This is a notice under Turkish Law No. 6698 on the Protection of Personal Data (KVKK), Article 10. It exists because glimana serves users in Türkiye. For the full technical detail of what we collect, see the Privacy Policy. The authoritative version of this notice is the Turkish one.
1. The data controller
Address: [full address]
Registration (MERSİS / tax) no: [number]
Registered e-mail (KEP): [KEP address]
Email: support@glimana.com
Website: glimana.com
The company details above are not filled in yet; this page will be updated once the legal entity details are settled.
2. Categories of personal data
| Category | Data | Source |
|---|---|---|
| Identity | Name | Sign-up form |
| Contact | Email address; email addresses of people you invite | Sign-up and invitation forms |
| Transaction security | Password hash, two-factor secret (encrypted), last sign-in time, email verification time, session record, IP address and browser string (server logs), API key prefix and hash | Automatic, by the system |
| Customer transaction | Workspace name and settings, the site addresses you add, the email of the connected Google account, identifiers of the connected Search Console / Analytics properties, notification channel settings (encrypted) | What you enter in the panel, and Google OAuth |
| Site performance data | Aggregated daily metrics from Search Console and Analytics 4; the content of crawled pages | Google APIs and our own crawler |
We read no visitor-level identifiers, cookie IDs or event records from Search Console or Analytics 4 — Google aggregates that data before we receive it. No special categories of personal data (Article 6) are processed.
3. Purposes of processing
- Creating the account, managing it, and securing sessions.
- Delivering the service: crawling the sites you add, reading data from your Google properties, and producing reports and task lists.
- Managing workspace memberships and permissions, and sending invitations.
- Sending notifications and answering support requests.
- Information security: detecting abuse and unauthorised access.
- Meeting legal obligations and producing evidence in any dispute.
Personal data is not used for marketing, profiling or automated decision-making, and is never sold.
4. Legal grounds (Article 5)
- Art. 5/2-c — necessary for a contract: account data, workspace and site records, the Google connection and the performance data fetched through it. The service cannot be delivered without them.
- Art. 5/2-ç — legal obligation: records the law requires us to keep.
- Art. 5/2-f — legitimate interest: server security logs, abuse detection, keeping the service running — processed only so far as it does not harm your fundamental rights.
- Art. 5/1 — explicit consent: required only for optional notification channels and optional announcement emails. You can withdraw consent at any time.
5. Method of collection
Personal data is collected by wholly automated means, electronically: the sign-up and panel forms on glimana.com, the Google OAuth flow, server-side calls to Google APIs, and server logs.
6. Transfers (Articles 8 and 9)
- Google LLC — the source of the data; calls to the Search Console, Analytics 4, PageSpeed Insights and CrUX APIs carry the relevant site URLs and an authorisation token.
- Hosting provider — [hosting provider and data-centre country]; servers, database and backups.
- Your notification channel — only the one you set up (mail server, Telegram, Slack, or your own webhook).
- Public authorities — only where the law requires it, limited to the scope of the request.
Some of these transfers go outside Türkiye. The Article 9 basis for the cross-border transfer is: [standard contract / undertaking / adequacy decision — to be completed]. This will be filled in together with the company details.
7. Retention
| Data | Period |
|---|---|
| Account and workspace records | while the account exists |
| After account deletion | at most 30 days |
| Search Console — daily query × page breakdown | 16 months |
| Search Console / Analytics — other daily series | 36 months |
| PageSpeed runs | 12 months |
| Crawled page copies and snapshots | 45 days |
| Server security logs | [hosting provider's log retention] |
At the end of the period data is deleted, destroyed or anonymised. Where the law requires a longer period, that period applies.
8. Your rights (Article 11)
By applying to the data controller you may:
- Learn whether your personal data is processed.
- Request information about it if it is.
- Learn the purpose of processing and whether it is used accordingly.
- Know the third parties, in Türkiye or abroad, to whom it is transferred.
- Request correction if it is incomplete or inaccurate.
- Request deletion or destruction under the conditions of Article 7.
- Request that corrections and deletions be notified to those third parties.
- Object to an adverse result produced by analysis through wholly automated systems.
- Claim compensation for damage caused by unlawful processing.
9. How to apply
Under the Communiqué on Procedures for Applications to the Data Controller, you may apply:
- By signed written petition with proof of identity, delivered to the address above in person or through a notary.
- By secure electronic or mobile signature to our KEP address.
- By email from the address registered in our system, to support@glimana.com.
We answer within 30 days at the latest, free of charge; if the request itself has a cost we may charge the fee set by the Board's tariff. If we refuse, or fail to answer in time, you may complain to the Personal Data Protection Board (KVKK Kurulu).
10. Disconnecting your Google account
You can disconnect Google at any time from the panel or at myaccount.google.com/permissions. After that no new data can be fetched; to have existing data deleted, use the application routes above.