KVKK Data Privacy Disclosure

Last Updated: 05/06/2026

1. Identity of the Data Controller

In accordance with the Law on Protection of Personal Data No. 6698 ("KVKK"), your personal data will be collected and processed by Xpensio Yazılım A.Ş. ("Company") as the data controller within the scope described below.

2. Purposes of Processing Personal Data

Your collected personal data may be processed for the following purposes within the conditions of personal data processing specified in Articles 5 and 6 of the Law:

• Conducting the necessary work by our business units so that you can benefit from the products and services offered by our Company,
• Ensuring legal, technical, and commercial business security of the relevant persons in a business relationship with our Company,
• Analyzing and verifying OCR and receipt scanning operations within the application on our systems.

3. Transfer of Personal Data

Personal data belonging to our customers may be transferred to our business partners (SAP and other integration companies), suppliers, and legally authorized public institutions for the purpose of carrying out our company activities, in accordance with the conditions specified in Articles 8 and 9 of KVKK.

3a. Cross-Border Data Transfer (KVKK Article 9)

Our SaaS infrastructure is hosted at the Hetzner Online GmbH Frankfurt (Germany) data center. Therefore, your personal data is transferred to and processed within the European Union under your explicit consent in accordance with KVKK Article 9. Hetzner operates under EU GDPR with ISO 27001 certified data centers. Enterprise customers may opt for the BYOC (Bring Your Own Cloud) deployment model, in which case no data leaves their own infrastructure and no cross-border transfer occurs.

4. Your Rights Under Article 11 of KVKK

As personal data subjects, you may submit your requests regarding your rights within the scope of Article 11 of KVKK, together with identity-verifying documents, to: kvkk@xpensioapp.com