KVKK Data Protection Notice

1. Identity of the data controller

The data controller within the meaning of Article 3 of the KVKK is KuantTrade. Its registered name, country of incorporation, registration number and address for service appear below; this notice does not take effect until they are recorded.

Where the data controller is not established in Türkiye, whether the KVKK provisions on a controller’s representative and registration with the Data Controllers Registry (VERBİS) apply is assessed separately, and the outcome is published in this section.

2. Definitions

Terms used in this notice carry the meanings given in Article 3 of Law No. 6698. The principal ones, and those specific to this Service, are set out below for convenience.

• Personal data: any information relating to an identified or identifiable natural person.
• Special categories of personal data: the data listed in Article 6 of the Law (race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal conviction and security measures, and biometric and genetic data). The Company neither requests nor processes data of this kind, and none of the categories in Section 3 falls within it.
• Processing of personal data: any operation performed upon personal data, wholly or partly by automated means or by non-automated means forming part of a filing system, including obtaining, recording, storing, retaining, altering, disclosing, transferring, classifying or preventing the use of that data.
• Data controller: the person who determines the purposes and means of processing and is responsible for establishing and managing the filing system. For this notice the data controller is the company identified in Section 1.
• Data processor: a person who processes personal data on behalf of the data controller under the authority given by it. The providers listed in Section 6 act in that capacity.
• Data subject: the natural person whose personal data is processed. For this notice that is the person who uses or visits the Service.
• Filing system: a system in which personal data is processed, structured according to defined criteria.
• Explicit consent: consent relating to a specific matter, given on an informed basis and by free will. This document is a notice; as Section 5 shows, the legal basis for processing is as a rule not explicit consent, and where consent is relied upon it is asked for separately and expressly.
• Account: the User’s account with the Service. A brokerage account is distinct from it: that account is governed by the relationship between the User and the broker, and the assets are held there.

3. Categories of personal data processed

2.1 Identity and contact data.

Username, email address and, optionally, a display name. The password is not stored: where a password credential is held by us it is kept only as a salted one-way hash, and where authentication is delegated to an identity provider the password never reaches us.

2.2 Transaction security data.

Session records, the IP address and browser of the device that signed in, a device notification token where notifications are enabled in the mobile app, server request logs, and audit records of security events such as sign-in, credential change, broker connection and permission change.

2.3 Financial and trading data.

Account identifiers and metadata for a connected brokerage account; positions, orders, executions, balances, cash and buying power read from it; the strategies created and their configuration; backtest and simulation runs and their results; and performance figures computed from them. Brokerage credentials (delegated-access tokens or keys) are stored encrypted under keys held in a separate secret store.

2.4 AI interaction data.

Where an AI feature is used: the request made, the account context assembled to answer it, the model’s response, any draft configuration or order parameters produced, and the decision taken on each.

2.5 Machine access records.

Where API credentials are issued or a third-party client is authorised: which client connected, when, under what scope, and what it requested.

2.6 Customer transaction and marketing data.

Support correspondence and our replies; and, where paid plans are offered, the customer and subscription identifier, plan, status and the last four digits and brand of the card, received from the payment processor. The full card number and security code do not reach us.

2.7 Data not processed.

We do not process special categories of personal data within the meaning of Article 6 of the KVKK (health, biometric data, political opinion and the like). We do not request identity documents; a broker may, but such a document does not reach us. Our website runs no analytics, advertising or tracking technology.

4. Method of collection

Personal data is obtained wholly or partly by automated means, through the following channels:

1. directly from the data subject: through the registration form, product configuration, strategy definitions and support requests;
2. automatically from the device: request records, IP address and browser information generated by use of the Service;
3. from the connected broker: on connection and thereafter as positions and orders change, through its application programming interface;
4. from the identity provider, where sign-in through one is chosen;
5. from the payment processor, in respect only of the subscription data listed in Section 3.6.

5. Purposes of processing and legal grounds

Personal data is processed for the purposes below, on the KVKK grounds stated against each. No line rests on explicit consent except marketing messages, which are sent only on request.

Where we rely on legitimate interest, we have assessed whether that interest harms the data subject’s fundamental rights and freedoms, and an objection may be raised at any time under Section 11.

6. Recipients of personal data and the purpose of each transfer

5.1 Providers processing on our behalf.

Transfers to the categories of recipient below are made for the stated purpose and under contract. Some of those providers, and a payment service provider in particular, may also act as an independent data controller in respect of their own statutory obligations and their fraud-prevention, security, accounting or regulatory obligations; processing of that kind is governed by that provider’s own notice. Rows marked "conditional" apply only where a deployment or feature is configured to engage that category. The current list of the actual providers behind each category is available on request through the procedure in Section 12.

