Privacy Notice under Article 10 of the Turkish Data Protection Law (KVKK)
Last updated: August 18, 2026 · Version 1.1
This document is provided for convenience only; the Turkish version prevails, and in the event of any discrepancy between the versions the Turkish text governs. This privacy notice (the "Notice") has been prepared by OYOX LLC, acting as data controller (the "Company" or "Data Controller"), pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, in order to inform visitors of the bluehams.com website (the "Platform"), persons who use the demo request form or otherwise contact the Company, BLUEHAMS (the "Service") customer account holders, and billing contact persons (together, the "Data Subject") about the processing of their personal data ("Personal Data"). This Notice takes effect on 17 August 2026. Patient data recorded in the Service by our customers (the "Customer"), i.e. the hearing aid centers (each a "Clinic"), falls outside the scope of this Notice; that distinction is explained in a dedicated section below.
Identity of the Data Controller
With respect to the Personal Data described in this Notice, the data controller is OYOX LLC, a Domestic Limited Liability Company registered with the New Mexico Secretary of State on 23 February 2026 under registration number 0008084103. BLUEHAMS, referred to as the "Platform" and the "Service", is the brand and product name of the Company's subscription-based software service for hearing aid centers, which does not involve any transfer of source code or reproduction rights.
- Legal name: OYOX LLC
- Registered (postal) address: 1209 Mountain Road PL NE, STE N, Albuquerque, NM 87110, United States
- E-mail: kvkk@bluehams.com (will become active once the Company's e-mail infrastructure is in place)
- Web: bluehams.com (contact form)
Scope — Who This Notice Informs
This Notice covers only the Personal Data that the Company processes in its capacity as a data controller. That data belongs to the following groups of Data Subjects:
- visitors of the Platform (bluehams.com),
- persons who use the demo request form or otherwise contact the Company through its channels,
- customer account holders in respect of the Service (the Clinic owner and the panel users defined by the Clinic),
- billing contact persons involved in subscription and payment processes.
Categories of Personal Data Processed
The Personal Data processed by the Company is limited to the following:
- Demo request form data — full name, clinic name, e-mail address, phone number, number of branches, and free-text message.
- Account registration data — first name, last name, e-mail address, phone number, username, and password (passwords are stored only as cryptographic hashes and never in plain text).
- Subscription and payment data — subscription payment records and payment receipts uploaded through the panel after a bank transfer. The fee is collected by bank transfer; no credit card data is collected.
- Security and activity records — IP address and login attempt records, user activity history (activity log), administrator audit records, two-factor authentication (2FA) recovery codes, and password reset records.
- Cookie data — a strictly necessary session cookie and a language preference cookie (hams_lang). The Platform uses no advertising or analytics cookies or trackers of any kind; see the Cookie Policy for details.
No special categories of Personal Data within the meaning of Article 6 of the Law (including health data) are collected from the Data Subject groups covered by this Notice.
Purposes of Processing and Legal Bases
Your Personal Data is processed for the specific, explicit, and legitimate purposes matched per category in the table below, relying on the legal bases listed in Article 5, second paragraph, of the Law. The Company carries out no processing activity based on your explicit consent, and your Personal Data is not profiled for marketing purposes.
| Data category | Purpose of processing | Legal basis (Law Art. 5/2) |
|---|---|---|
| Demo request form data | Receiving and evaluating the demo request, scheduling the demo presentation, communicating with the Data Subject about the request | Art. 5/2-c — directly related to the conclusion or performance of a contract (pre-contractual steps) |
| Account registration data | Creating and managing the customer account, authentication, providing the Service, handling support requests | Art. 5/2-c — performance of the contract |
| Subscription and payment data | Tracking collection of subscription fees, verifying and matching uploaded receipts, issuing commercial invoices, keeping commercial and financial records under the Turkish Commercial Code and applicable fiscal legislation | Art. 5/2-c — performance of the contract; Art. 5/2-f — legitimate interest in keeping orderly and accurate commercial records |
| Security and activity records | Ensuring information security, preventing unauthorized access and brute-force attacks, detecting account security incidents, maintaining an audit trail | Art. 5/2-f — legitimate interest, provided your fundamental rights and freedoms are not harmed; Art. 5/2-ç — fulfilling the data security obligation under Article 12 of the Law |
| Session and language cookies | Maintaining your session and protecting authentication, remembering your language preference | Art. 5/2-c — performance of the contract; Art. 5/2-f — legitimate interest |
| All categories (upon request) | Responding to lawful requests of competent public authorities, establishing proof and exercising the right of defense in legal disputes | Art. 5/2-ç — fulfillment of a legal obligation; Art. 5/2-e — establishment, exercise, or protection of a right |
Method of Collection
Your Personal Data is collected electronically, by fully or partly automated means, through the following channels:
- through the demo request form on the Platform,
- through the information you enter during account registration and panel use,
- through the payment receipts you upload via the panel during the subscription process,
- automatically, through session and language preference cookies and through login attempt, activity, and audit records (logs).
