Skip to content
Sodo CRM
TR EN DE
Book a demo
Last updated: 2026-09-13

Privacy Policy

This policy covers two separate situations: data processed when you visit the sodocrm.com marketing website and our role regarding customer data handled by businesses using Sodo CRM. These involve different legal roles and are explained separately below.

Data controller

Hüseyin Ege Ermiş (Sodo CRM), Şişli Vergi Dairesi
Email: info@sodocrm.com

1. Marketing website visitors

In this section, we are the data controller.

Data we process

Through the demo and contact form, we process your name, email address, phone number, company name, team size and any message you provide. For technical security, your IP address is processed briefly for rate limiting.

Purpose and legal basis

We use this data to respond to your request, assess your needs and plan the proposal and setup process. The legal basis is necessity for steps taken before entering into a contract under Article 5/2(c) of the KVKK and legitimate interest under Article 5/2(f). Rate limiting is based on Article 5/2(f).

Retention period

Demo requests are retained for no more than 24 months from the request date. If a contract is established, the data becomes part of the customer record and is retained for the contract term. Security-related IP records are kept for no more than 30 days.

2. Customer data handled by businesses using Sodo CRM

In this section, the business using the software is the data controller (such as a clinic, agency or other customer). We act as a data processor within the meaning of Article 3/1(ğ) of the KVKK: we host, back up and make the data available under the business's instructions.

The terms of this relationship are governed by a data processing agreement signed with the business. As data controller, the business is responsible for providing required notices and obtaining consent from its own customers.

We access data only when required to respond to a support request or resolve a technical issue, and only to the extent necessary.

3. Where data is stored

Sodo CRM data is hosted on servers located in Istanbul, Türkiye. Databases and files are backed up daily; backups are encrypted on the server before being transferred to a storage provider in the European Union. Only we hold the encryption key, so the storage provider cannot read the backup contents.

This transfer is an international data transfer under Article 9 of the KVKK and is carried out in accordance with the conditions required by applicable law.

4. Third-party service providers

We use the providers below to operate the service. Personal data is never sold or transferred to third parties for marketing purposes.

  • Server hosting — Türkiye
  • Backup storage — European Union, encrypted
  • Meta (Facebook/Instagram) — only for businesses using the lead form integration
  • WhatsApp — only for businesses using the WhatsApp integration
  • Google — only for businesses with AI reporting enabled

5. Security measures

All connections are encrypted with TLS. Passwords are stored using non-reversible hashing. Two-factor authentication is available. Access is role-based and each company's data is isolated from others. Patient photos and message attachments cannot be accessed directly. Backups are encrypted and server access is key-based only.

6. Your rights

Under Article 11 of the KVKK and the GDPR, you may ask whether your data is processed, request information, correction, deletion or transfer, and object to processing.

You can submit your request to info@sodocrm.com. Requests will be completed within 30 days at the latest.

If you are a customer of a business using Sodo CRM, you should first direct your request to that business because it is the data controller. We provide the necessary technical assistance when requested by the business.

7. Cookies

The marketing website does not use marketing or tracking cookies. Only technical cookies necessary for session handling and security are used.

8. Data breaches

If personal data is accessed unlawfully, where we act as data controller we notify the Turkish Personal Data Protection Board as soon as possible and within 72 hours at the latest. Where we act as data processor, we inform the relevant business without delay.

9. Changes

We may update this policy. The current version is always published on this page and the date above is revised accordingly.