KVKK Privacy Notice
1. Data controller
Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Warewave Teknoloji Sanayi ve Ticaret Limited Şirketi; address: Esentepe Mah. Talat Paşa Cad. No: 5 İç Kapı No: 1, Şişli / İstanbul, Türkiye; MERSİS: 0800115470600001; trade registry: İstanbul Ticaret Sicili Müdürlüğü, 394936-5; tax office and number: Zincirlikuyu 8001154706; phone: +90 539 841 28 69; e-mail: contact@warewave.tech ("Heimdall") as data controller, as described below. The Turkish version of this notice prevails.
2. Data we process
Identity: first and last name.
Contact: e-mail address; the mobile number you added to your own profile and confirmed through the confirmation link.
Customer transactions: account, plan, monthly SMS and call usage, records of alert SMS and calls sent to you (time, status, masked number), your SMS replies (e.g. ACK, STOP).
Security: IP address, session data, sign-in and activity logs, verification attempts.
Acknowledgement records: which version of which text you accepted and when.
Billing: invoice details. Your card details never reach Heimdall; the payment provider processes them directly.
3. Purposes
Creating your account and entering into and performing the service contract.
Sending alerts by e-mail, SMS and voice call when a system you monitor goes down; processing acknowledgements (ACK) and stop requests (STOP) received by SMS.
Confirming, through the confirmation link, that the number is yours and that you agreed to receive alerts on it, and honouring your STOP request for every organisation.
Billing, usage and fair-use accounting, and payments.
Information security, abuse prevention, legal obligations and the protection of rights in disputes.
Answering your requests and complaints.
Your data is not used for marketing; alert SMS never contain promotional content.
4. Collection method and legal bases
Data is collected electronically through forms on the website and app, the phone verification flow, your SMS replies and system logs.
Legal bases: necessity for entering into or performing a contract (KVKK art. 5/2-c), legal obligations (5/2-ç), establishing, exercising or protecting a right (5/2-e) and legitimate interest without harming your fundamental rights (5/2-f). Where explicit consent is required, it is asked for separately.
5. Transfers
To deliver SMS and calls, your phone number is passed to the mobile operators that carry them.
To our service providers, only as far as their services require: hosting — Huawei Cloud, data centres in Istanbul, Türkiye; backups — the database's backups are encrypted by us and then kept with Amazon Web Services in Stockholm, Sweden (the key stays with us, so Amazon holds data it cannot read); payments — iyzico Ödeme Hizmetleri A.Ş., Türkiye; e-mail delivery — Google Workspace (Google), whose servers are also outside Türkiye, so that your name, your e-mail address and the content of the e-mails we send you are transferred abroad.
Transfers abroad happen only with the safeguards of KVKK art. 9 (e.g. the standard contract published by the Board).
If you link a Telegram account yourself, or your organisation sets up Slack or a webhook as an alert channel, alerts are sent to those services because you or your organisation chose so.
To authorised public bodies when legally required.
Administrators of the organisation your account belongs to (e.g. your employer) can see the status of alerts sent to you, with your number masked.
6. Retention
Data is kept for as long as the purpose and the statutory limitation periods require, then deleted, destroyed or anonymised. When the number is removed from a contact or you reply STOP, alerts stop immediately and the number is deleted within 30 days; only an irreversible digest is kept so that a STOP request keeps working.
7. Your rights (KVKK art. 11)
You may ask whether your data is processed and request information about it; learn the purpose and whether it is used accordingly; know the third parties it is transferred to in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under art. 7; request that corrections and deletions be notified to those third parties; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
Send requests in writing to Esentepe Mah. Talat Paşa Cad. No: 5 İç Kapı No: 1, Şişli / İstanbul, Türkiye, or from the e-mail address registered with us to contact@warewave.tech. Requests are answered free of charge within 30 days. If you are a Heimdall user you can also download your data from your profile page; you can stop SMS and calls at any time by replying STOP.