Personal Data Protection Notice
Version: 2026-10-12
This is a translation. The Turkish version is the binding text.
This notice explains how your personal data is processed when you sign up for and use the EJO Cloud service (ejocloud.com and the subdomains under ejocloud.com), pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
1. Data controller
[Company name]
[Company address]
Personal data requests: kvkk@ejocloud.com
General support: destek@ejocloud.com
In this notice, "EJO", "we" and "our" refer to the data controller above.
2. What this notice covers and does not cover
This notice covers data that EJO processes on its own behalf and for its own purposes: the signup form, communication with the account owner, billing, support and the security of the service.
The users, repositories, pipelines, deployments and logs of an organization are loaded into the EJO installation set up for that organization (for example acme.ejocloud.com). The data controller for this data is the organization using EJO; for this data EJO is only the data processor, acting on that organization's instructions. To exercise your rights regarding this data, first apply to the organization you work for. EJO's obligations as a data processor are set out in the Data Processing Agreement.
3. What data we process
| Data category | Data | Source |
|---|---|---|
| Identity and contact | Email address | Signup form |
| Customer transaction | Organization name, chosen subdomain, language preference, status of the signup (awaiting verification, awaiting approval, approved, rejected, expired, provisioned), signup, verification and decision dates, version of the legal texts accepted and time of acceptance | Signup form and signup flow |
| Transaction security | The password you choose at signup (only in encrypted form and temporarily; see Section 7), the digest of the email verification link (the link itself is not stored), IP address, technical information sent by the browser, server logs | Signup form, your browser, our servers |
| Marketing | Not processed. We do not send you advertising or campaign emails. | |
| Finance (paid plans only) | Invoice title or full name, billing address, tax office and tax ID number or Turkish national ID number, amount paid, payment date, transaction number issued by the payment institution | You and the payment institution |
| Requests and complaints | What you write to us in support requests and personal data requests | You |
Card details are entered on the payment institution's (PayTR) page and do not reach EJO; we do not see or store your card number.
We do not collect or ask you for special categories of personal data (KVKK Art. 6: health, biometric data, religion, etc.). Do not enter such data in the organization name field or in support correspondence.
4. For what purposes and on what legal basis
| Purpose | Legal basis (KVKK Art. 5/2) |
|---|---|
| Receiving the signup application, verifying the email address, approving or rejecting the application, creating the EJO installation for your organization and defining the account's first administrator (you) | (c) It is directly related to the conclusion or performance of a contract |
| Sending mandatory service notifications: verification, approval, installation ready, suspension, deletion, security incident, price and contract changes | (c) Performance of the contract; for security breach notifications also (ç) legal obligation |
| Protecting the signup form and the service against automated registrations, brute-force attempts and abuse (rate limiting, bot verification, server logs) | (f) Our legitimate interests, provided that your fundamental rights and freedoms are not harmed |
| Keeping billing, accounting and tax records | (ç) Legal obligation (Tax Procedure Law No. 213, Turkish Commercial Code No. 6102); (c) performance of the contract |
| Responding to support requests and personal data requests | (c) Performance of the contract; (ç) legal obligation (KVKK Art. 13) |
| Establishing, exercising or protecting our rights in a dispute; meeting the legal requests of competent authorities | (e) Establishment, exercise or protection of a right; (ç) legal obligation |
None of the processing above is based on explicit consent, so we do not ask you for explicit consent. If we later start processing based on explicit consent (for example a newsletter), we will ask separately, without making it a condition of the service and in a way that lets you withdraw it at any time.
EJO does not make any decision about you based solely on automated processing that significantly affects you. During the beta period, signup applications are approved by a person.
5. How we collect data
We collect data from what you enter in the signup form, from the requests your browser sends to our servers during and after signup, from emails you send us and (on paid plans) from the payment institution, in electronic form, by partially automated means.
6. To whom we transfer data
We do not sell your data and do not share it with anyone for advertising purposes. To provide the service, we transfer data to the following recipient groups, only to the extent necessary:
| Recipient group | For what, which data | Where |
|---|---|---|
| Server and backup infrastructure provider (data processor) | The servers, database and backups on which EJO Cloud runs: all the data in this notice | Türkiye |
| Cloudflare, Inc. (data processor) | Domain name (DNS), TLS and attack protection; if enabled, bot verification on the signup form (Turnstile). Traffic between your browser and our servers, IP address and browser information | USA and Cloudflare's global network |
| Email delivery service provider (data processor) | Delivering service emails: email address, organization name, subdomain, content of the email | European Union |
| Payment institution: PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (paid plans only) | Receiving the payment: the payment institution processes card and payment data under its own privacy notice and on its own responsibility | Türkiye |
| Financial advisor, e-Archive invoice service provider and the Revenue Administration (paid plans only) | Issuing invoices and fulfilling tax obligations: finance data | Türkiye |
| Competent public authorities and institutions, courts | Only where the law expressly requires it and there is a duly issued request | Türkiye |
The current list of data processors, with names, is in the annex to the Data Processing Agreement.