5.2 Recipients the data subject brings in, acting for themselves.

5.3 Other transfers.

• To legal, accounting and audit advisers under a duty of confidence, to the extent necessary (Art. 8(2)(a) referring to Art. 5(2)(f)).
• To competent public authorities and courts where disclosure is required by law (Art. 8(2)(a) referring to Art. 5(2)(ç)).
• To an acquirer in connection with a merger, acquisition, financing or transfer of assets, subject to this notice continuing to apply to the data transferred and with prior notice.

7. Transfers abroad

6.1 Transfers occur.

Our servers are in the European Economic Area. Some of the providers listed in Section 6 are in the United States, and a connected broker may be in any country. Personal data is therefore transferred abroad.

6.2 Basis for the transfer.

Transfer abroad is governed by Article 9 of the KVKK. For transfers to a country for which the Board has not published an adequacy decision, the standard contract published by the Board is executed and notified to the Authority within five business days of signature; alternatively, and only where their conditions are met, binding corporate rules or the incidental-case exception in Article 9(6) are assessed.

8. Retention periods

Personal data is retained for as long as is necessary for the purpose for which it was processed and for the minimum periods prescribed by applicable legislation; on expiry it is erased, destroyed or anonymised.

9. Technical and organisational measures

• Encryption in transit using current industry-standard transport security; encryption at the storage layer.
• Brokerage credentials encrypted under keys held in a separate secret-management system and never written to environment variables, configuration files or logs.
• Passwords stored only as salted one-way hashes, and not stored at all where authentication is delegated.
• Session tokens held server-side; the browser receives only a cookie that page scripts cannot read and that is sent solely over an encrypted connection.
• Access to production systems restricted, individually attributable and logged.
• Services segmented at the network layer.
• Security-relevant events written to an audit log that ordinary application code cannot amend.

These measures state the practice followed as at the version date of this notice and are updated as technology develops.

10. Automated analysis and profiling

No decision producing an adverse result for the data subject is taken by analysing them exclusively through automated systems. No credit scoring, eligibility scoring or automated account decision is applied.

The Service does perform automated actions in a connected brokerage account. Those actions follow the rules the data subject wrote, the settings they chose and the bounds they set; they are a decision the data subject made in advance rather than a decision taken about them, and they can be stopped at any time.

Where the data subject invokes an artificial-intelligence feature, that feature may use the account data described in Section 3 to compose parameters or a draft responsive to their request. The parameters used are shown to them. The result is as a rule a draft, and an order is transmitted upon their confirmation; the exception is where they have adopted an automation setting under which a class of order instruction is transmitted without individual confirmation. In that case too the operative decision is the one they made in adopting that setting, and the setting can be withdrawn at any time. No eligibility, suitability, credit or account decision is taken about them as a result of that processing.

11. Rights of the data subject (KVKK Art. 11)

Under Article 11 of the KVKK, by applying to the data controller, the data subject has the right to:

1. learn whether personal data concerning them is processed;
2. request information as to processing if it has occurred;
3. learn the purpose of processing and whether the data is used in accordance with that purpose;
4. know the third parties in Türkiye or abroad to whom the data has been transferred;
5. request rectification where the data is incomplete or inaccurate;
6. request erasure or destruction within the conditions set out in Article 7;
7. request notification of rectification, erasure or destruction to the third parties to whom the data was transferred;
8. object to a result arising against them from analysis exclusively by automated systems;
9. claim compensation for damage suffered by reason of unlawful processing.

12. How to apply

A request in respect of those rights may be made in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, stating the applicant’s name and surname, a signature where the application is in writing, their Turkish identity number (nationality and passport number for foreign nationals), their address for service, any email address and telephone number for notification, and the subject of the request.

The application may be sent in writing to the address for service in Section 1, or from the email address registered on the account to privacy@kuanttrade.com. It is concluded free of charge as soon as possible and in any event within thirty days; where the process entails a cost, the fee in the tariff set by the Board may be charged.

Where the application is refused, the response is found insufficient, or no response is given in time, a complaint may be made to the Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the application.

13. Changes and effect

This notice is updated when processing activities change, and each version carries a version number and an effective date. The current text is published at https://kuanttrade.com.

The Turkish text of this document governs. The English is published as a courtesy; unlike our other legal documents, the binding language of this one is Turkish.