Draft – subject to legal review
Sendonis Privacy Policy
Effective date: [EFFECTIVE DATE]
This Privacy Policy explains how Sinapp Sağlık Eğitim Yazılım Danışmanlık Ltd. Şti. ("Sendonis", "we", "us") processes personal data when you visit https://sendonis.com, join our early-access waitlist, create or use a Sendonis account, contact us, or otherwise interact with us.
1. Who we are
Controller: Sinapp Sağlık Eğitim Yazılım Danışmanlık Ltd. Şti., Nurol Plaza, Maslak/İstanbul, Türkiye. Trade registry no. [COMPANY REGISTRATION NO], MERSIS no. [MERSIS NO], tax office Maslak, tax ID 7701222551. VERBIS registration no. [VERBIS REGISTRATION NO]. Privacy contact: [PRIVACY EMAIL] · Phone: 0850 303 91 42 · Data protection officer: [DPO CONTACT – if appointed] EU representative (Art. 27 GDPR): [EU REPRESENTATIVE] UK representative (Art. 27 UK GDPR): [UK REPRESENTATIVE]
Turkish-language information under Law No. 6698 on the Protection of Personal Data ("KVKK") is provided in our KVKK Aydınlatma Metni at [LEGAL PAGES URL].
2. Scope: when we are controller and when we are processor
We are the controller for personal data about:
- visitors to our website;
- prospective customers, customers and their Authorized Users (account, billing, support and usage data);
- people who contact us, report abuse, or subscribe to our own newsletters;
- people who join our early-access waitlist (see Section 4A).
We are a processor (service provider) for our customers for personal data contained in the messages and contact lists our customers send through Sendonis ("Recipient Data"). Our customers decide whom they message and why. If you received an email or SMS sent through Sendonis, the sender (our customer) is responsible for that processing — please contact the sender, use the unsubscribe link or opt-out keyword in the message, or write to [ABUSE EMAIL] if you believe the message is unwanted. Our processing of Recipient Data is governed by our Data Processing Agreement ([LEGAL PAGES URL]) with each customer, not by this Privacy Policy, except for Section 10 below.
3. Personal data we collect (as controller)
| Category | Examples | Source |
|---|---|---|
| Identity & contact | Name, business email, phone, company name, job title | You |
| Account & authentication | Username, hashed password, MFA settings, API key metadata (not the secret), roles | You / the Service |
| Billing & transaction | Billing address, tax ID, VAT number, invoices, plan, payment status; card data is handled by [PAYMENT PROVIDER] — we receive only limited details (e.g. card brand, last four digits, expiry) | You / [PAYMENT PROVIDER] |
| Verification & compliance | Business information, sending-domain ownership, information on list sources and consent practices, KYC/sanctions screening results | You / public sources / [KYC PROVIDER – if used] |
| Usage & technical | IP address, device/browser data, log data, API request logs, sending volumes, deliverability metrics, audit logs | Automatically |
| Communications | Support tickets, emails, abuse reports, call notes | You / third parties reporting abuse |
| Marketing preferences | Newsletter subscriptions, consent records, cookie choices | You |
| Early-access waitlist | Email address; optionally name and company; waitlist and marketing consent records (wording and version of the consent text, date and time, IP address, page and language of the form, double-opt-in confirmation date and time); unsubscribe/withdrawal status | You / automatically |
| Anti-bot signals | IP address, TLS fingerprint, user-agent and similar browser signals evaluated by Cloudflare Turnstile when you submit a form | Automatically (Cloudflare) |
| Website data | Pages viewed, referrer, cookies (see Cookie Policy) | Automatically |
We do not intentionally collect special categories of personal data about our customers or visitors.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR / UK GDPR) | Legal basis (KVKK Art. 5) |
|---|---|---|
| Creating and managing your account; providing the Service | Contract (Art. 6(1)(b)) | Necessary for performance of a contract (5/2-c) |
| Billing, invoicing, tax and accounting | Legal obligation (6(1)(c)); contract | Legal obligation (5/2-ç); contract (5/2-c) |
| Customer verification, fraud and abuse prevention, enforcing our AUP, protecting deliverability and security | Legitimate interests (6(1)(f)); legal obligation where applicable | Legitimate interest (5/2-f); legal obligation (5/2-ç) |
| Customer support and service communications | Contract; legitimate interests | Contract (5/2-c); legitimate interest (5/2-f) |
| Improving the Service, analytics (aggregated) | Legitimate interests; consent for non-essential cookies | Legitimate interest (5/2-f); explicit consent where required (5/1) |
| Marketing our own services | Consent, or legitimate interests where permitted for existing customers | Explicit consent (5/1) and commercial electronic message consent under Law No. 6563 / İYS where required |
| Early-access waitlist: confirming your email address, notifying you of our launch and sending your early-bird offer | Consent (Art. 6(1)(a)) | Explicit consent (5/1) and commercial electronic message consent under Law No. 6563 / İYS where required |
| Keeping records of waitlist consents and withdrawals to demonstrate compliance | Legal obligation (6(1)(c)); legitimate interests (6(1)(f)) | Legal obligation (5/2-ç); establishment, exercise or protection of a right (5/2-e) |
| Protecting our forms against bots and abuse | Legitimate interests (6(1)(f)) | Legitimate interest (5/2-f) |
| Establishing, exercising or defending legal claims; responding to authorities | Legitimate interests; legal obligation | Establishment, exercise or protection of a right (5/2-e); legal obligation (5/2-ç) |
Where we rely on legitimate interests, you can contact us for information on our balancing test.
