- Legislation
- We process personal data in line with Turkish Law No. 6698 (KVKK) and, where applicable, the GDPR. Every processing activity rests on a specific legal basis, such as explicit consent, performance of a contract, a legal obligation or legitimate interest.
- Retention
- We keep data only for as long as the purpose of processing requires, then securely delete or anonymise it. The retention period for each data category is listed in the Privacy Policy. Data we are legally required to keep, such as invoice records, is retained for the period the law prescribes.
- International transfers
- Depending on server and supplier locations, your data may be transferred outside Türkiye. In that case we apply the appropriate safeguard provided by law, such as an adequacy decision, binding corporate rules or standard contractual clauses, and obtain your explicit consent where required.
- Sub-processors
- We work with suppliers for services such as hosting, model provision, payments and analytics, and share your data only to the extent the service requires. Each supplier's role and terms are explained in the Privacy Policy; we share the current list on request.
- Data subject requests
- You have the right to access your data, to ask for it to be corrected or deleted, and to object to its processing. We resolve requests within 30 days, free of charge. If you find our response insufficient, you can lodge a complaint with the Turkish Data Protection Board.
- Incident response
- If a personal data breach is suspected, we first assess the scope and impact of the incident. Where necessary, we notify affected individuals and the competent authorities within the periods prescribed by law.