Transfers abroad
EJO Cloud's database, installations and backups are located on servers in Türkiye. However, two of our service providers are located abroad: Cloudflare (USA) carries traffic, and our email delivery provider delivers emails in the European Union. We carry out these transfers under KVKK Art. 9 by signing the standard contracts announced by the Personal Data Protection Board (the "Board") and by notifying the Personal Data Protection Authority within five business days after the contract is signed. We do not ask for your explicit consent for these transfers.
7. How long we retain data
| Data | Period |
|---|---|
| Application whose email address has not been verified | Expires 24 hours after the application; deleted after 30 days |
| Verified but unapproved application | Expires 14 days after verification; deleted after 30 days |
| Rejected application | Deleted 30 days after the rejection decision |
| Password you choose at signup | Kept in EJO Cloud only in encrypted form and until the installation is completed; deleted when the installation step runs, when the application is rejected or when it expires. Only its irreversible digest (bcrypt) is stored in your EJO installation. |
| Account and installation data | As long as the contract continues. When an installation is deleted, a final backup is taken and deleted after 30 days; daily backups are kept for 14 days. The account owner's email address and organization name are removed from our records 30 days after the installation is deleted. Thus, the data of a deleted installation disappears completely, including backups, within 44 days at the latest. |
| Rate-limiting counters of the signup form (IP address, email) | Kept in memory only, not written to disk; deleted at the latest when the server restarts |
| Server and access logs | At most 30 days; if legislation requires longer retention, for that period |
| Invoice and accounting records | 10 years (Turkish Commercial Code No. 6102 Art. 82; Tax Procedure Law No. 213 Art. 253) |
| Support correspondence and personal data requests | 2 years after the request is concluded |
| Legal text acceptance record (version, time) | Same period as account and installation data |
We delete or anonymize data whose retention period has expired in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.
8. How we protect data
- All traffic is encrypted with TLS. Each organization's installation runs in a separate Kubernetes namespace and a separate database.
- Database passwords, installation keys and temporary passwords stored by EJO Cloud are encrypted with AES-GCM. SECRET variables inside installations are encrypted with each installation's own key.
- The email verification link is single-use and valid for 24 hours; only its digest is kept in the database.
- The signup form is CSRF-protected, applies rate limiting and, if enabled, requires bot verification.
- The administration panel is not exposed to the internet.
- In case of a data breach, pursuant to KVKK Art. 12/5 and the Board's Decision No. 2019/10, we notify the Board within 72 hours and the affected persons as soon as reasonably possible.
9. Your rights (KVKK Art. 11)
By applying to us, you may request to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used in accordance with that purpose,
- know the third parties to whom it is transferred within Türkiye or abroad,
- request correction if it is incomplete or incorrectly processed,
- request deletion or destruction within the framework of the conditions in KVKK Art. 7,
- request that the correction, deletion or destruction operations be notified to the third parties to whom the data has been transferred,
- object to an outcome against you resulting from analysis exclusively by automated systems,
- claim compensation for damage if you suffer damage due to unlawful processing.
10. How to apply
Pursuant to the Communiqué on the Procedures and Principles for Applications to the Data Controller, you may submit your application in Turkish and in writing by one of the following means:
- by sending an email to kvkk@ejocloud.com from your email address registered with EJO,
- by sending an email to kvkk@ejocloud.com with a secure electronic signature or mobile signature,
- by delivering a wet-signed petition to the address above by hand or through a notary.
Your application must include your full name, your signature (if the application is written), your Turkish national ID number (if you are a foreigner, your nationality and passport or ID number), your residence or workplace address for notification, your email address for notification if any, your telephone number and the subject of your request. For a ready-made template, you can use the Personal Data Request Form page.
We respond to your application free of charge within 30 days at the latest. If the process requires an additional cost, we may charge the fee in the tariff set by the Board. If your application is rejected, the response is insufficient or no response is given in time, you may lodge a complaint with the Board within 30 days from the date you learn of the response and in any case within 60 days from the date of application.
11. Cookies
EJO Cloud's use of cookies is described in the Cookie Policy. We do not use advertising, analytics or tracking cookies.
12. Changes
When we change this notice, we publish the new version on this page and update the version date. If we are going to start processing your data for a new purpose, we notify the account owner by email before it takes effect.