Privacy Policy

Effective date: 31 October 2026

This is an English translation of the AjandaX privacy policy. The binding version is the Turkish original; if the two differ, the Turkish version prevails.

This policy explains how the AjandaX law office calendar application ("AjandaX") processes personal data and data received from Google accounts. AjandaX is provided by Mert Özkan, registered e-mail (KEP): mehmet.ozkan.01@hs01.kep.tr, e-mail: admin@ajandax.com ("we").

1. Summary

• AjandaX is used by law offices. The office enters and manages the data about its case files, clients and calendar. For this data the office is the data controller and we are the data processor. This is also set out in the service agreement with the office.
• If a lawyer connects a Gmail account, AjandaX reads only the electronic service of process e-mails sent by UETS (uets@bilgi.ptt.gov.tr), the Turkish national e-notification system. It reads no other e-mail, and it never sends, modifies or deletes e-mail.
• If a lawyer connects Google Calendar, AjandaX creates a separate "AjandaX" calendar in the lawyer's Google Calendar and writes and updates the office's court hearings and mediation meetings only in that calendar.
• We do not use data for advertising and we do not sell data.

2. Data we process

User account: name, e-mail address, role (managing partner, partner, associate lawyer, intern, clerk), a one-way hash of the password (bcrypt), notification and e-mail preferences.

Data entered by the office: case files (court, case number, office file number, parties), clients (name, contact details, Turkish ID or tax number), hearings, tasks, notes, notifications of service, mediation records, data protection consent records, client fee, expense and payment records, and the partners' office expense records. Turkish ID and tax numbers are stored encrypted (AES-256-GCM).

Data received from Google accounts: see section 4.

Technical data: an audit log of every change (who changed what and when), application and server logs, and two cookies required for the session (section 8).

3. Purposes and legal grounds

• Providing the service and performing the agreement with the office (Turkish Personal Data Protection Law No. 6698, "KVKK", art. 5/2-c).
• Legal obligations (KVKK art. 5/2-ç).
• Legitimate interest in security, troubleshooting and service continuity (KVKK art. 5/2-f).
• For client data the office relies on its own legal ground; the consent records in AjandaX are a tool for the office.

4. Google user data

4.1 Gmail (gmail.readonly scope)

• What is read: only e-mails whose sender is uets@bilgi.ptt.gov.tr. The Gmail search query is restricted to this sender. On first connection the last 7 days are scanned, then new messages every hour; if the connection breaks and is restored, the period since the break (at most 90 days back) is scanned.
• What is stored: the Gmail message ID, sender, subject, and the court name, case number and UETS barcode extracted from the e-mail, and the date received; if these cannot be extracted, the first 2,000 characters of the e-mail body. Attachments are not downloaded.
• Why: to record the notification of service, match it to the relevant case file and add the resulting deadline to the calendar. The record is visible to authorised users in the office.
• Access tokens: the access and refresh tokens issued by Google are stored encrypted (AES-256-GCM) on our server.

4.2 Google Calendar (calendar.app.created scope)

• What is written: court hearings and mediation meetings; the title holds the court and case number, the description holds the case number, office file number, names of the parties and the type of proceeding.
• Where it is written: only in the "AjandaX" calendar that AjandaX creates. This scope gives no access to your primary calendar or your other calendars; events there are not read, changed or deleted.
• When you disconnect: the "AjandaX" calendar is removed from your Google Calendar, so outdated entries do not stay in your calendar.
• Once written to your calendar, this information is also on Google's servers, where Google's own privacy policy applies.

4.3 Sharing

Data received from Google is used only to provide this service. It is not sold or transferred to third parties, and it is not used for advertising, personalised advertising, credit assessment or training artificial intelligence models. Only the infrastructure providers in section 6 process it, to the extent needed to provide the service and on our instructions. It may be disclosed to competent authorities where required by law.

4.4 Human access

No one on our team reads data received from Google, except: (a) with the explicit consent of the user or the office for a specific record (for example a support request), (b) for security purposes (investigating abuse or an attack), (c) to comply with the law, or (d) aggregated and anonymised data for internal operations.

4.5 Limited Use disclosure

AjandaX's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Retention

• Google tokens: deleted from our server when the connection is removed or when access is revoked at Google.
• Notification of service records: kept for as long as the office's account is open and not deleted automatically; the case history shows from these records when each notification arrived. A notification a user removes from the list is hidden, not deleted. For notifications deleted under the former 2-month rule up to 27 October 2026, only the court, case number, barcode and the dates received and processed remain in the archive.
• Other office data and the archive: kept while the office's account is open. When the agreement ends, the data is delivered to the office as Excel (XLSX) or CSV within 30 days if the office asks, and deleted at the end of those 30 days.
• In-app notifications: deleted automatically after 90 days if read and 180 days if unread.
• Backups: the database is backed up in encrypted form. Daily backups for the last 14 days, weekly for the last 8 weeks and monthly for the last 12 months are kept; older backups are deleted automatically. Deleted data may remain in backups for up to 12 more months.
• Audit logs and e-mail delivery logs: kept while the office's account is open and deleted with the other data when the agreement ends.
• Server logs: at most 30 days at the hosting provider.

6. Infrastructure providers and international transfer

Because these providers' servers are outside Türkiye, data is transferred abroad. Legal basis: the standard contract published by the Turkish Personal Data Protection Board under KVKK art. 9.

7. Security

Connections are encrypted with HTTPS. Passwords are stored as one-way hashes; Google and Todoist tokens and Turkish ID and tax numbers are stored encrypted with AES-256-GCM. Sessions are valid for 8 hours; requests are protected by CSRF protection and rate limiting. Every change is written to the audit log. Backups are encrypted.

8. Cookies

AjandaX uses only two cookies required for the session: a session cookie and a CSRF protection cookie. No analytics or advertising cookies are used. The browser's local storage holds only display preferences.

9. Revoking Google access and your rights

• Disconnecting: AjandaX > Ayarlar (Settings) > Bağlantılar (Connections) > Gmail Tebligat Bağlantısı or Google Takvim eşitleme > Bağlantıyı Kes (Disconnect). The tokens are deleted from our server.
• Revoking at Google: go to myaccount.google.com/permissions, select AjandaX and remove access. AjandaX detects the revocation within one hour and closes the connection.
• Rights under KVKK art. 11: to learn whether your data is processed, to request information, rectification and erasure, to object, and other rights. Requests: admin@ajandax.com or mehmet.ozkan.01@hs01.kep.tr (KEP). Requests about client data must be made to the relevant office; we support the office in handling them.

10. Changes

If this policy changes, the new text is published on this page with its effective date; material changes are notified to users by e-mail. If the purpose for which data received from Google is used changes, users' consent is obtained first.

11. Contact

Mert Özkan, e-mail: admin@ajandax.com, KEP: mehmet.ozkan.01@hs01.kep.tr.