Legal information

Privacy, data and cookies

At Pro/Ref, we are committed to transparency about how your personal data is processed. This page summarizes your rights and our obligations.

This page is an informational summary ; the full texts with contractual force are available via the links below .

KVKK Privacy Notice

Privacy Notice on the Processing of Personal Data

Prepared in accordance with Turkish Personal Data Protection Law No. 6698 (KVKK).

Data controller

Pro/Ref Yazılım A.Ş. (legal name and address are stated in the contract document) is the data controller under KVKK. Your organization is the controller of its own employee and participant data; Pro/Ref acts as a data processor in this relationship.

Processing purposes

  • Creating user accounts and authentication
  • Delivering and collecting 360° evaluation forms
  • Generating aggregated (anonymous) reports
  • Platform security and abuse prevention
  • Fulfilling legal obligations

Retention periods

Evaluation data is retained for as long as the organization's subscription is active, and for a maximum of 2 years after it ends. Records subject to legal retention obligations are kept separately in accordance with applicable legislation. At the end of the period, data is permanently deleted or irreversibly anonymized.

Your rights

  • Learning whether your data is being processed
  • Learning the purpose of processing and to whom it is transferred
  • Requesting correction of incomplete or incorrect data
  • Requesting deletion or anonymization once the purpose no longer applies
  • Objecting to processing

You may submit your KVKK-related requests to kvkk@proref360.com Requests made on behalf of your organization are processed through your organization administrator. Full text: KVKK Privacy Notice

Data Processing

Pro/Ref's role as data processor

We process your organization's data solely in accordance with your instructions.

Tenant isolation

Each organization's data is stored technically separated (tenant-scoped) from other organizations. One organization's data can never be accessed by another organization under any circumstances.

Sub-processors

Infrastructure services (cloud hosting, email delivery) are provided by trusted, contracted sub-processors. All sub-processors are either based in Turkey and KVKK-compliant, or provide adequate safeguards.

Data Processing Agreement (DPA)

A Data Processing Agreement (DPA) is signed as part of organization subscriptions. This agreement defines in detail which data is processed and how, the security measures applied, and the obligations of each party.

Have a question about the DPA or data architecture?

Let's review your organization's data flow and security protocols together.

Contact us
Cookie Policy

About cookies

Pro/Ref only uses strictly necessary, functional cookies.

Cookie types used

  • Session cookie (httpOnly) — Required for organization administrator login and evaluator sessions. Deleted when the browser is closed or the session expires.
  • Security cookie (CSRF) — Prevents cross-site request forgery on form submissions.

Cookie types not used

  • Third-party advertising/tracking cookies
  • Behavioral analytics cookies
  • Social media tracking pixels
  • Persistent marketing cookies

Note: Strictly necessary session cookies are required for the platform to function; separate consent is not requested for these cookies (based on legitimate interest under KVKK Art. 5/2-c). Should any additional cookie use begin, this page will be updated and users will be notified.

The sections on this page are summaries; the full contractual texts are published via the links above. For questions, contact us or write to kvkk@proref360.com .