and profile photo link from your Google account. |
| Contact | E-mail address; other contact details you share in support or contact correspondence. |
| Customer transaction | Projects and floor plans, drawing sheet templates, title block information and, if uploaded, your company logo; share links and comments; support tickets and correspondence; plan, subscription and waiting list records; preferences such as language and region. |
| Transaction security | Sign-in and session logs (date, time), IP address, browser and device information, a one-way hash of your password (the password itself is not stored). |
| Financial | If you purchase a paid plan: limited transaction information provided to us by the payment institution (transaction number, amount, date, payment status) and the billing information required by law for issuing an invoice. |
| Marketing | Only if you have consented to receive newsletters or commercial electronic messages: your e-mail address and your consent record (date, channel). |
Your card details are collected and processed on the payment page directly by the licensed payment institution [PAYMENT INSTITUTION]. The card number, expiry date and security code are neither seen nor stored by Nodaform.
If you add information about third parties to your plans (e.g. your client’s name or the address of a property), you are responsible for obtaining that information lawfully and for adding it to the Service.
03Purposes of processing personal data
Your personal data is processed for the following purposes and only to the extent limited by them:
- creating the user registration, authentication and account management;
- providing the Service: saving projects, drawing and export functions, share links and comments;
- carrying out subscription, payment and billing processes, and applying plan entitlements and usage limits;
- receiving, responding to and recording support tickets, requests and complaints;
- carrying out information security processes; preventing unauthorized access, fraud and abuse;
- sending mandatory notices about the Service (such as security, changes to the agreement and prices, and subscription renewal);
- fulfilling legal obligations and responding to requests from competent authorities and institutions;
- establishing, exercising and protecting rights in potential disputes;
- if you give consent, sending commercial electronic messages about new features, campaigns and the newsletter.
04Legal grounds
Your personal data is processed on the basis of the following legal grounds listed in Article 5 of the KVKK:
| Legal ground | Processing activities |
|---|---|
| Art. 5/2-c — Conclusion or performance of a contract | Account creation and sign-in, storing projects, sharing and comment functions, subscription and payment processes, responding to support tickets. |
| Art. 5/2-ç — Compliance with a legal obligation | Invoice and accounting records (Tax Procedure Law, Turkish Commercial Code), record-keeping and information obligations under consumer legislation, records under Law No. 5651, requests from competent authorities. |
| Art. 5/2-e — Establishment, exercise or protection of a right | Retaining and using relevant records in dispute, complaint and objection processes. |
| Art. 5/2-f — Legitimate interest | Security and sign-in logs, preventing abuse, transactional notices about the service, remembering your language and region preferences. This processing is carried out in a manner that does not harm your fundamental rights and freedoms. |
| Art. 5/1 — Explicit consent | Sending newsletters and commercial electronic messages (separate consent is obtained under Law No. 6563); transfers abroad where the other conditions of Art. 9 of the KVKK are not met. |
Explicit consent is not a precondition for using the Service. You may withdraw your explicit consent at any time; withdrawal does not affect the lawfulness of prior processing.
05Transfer of personal data
Your personal data may be transferred to the following groups of recipients to the extent necessary for the purposes above and in accordance with Articles 8 and 9 of the KVKK. Your data is not sold and is not shared with third parties for advertising purposes.
| Recipient | Data transferred and purpose |
|---|---|
| Hosting and infrastructure service provider (Cloudflare, Inc.) | All account, project and log data stored on the servers on which the Service runs; serving the website, the database, security, and forwarding e-mails sent to info@nodaform.com. The primary location of the database is Eastern Europe; website content is delivered through Cloudflare’s global network. |
| Payment institution ([PAYMENT INSTITUTION]) | Name, e-mail, order amount and transaction information; collecting and refunding payments and preventing fraud. You provide your card details directly to the payment institution. |
| Google (only if Sign in with Google is chosen) | When you sign in with Google, authentication is performed by Google, and Google provides us with your name, e-mail and profile photo link. |
| E-mail delivery service provider (Resend, Inc.) | E-mail address and message content; delivering account verification, password reset, security and subscription notifications. The sending server is located in Ireland (EU). |
| Accountants and legal advisors | Invoice and accounting records, dispute-related records; fulfilling legal obligations. |
| Competent public authorities and institutions, judicial authorities | Only in cases provided for by law and to the extent requested. |
When you share a plan via a share link, anyone who accesses the link can see the information in the plan. This sharing takes place at your choice; you may remove the link at any time.