4A. Early-access waitlist
If you join the Sendonis early-access waitlist on our website:
- Data: your email address and, if you choose to give them, your name and company. We also keep a record of your consent: the consent text you agreed to (and its version), the date and time, your IP address, the page and language of the form, and the date and time you confirmed your address through the link in our confirmation email (double opt-in).
- Purposes: to confirm your email address, to notify you when Sendonis launches, and to send you our early-bird offer. If you also tick the separate, optional box for product news, we will send you occasional Sendonis product news after launch. Marketing consent is never pre-ticked and is not a condition of joining the waitlist.
- Legal basis: your consent (Art. 6(1)(a) GDPR / UK GDPR; explicit consent under Art. 5(1) KVKK, and commercial electronic message consent under Law No. 6563 where required). We keep the consent record itself to be able to prove consent and to honour withdrawals (legal obligation / legitimate interests).
- Retention: waitlist data is kept until you unsubscribe or withdraw consent, or for [WAITLIST RETENTION], whichever is earlier. Sign-ups that are never confirmed are deleted after [UNCONFIRMED SIGN-UP RETENTION]. After you unsubscribe, we keep a minimal record of your withdrawal (and the original consent record) for [RETENTION PERIOD – MARKETING PREFERENCES] so we don't email you again and can demonstrate compliance. If you create a Sendonis account, the account data retention in Section 7 applies from then on.
- Withdrawal: you can withdraw your consent at any time using the unsubscribe link in every waitlist email, or by writing to [PRIVACY EMAIL]. Withdrawal does not affect the lawfulness of processing before it.
- Recipients: waitlist emails are sent through Amazon SES (AWS region eu-central-1, Frankfurt), and waitlist data is stored at [HOSTING PROVIDER / LOCATION]. The waitlist form is protected by Cloudflare Turnstile (see Section 5 and our Cookie Policy).
Drafting note (lawyer): Confirm whether consents collected through the waitlist must be registered in İYS for Turkish recipients (and within which deadline), and whether the launch notification alone (without the offer) could rely on a basis other than consent.
5. Sharing of personal data
We share personal data only as needed with:
- service providers acting on our behalf, including hosting ([HOSTING PROVIDER / LOCATION]), Amazon Web Services (Amazon SES and related services, AWS region eu-central-1, Frankfurt, Germany), [SMS PROVIDER], [PAYMENT PROVIDER], [EMAIL/WORKSPACE PROVIDER], [CUSTOMER SUPPORT TOOL], [ANALYTICS PROVIDER], [DNS / CDN PROVIDER], Cloudflare, Inc. (Cloudflare Turnstile anti-bot protection on our website forms, acting as our processor; Cloudflare also processes Turnstile signals as an independent controller to improve its bot detection, as described in its Turnstile Privacy Addendum at https://www.cloudflare.com/turnstile-privacy-policy/) and [OTHER SUBPROCESSORS];
- professional advisers (lawyers, accountants, financial advisers/auditors);
- authorities, courts and regulators, where required by law or to protect our rights;
- delivery partners and mailbox/carrier ecosystems to the limited extent necessary to investigate abuse;
- a successor entity in a merger, acquisition or asset sale, subject to this Policy.
We do not sell personal data and do not "share" it for cross-context behavioural advertising as defined under the CCPA/CPRA.
6. International transfers
Sendonis is established in Türkiye and serves customers globally. Personal data may be transferred to and processed in Türkiye, Germany/EU (Amazon SES, AWS region eu-central-1, Frankfurt), the United States (where our US-headquartered providers, including Amazon Web Services and,, Cloudflare, Inc., may access or process data, for example for support, security or legal-compulsion purposes), [HOSTING PROVIDER / LOCATION], [SMS PROVIDER LOCATION], [PAYMENT PROVIDER LOCATION] and other countries where our subprocessors operate. Some of these countries are not considered by the European Commission, the UK government or the Turkish Personal Data Protection Board to provide an adequate level of protection.
Where required, we rely on appropriate safeguards, including:
- for transfers from the EU/EEA: the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), and/or the EU–U.S. Data Privacy Framework where the recipient is certified;
- for transfers from the UK: the UK International Data Transfer Addendum to the EU SCCs (or the IDTA), and/or the UK Extension to the Data Privacy Framework where applicable;
- for transfers from Türkiye: the standard contracts published by the Turkish Personal Data Protection Board under Article 9 KVKK (as amended by Law No. 7499), notified to the Authority within five business days of signature, or another mechanism permitted by Article 9;
- supplementary measures such as encryption in transit and at rest and access controls.
