Personal Data Protection Notice (KVKK)

Data Controller: İŞLEMCİ BİLGİSAYAR YAZILIM İLETİŞİM ÖZEL EĞİTİM İNŞAAT TURİZM PLASTİK HURDA SANAYİ TİCARET LİMİTED ŞİRKETİ

Effective Date: 06.06.2026

1. Identity of the Data Controller

İŞLEMCİ BİLGİSAYAR YAZILIM İLETİŞİM ÖZEL EĞİTİM İNŞAAT TURİZM PLASTİK HURDA SANAYİ TİCARET LİMİTED ŞİRKETİ (hereinafter the "Company"), in its capacity as "Data Controller" within the meaning of Law No. 6698 on the Protection of Personal Data ("KVKK" — Turkey's GDPR equivalent), has prepared this notice in order to inform you regarding the processing of your personal data.

Address: İzmir, Türkiye · Tax ID (VKN): 4820159045 · MERSİS: 0482015904500019

2. Categories of Personal Data Processed

Category	Data Types
Identity	First name, last name, national ID / tax ID, date of birth (optional)
Contact	Email, telephone, address
Financial	Last 4 digits of card (PCI-DSS compliant; full card numbers are not stored)
Transaction Security	IP address, session records, log data
Customer Transaction	Request/complaint records, subscription history
Marketing	Email preference records collected with explicit consent

3. Purposes of Processing Personal Data

Establishment and performance of the contract (KVKK Art. 5/2-c)
Fulfillment of legal obligations — invoicing, e-archive (KVKK Art. 5/2-ç)
Provision of the service and technical support (KVKK Art. 5/2-c)
Information and system security (KVKK Art. 5/2-f)
Marketing communications — separate explicit consent obtained (KVKK Art. 5/1)

4. Location and Retention Periods of Data

All personal data is stored in data centers located in Türkiye (İzmir region). No cross-border data transfers are made.

Retention periods:

Account data: For as long as the account is active + deleted 30 days after cancellation.
Invoice/financial records: 10 years (Tax Procedure Law (VUK) Article 253).
Log records: 2 years (Law No. 5651 — Internet Activity Logging Law).
Marketing consents: Until withdrawn.

5. Third Parties to Whom Data Is Transferred

Payment infrastructure: PayNKolay (NKolay Ödeme A.Ş.) — for card transactions, PCI-DSS compliant.
E-invoicing: Integrator authorized by the Turkish Revenue Administration (mandatory legal transfer).
SMS/Email: NetGSM, Postfix self-hosted SMTP server — for notification purposes only.
Error monitoring: Sentry — IP and error stack traces anonymized/masked.
Judicial/administrative authorities: Limited transfers in response to lawful requests.

No personal data is sold to any third party for marketing purposes.

6. Rights of the Data Subject (KVKK Art. 11)

You have the following rights:

To learn whether your personal data is being processed;
To request information if it has been processed;
To learn the purpose of processing and whether it is being used in accordance with that purpose;
To learn the third parties to whom data is transferred domestically or abroad;
To request correction if data has been processed incompletely or incorrectly;
To request erasure or destruction of personal data;
To object to processing;
To object to adverse outcomes resulting from automated analysis;
To claim compensation in case of damages caused by unlawful processing.

7. Application Methods

Data subject applications may be submitted using the following methods:

Email: {{kvkk_email}}
Registered Email (KEP):
Written petition: İzmir, Türkiye
Self-service: Portal → Settings → KVKK → "Data Request"

Requests are concluded free of charge within 30 days (KVKK Art. 13).

8. Contact Person (DPO)

Data Controller Representative: İŞLEMCİ BİLGİSAYAR LTD. ŞTİ. KVKK Unit · {{kvkk_email}}

This notice was last updated on 06.06.2026.