Last updated: 21 October 2026
This policy explains how personal data is processed on the osvoy.com website and within the Osvoy Verify identity verification service, both operated by OSVOY YAZILIM LİMİTED ŞİRKETİ ("Osvoy",
"we").
Contact: [email protected] Address: Erzene Mah. Ankara Cad. Ebiltem No: 172/14 Bornova/İzmir, Türkiye
1. Two distinct capacities
Data protection law gives us two different roles, and this policy treats them separately:
- As a controller — for the data of website visitors and anyone who contacts us.
- As a processor — for the identity and biometric data we handle when verifying our customers' end users. For that data the controller is the organisation using the service; we process it only on their instructions. The framework is set out in our Data Processing Agreement.
2. Data processed on the website
Analytics. To measure how the site is used, Google Analytics runs in Google's advanced consent mode. Analytics cookies are set only if you consent in the cookie prompt (legal basis: your explicit consent, KVKK Art. 5(1), GDPR Art. 6(1)(a)); before consent, or if you decline, Google receives only cookieless signals with no persistent identifier (legal basis: legitimate interest, KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)). No advertising trackers are used. You can withdraw consent at any time from the Cookie Preferences link at the bottom of every page. Cloudflare Web Analytics also measures page-load performance; it sets no cookie and does not recognise you between visits (legal basis: legitimate interest, KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)). See the Cookie Policy for detail.
Contact form. When you submit the form we process your name, phone number, email address, the content of your message and the IP address the request came from. This is passed to our email infrastructure for the sole purpose of answering you.
- Legal basis: legitimate interest, and where your enquiry is pre-contractual, the steps taken at your request prior to entering a contract — GDPR Art. 6(1)(f) and 6(1)(b); KVKK Art. 5/2-f and 5/2-c.
- Retention: at most 2 years from the conclusion of the enquiry.
Language preference. Your chosen interface language is kept in your browser's localStorage.
It never leaves your browser and is never sent to us.
3. Data processed in the verification service
On behalf of our customers, and only to the extent the verification flow requires, we process: identity document images and the data on them, selfie images, biometric templates, liveness results, sanctions and PEP screening output, and transaction timestamps.
Biometric data is a special category of personal data under GDPR Art. 9 and KVKK Art. 6. It is processed only where the data subject has given explicit consent or another lawful basis relied on by our customer applies. Obtaining that basis is the customer's responsibility as controller.
The retention period is set by our customer. In Zero Data Retention mode, raw images and biometric templates are permanently deleted the moment verification completes; only the verification result itself and the audit record remain with us.
4. Transfers
Data is shared with the providers we rely on — hosting, email delivery, sanctions list providers — and only to the extent the service requires. Where a transfer leaves the country, the safeguards under GDPR Chapter V and KVKK Art. 9 apply. Google Analytics data may be processed by Google, and Cloudflare Web Analytics data by Cloudflare, outside the country, including in the United States.
We do not sell personal data and we do not pass it to third parties for marketing.
5. Security
Data is encrypted both in transit and at rest using industry standard protocols (TLS 1.3 / AES-256). Access is limited to staff who need it for their role, and every verification step is recorded with a timestamp.
6. Your rights
Under GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing. Under KVKK Art. 11 you may learn whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to at home or abroad, request correction or erasure where the conditions are met, and require that these actions be notified to those third parties.
Send requests to [email protected]; we respond within 30 days at the latest. Requests about data processed within the verification service are forwarded to the relevant controller.
7. Changes
When this policy is updated, the "last updated" date above changes. Customers are notified separately of material changes.