Processing Amazon SES data in an EU region reduces, but does not eliminate, international-transfer considerations, because AWS is headquartered in the United States. For data originating in Türkiye, transfer to the EU is still a cross-border transfer under Article 9 KVKK.
You can request a copy of the relevant safeguards at [PRIVACY EMAIL].
7. Retention
We keep personal data only as long as necessary for the purposes above:
| Data | Retention |
|---|---|
| Account data | Duration of the account + [RETENTION PERIOD – ACCOUNT DATA] |
| Billing, invoices and tax records | [RETENTION PERIOD – BILLING / TAX RECORDS] (Turkish law generally requires up to 10 years under the Turkish Commercial Code and 5 years under the Tax Procedure Law) |
| Support communications | [RETENTION PERIOD – SUPPORT COMMUNICATIONS] |
| Website and server logs | [RETENTION PERIOD – WEBSITE / SERVER LOGS] |
| Security and audit logs | [RETENTION PERIOD – SECURITY / AUDIT LOGS] |
| Abuse reports and enforcement records | [RETENTION PERIOD – ABUSE RECORDS] |
| Marketing consent and preference records | Until withdrawal + [RETENTION PERIOD – MARKETING PREFERENCES] |
| Early-access waitlist data | Until you unsubscribe or withdraw consent, or [WAITLIST RETENTION], whichever is earlier; unconfirmed sign-ups [UNCONFIRMED SIGN-UP RETENTION] |
| Backups | Rolling, up to [RETENTION PERIOD – BACKUPS] |
After the retention period, data is deleted, destroyed or anonymised in accordance with our data retention and destruction policy.
8. Your rights
Depending on where you live, you may have the rights below. To exercise them, contact [PRIVACY EMAIL]. We may need to verify your identity. We respond within the period required by law (generally one month under GDPR/UK GDPR, 30 days under KVKK, and 45 days under CCPA/CPRA, extendable where permitted).
EU/EEA and UK (GDPR / UK GDPR): access; rectification; erasure; restriction; data portability; objection (including to direct marketing at any time and to processing based on legitimate interests); withdrawal of consent at any time; not to be subject to solely automated decisions with legal or similarly significant effects; and the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).
Türkiye (KVKK Art. 11): to learn whether your personal data is processed and request information; learn the purpose and whether data is used accordingly; know the third parties to whom data is transferred in Türkiye or abroad; request rectification; request erasure or destruction under Art. 7; request notification of these operations to third parties; object to outcomes against you resulting exclusively from automated analysis; and claim compensation for damages arising from unlawful processing. You may also complain to the Personal Data Protection Board. See our KVKK Aydınlatma Metni for the application procedure.
California (CCPA/CPRA) and other U.S. states with comprehensive privacy laws, to the extent applicable to us: right to know/access the categories and specific pieces of personal information collected, sources, purposes and recipients; right to delete; right to correct; right to opt out of sale or sharing (we do not sell or share); right to limit use of sensitive personal information (we do not use sensitive personal information for purposes requiring this right); and right not to be discriminated against for exercising rights. You may use an authorised agent. In the preceding 12 months we collected the categories of personal information listed in Section 3 (identifiers, commercial information, internet/network activity, professional information, and inferences limited to fraud/abuse risk), for the business purposes in Section 4, and disclosed them to service providers listed in Section 5.
Drafting note (lawyer): Confirm whether Sendonis meets CCPA "business" thresholds; if not, keep a short voluntary section or remove.
Marketing and waitlist opt-out: you can unsubscribe from our own marketing and from waitlist emails at any time via the link in each email or by contacting [PRIVACY EMAIL].
9. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and logging, as further described in Annex II of our DPA. No system is completely secure; please protect your credentials and API keys.
10. If you received a message sent through Sendonis
If you are a Recipient of a message sent by one of our customers:
- the customer is the controller; please direct privacy requests to them;
- we will forward requests we receive to the relevant customer where we can identify them, and assist the customer as required by our DPA;
- we may retain a minimal record (e.g. a hashed email address or phone number) of your unsubscribe or complaint in the sending customer's suppression list to ensure you are not messaged again by that customer, and may use aggregated abuse signals to protect the Service;
- to report unwanted messages, contact [ABUSE EMAIL].
11. Children
Our Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children under 16 (or the applicable age in your jurisdiction).
12. Changes
We may update this Policy. We will post the updated version with a new effective date and, for material changes, notify account holders by email or in the web app.
13. Contact
Sinapp Sağlık Eğitim Yazılım Danışmanlık Ltd. Şti. · Nurol Plaza, Maslak/İstanbul · [PRIVACY EMAIL] · Phone: 0850 303 91 42 · KEP: [KEP ADDRESS] EU representative: [EU REPRESENTATIVE] · UK representative: [UK REPRESENTATIVE]