No data is collected through any other channel, such as printed forms, call centers, or third-party data providers.
Recipient Groups and International Transfers
Your Personal Data is transferred only to the recipient groups below and only for the stated purposes, within the conditions set out in Articles 8 and 9 of the Law:
| Recipient group | Purpose of transfer | Notes |
|---|---|---|
| Hosting provider — Hostingdünyam (CNC Bilişim Hizmetleri Ltd. Şti.) | Operation of the server infrastructure on which the Service runs | The servers are located in Istanbul, within the Republic of Türkiye |
| Competent public authorities and institutions | Responding to lawful requests for information and documents | Only upon request and limited to the request (Law Art. 8/2) |
Retention Periods
Your Personal Data is retained for the maximum periods required by the purpose of processing and prescribed by applicable legislation; at the end of that period it is deleted, destroyed, or anonymized in accordance with Article 7 of the Law and the Regulation on the Deletion, Destruction, or Anonymization of Personal Data. By way of example, in-application audit records are automatically deleted after 730 days (2 years), and encrypted backups are retained for 14 days. For category-based retention periods and the periodic destruction procedure, see the Retention and Destruction Policy page.
Your Rights under Article 11 of the KVKK
Under Article 11 of the Law, you have the right to apply to the Data Controller and to:
- Learn whether your Personal Data is being processed,
- Request information if your Personal Data has been processed,
- Learn the purpose of processing and whether the data is used in accordance with that purpose,
- Know the third parties to whom your Personal Data is transferred, whether in Türkiye or abroad,
- Request correction of your Personal Data if it is incomplete or inaccurate,
- Request deletion or destruction of your Personal Data under the conditions set out in Article 7 of the Law,
- Request that operations carried out under items (5) and (6) be notified to third parties to whom your Personal Data has been transferred,
- Object to a result arising against you through the analysis of your data exclusively by automated systems,
- Claim compensation if you suffer damage due to unlawful processing of your Personal Data.
How to Apply and Response Time
You may submit requests concerning your rights under Article 11 of the Law, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (the "Application Communiqué"), through the channels below. The primary channel for your applications is the OYOX LLC (USA) postal address above:
- Written application — post (primary channel): by sending your signed application to the Company's postal address at 1209 Mountain Road PL NE, STE N, Albuquerque, NM 87110, United States, in person, through a notary, or by registered return-receipt mail,
- Application form: through the dedicated application form on the KVKK Application page of the Platform,
- E-mail (secondary channel): via kvkk@bluehams.com; this e-mail channel will become active once the Company's e-mail infrastructure is in place, and until then you are advised to direct your applications to the OYOX LLC (USA) postal address above.
Under Article 5 of the Application Communiqué, your application must include your full name, your signature if the application is in writing, your Turkish ID number for citizens of the Republic of Türkiye, your nationality together with your passport number or national ID number if available for foreign nationals, your residential or business address for notification, your e-mail address, phone number, and fax number for notification if available, and the subject of your request. For details of the application process and the form, see the KVKK Application page.
Your application will be concluded free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request. However, if the process additionally incurs a cost, the fee schedule set out in the Application Communiqué may apply. If your application is rejected, the response is found insufficient, or no response is given in time, you retain the right to lodge a complaint with the Board within thirty days of learning of the response and in any event within sixty days of the date of application (Article 14 of the Law).
Important Clarification Regarding Patient Data
BLUEHAMS is electronic software through which hearing aid centers manage their patient registration and follow-up processes; it does not replace the written patient register but serves a supporting function alongside it. With respect to the patient data recorded in the Service by our Customer Clinics (patient identity and contact information, health data such as hearing and device information, patient documents, and collection records), the data controller is the relevant Clinic; the Company acts solely as a data processor, processing that data only on the Clinic's instructions and on its behalf.
- The obligation to inform under Article 10 of the Law with respect to this data rests with the relevant Clinic as data controller; patients are informed by the Clinic.
- Applications by patients under the Law must be addressed to the relevant Clinic. If such an application reaches the Company by mistake, it is forwarded to the relevant Clinic without delay.
- The terms of the data processing relationship between the Company and the Clinics, the parties' obligations, and the security commitments are governed by the Data Processing Agreement concluded under Article 12 of the Law.
Effective Date and Changes
This Notice took effect on 17 August 2026. It may be updated in the event of legislative changes, changes in the Company's processing activities, or in line with decisions of the Board; the current version is always published on the Platform (bluehams.com) and takes effect on its date of publication. For more comprehensive information on the processing of Personal Data, see the Privacy Policy page.