Identity Verification Privacy Notice

01

Why do we ask for it?

1. To verify your real identity and lock your account to that identity. When you sign for the first time, the Turkish ID number and first and last name read from your qualified electronic signature certificate (e-signature card or mobile signature) are compared on the server with the information you entered in your profile. The electronic certificate service provider (ESHS) that issued your certificate is obliged, under the Elektronik İmza Kanunu (Electronic Signature Law No. 5070), to establish your identity face to face before issuing the certificate; we rely on this identification and do not additionally run a query against any government system. The first successful match marks your identity as "verified" and locks your account to that TCKN and name: from then on you cannot change your first name, last name, and Turkish ID number yourself (a change request = the KVKK right to correction, see the "Your rights" section). The purpose: to make sure that the account really belongs to the person who holds that ID number, to be able to tell in later signatures whether the signature belongs to the account holder, and invoice accuracy.
2. To tell, in every later signature, whether the signature belongs to you. In every signature after the lock is established, the ID number in the certificate is compared again with the (locked) number in your account. If they do not match, the signature is counted as another person's signature on your account: your account is not closed, your lock and identity status do not change, and this signature is added to the monthly sharing counter. The signer's identity information is not recorded (Privacy Policy, "Signatories who are not account holders").
3. To give each person a single verified account. An ID number can be verified on only one account with an e-signature certificate; if we find the number verified on another account, we show the warning "This Turkish ID number is registered on another account". When the true owner of the number verifies their identity with their certificate, the number is deleted from other (unverified) accounts that have entered the same number. This prevents gift entitlements from being claimed more than once and prevents misuse. If you delete your account, the number is released.
4. For invoicing. On the e-Arşiv invoice issued by DRN (for entitlements granted as gifts and transactions that DRN collects payment for directly), the recipient's name and address are mandatory by law; your Turkish ID number appears on the e-Arşiv invoice that is issued.

We do not use your ID number for any other purpose (marketing, profiling, sale to third parties); we do not query it against any government system. We never ask for your date of birth (including the year). Before your first signature, you can correct the first name, last name and Turkish ID number in your profile yourself; if they do not match the information in the certificate, the signed document is delivered with the note "identity not verified", your account is not considered verified, and this signature is counted as another person's signature. If the signature is yours, correct the information in your profile and sign again.

02

Legal basis

• Identification by certificate and lock: its being necessary for the conclusion and performance of the usage agreement between us (Article 5/2-c of Law No. 6698) and our legitimate interest in preventing abuse (Article 5/2-f). The Turkish ID number is not special-category personal data within the meaning of Article 6 of the Law.
• Lock verification in later signatures and single account: on the same grounds, Article 5/2-c and Article 5/2-f.
• Invoicing: fulfillment of our legal obligation (Article 5/2-ç; Article 230 of the Vergi Usul Kanunu, the Tax Procedure Law).

These operations are not based on your explicit consent; that is why we do not ask for consent separately. You are not obliged to provide identity information; however, if you do not, you cannot sign — viewing and signature verification of documents continue to work without an account and without identity information.

03

How do we store and protect it?

• Your ID number is kept on the server in a closed area that neither the app nor administrators can read directly; comparisons are made over a one-way digest produced with a secret key. It is shown masked on the app and portal screens (123******01); its full form is revealed only to you and, through a recorded action, to our authorized administrator.
• In the app, you can see the plain form: the "Show" button requires you to have signed in again within the last 5 minutes; a limited number of displays can be made per day, and every display is logged.
• Our authorized administrator may, when needed for support, account security, invoicing, and legal obligations, view your full Turkish ID number, address and phone and perform an identity comparison; every viewing and every comparison is entered into a record that cannot be deleted, together with who saw which information and when (the values viewed are not written to the record). Moderators can never see this information.
• The ID number read from the certificate and the certificate itself are not stored; only the match result (matched / another person's certificate / did not match before the lock), the name match and the time are recorded. The first successful match also creates the lock record (lock date, channel — e-signature card or mobile signature).
• The data is kept on Google Firebase infrastructure, in Google's European multi-region (eur3); your account's sign-in/authentication record (Firebase Authentication), however, is operated by Google only in the United States. For invoicing, the name, address, ID number, and email address are passed to our e-Arşiv integrator in Türkiye (Uyumsoft).

04

For how long?

For as long as your account is open. When you delete your account, your identity and address information is deleted; only the information on issued invoices is kept, for the statutory retention period (10 years), with its link to your account removed.

05

Your rights

To exercise your rights under Article 11 of the Law (obtaining information, correction, deletion, objection), you can write to privacy@drnportal.com from your email registered in the system, or use the other channels on the KVKK Application page. You can always correct your address yourself in the app. Until you make your first signature, you can also correct your first name, last name and Turkish ID number yourself in the app. After your first signature, these three items are locked, and you cannot change them yourself in the app; if they were entered incorrectly or have changed legally (e.g., a name change), you can request correction through support, with a document that proves your identity, by writing to privacy@drnportal.com or through the KVKK Application page — we review your request and remove the lock. If the lock is removed and the ID number changes, the certificate match is performed again at the next signature.

Detailed information: Privacy Policy and Privacy Notice.