KVKK at Citation
Personal data rights and processing responsibilities under Turkey’s data protection framework.
Scope at a glance.
- Framework
- KVKK
- Status
- Compliant
- Applies to
- Personal data processing and rights under the Turkish framework, for the service and relationships involved.
Read this alongside the security controls and provider list for the features you plan to use.
Personal information and its purpose
Citation’s KVKK compliance approach addresses personal information processed through the service. Account access, document collaboration, support and connected features involve different kinds of information and different processing purposes.
The privacy policy describes the product’s data practices. If your organization places personal information in documents, consider the appropriate legal basis, notices and authorizations for that use. The people who can access a workspace and a shared document may be different.
Requests and control
Contact us about information associated with your account and the privacy rights applicable to your request. Provide enough context to identify the relevant record, while keeping credentials and sensitive document contents out of the initial message.
Export and deletion have different effects. Exporting a document does not delete it; disconnecting an integration does not necessarily remove information already sent to that service. Review those actions in the context of the data you want to manage.
Service providers and transfers
Citation uses external services for hosting, authentication, storage, AI features and email. Discuss the applicable processing agreements and cross border transfer arrangements with us when evaluating the service for your organization.
Documents for a useful review.
Ask for the information that establishes the relevant scope, period and responsibilities.
- Processing purposes, data categories and responsible parties
- Applicable notices, legal basis and processor arrangements
- International transfer mechanism for the actual providers
- Data subject request and retention procedures
Include your organization, intended workflow and procurement requirements when requesting access. Some documents may require confidentiality arrangements.
Your part in the workflow.
- Assess the notices, authority and legal basis for the information you upload.
- Review international processing by feature; an EU transfer clause alone does not establish every Turkish transfer requirement.
- Route requests to the party responsible for the relevant account or organization content.
For personal information requests, use Data requests. For a suspected incident, follow the security reporting process.