Transfers abroad (Art. 9 of the KVKK)
The servers of hosting, payment, e-mail or authentication service providers may be located outside Türkiye. In that case, pursuant to Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, your personal data is transferred:
- on the basis of an adequacy decision of the Personal Data Protection Board, where one exists for the destination country;
- where there is no adequacy decision, provided that one of the conditions in Art. 5 or 6 of the KVKK is met and one of the appropriate safeguards is provided, such as the standard contract announced by the Board (the standard contract is notified to the Authority within five business days of signing);
- where none of these is possible, only on an incidental basis and relying on one of the exceptional cases listed in the law (e.g. your explicit consent).
Transfer mechanism used: [TRANSFER MECHANISM — e.g. standard contract].
06Method of collection
Your personal data is collected on the basis of the legal grounds stated above, by fully or partly automated means and electronically, through the following channels:
- registration, sign-in, account settings, support and contact forms;
- the plan editor, drawing sheet templates, sharing and comment functions;
- from Google, when Sign in with Google is chosen;
- from the payment institution, when a paid plan is purchased;
- from server and security logs generated automatically while the Service is used;
- from your browser’s local storage (for details, see the Cookie and Local Storage Policy);
- from your correspondence with us by e-mail or registered e-mail (KEP).
07Retention periods
Your personal data is retained for as long as required by the purpose of processing and provided for by law. At the end of that period, the data is deleted, destroyed or anonymized in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data; periodic destruction is carried out at intervals of no more than six months.
| Data | Retention period |
|---|---|
| Account, project and template data | For as long as your account remains open. A project you delete stays in the trash for 30 days and is then permanently deleted. When you delete your account, your account, projects, shares and comments are deleted from the live system immediately and are removed from database recovery records within 30 days at the latest. |
| Subscription, payment and invoice records | 10 years, pursuant to the applicable tax and commercial legislation. |
| Distance contract and pre-contractual information records | At least 3 years pursuant to the Regulation on Distance Contracts; for potential disputes, for the general limitation period (10 years). |
| Support tickets and correspondence | [PERIOD — e.g. 3 years] from the closing of the ticket. |
| Session records | IP address and browser information of an active session: for the duration of the session, up to 30 days; deleted when you sign out. Failed sign-in attempt counters are deleted within 1 day. |
| Sign-in, IP and security logs | For the period provided for in Law No. 5651 and related legislation (not less than one year and not more than two years): [PERIOD]. |
| Consent to commercial electronic messages | Until consent is withdrawn; records of consent and refusal are retained for 3 years from the date the consent ceases to be valid. |
| Entries kept in your browser | Until you delete them or clear your browser data; these records are stored on your device. Temporary copies of projects are deleted when you sign out. |
08Your rights under Article 11 of the KVKK
Pursuant to Article 11 of the KVKK, by applying to the data controller, you have the right to:
- a) learn whether your personal data is being processed;
- b) request information about the processing if your personal data has been processed;
- c) learn the purpose of the processing of your personal data and whether it is used in accordance with that purpose;
- ç) know the third parties in Türkiye or abroad to whom your personal data is transferred;
- d) request the rectification of your personal data if it has been processed incompletely or inaccurately;
- e) request the erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
- f) request that the actions taken under subparagraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred;
- g) object to any outcome to your detriment arising from the analysis of the processed data exclusively by automated systems;
- ğ) claim compensation for damages if you suffer loss due to the unlawful processing of your personal data.
You may correct your account information under My account › Settings, and delete your account and projects from the same section.
09How to submit a request
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit requests concerning your rights in Turkish, by one of the following means:
- By a petition bearing your wet signature, in person or through a notary public: [ADDRESS]
- By registered electronic mail (KEP): [KEP ADDRESS]
- Signed with a secure electronic signature or mobile signature: info@nodaform.com
- From the email address you previously provided to us and that is registered in our system: info@nodaform.com
Your request must include the following: your first name, surname and, for written requests, your signature; for citizens of the Republic of Türkiye, your Turkish national identity number, and for foreign nationals, your nationality and passport or identity number; your residential or business address for service of notices; if any, your email address, telephone and fax number for notifications; and the subject of your request. Any relevant information and documents should be attached to the request.
Your request will be concluded free of charge as soon as possible depending on its nature, and within thirty days at the latest. If the process entails an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. We may request additional information to verify your identity.
If your request is rejected, if you find the response insufficient, or if no response is given in due time, you may file a complaint with the Personal Data Protection Board within thirty days of learning of the response and, in any case, within sixty days of the date of your request (KVKK Art. 14).
10Changes
This privacy notice may be updated in line with changes to legislation, to the Service or to our data processing activities. The current version is always published on this page; material changes are also announced by email or by an in-Service notification.
For our general privacy practices, please see the Privacy Policy; for records kept in your browser, please see the Cookie and Local Storage Policy.