KVKK Privacy Notice

This notice is issued by Halil Demirci, as data controller, under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. This document is provided in Turkish and English; in case of any discrepancy, the Turkish version prevails.

1. Data controller

Halil Demirci — ORG.NAFİZ GÜRMAN MAH. 7119 SK. NO: 41 İÇ KAPI NO: 2 BAYRAKLI/ İZMİR — bildirim@kodzoft.com — +905365842617

2. Personal data processed and how they are collected

Your personal data are collected electronically, by automatic or partly automatic means, when you visit the site, fill in a form, open an account, make a purchase or contact us:

• Identity and contact: name, e-mail, phone, company name.

• Billing: billing name/legal name, address, tax office and tax identification number or Turkish ID number (required by law to issue invoices).

• Account and transactions: account creation date, session information, order, subscription, booking and invoice records, the consents you gave and when.

• Payment: the transaction result, transaction ID and amount received from the payment institution. Your card details never reach us; they are processed solely by the payment institution iyzico.

• Request content: what you write in the quote and contact forms, and the topic you state when booking a consulting session.

• Technical: IP address, browser and device information, page visits, cookies (see the Cookie Policy).

3. Purposes and legal bases

• Responding to your quote and contact requests — KVKK Art. 5(2)(c) (necessary for concluding a contract) and Art. 5(2)(f) (legitimate interest).

• Creating your account, verifying your identity, handling orders, subscriptions and bookings, performing the service — Art. 5(2)(c) (performance of a contract).

• Issuing invoices, keeping payment and accounting records, meeting statutory retention obligations — Art. 5(2)(ç) (legal obligation) and Art. 5(2)(a) (expressly provided by law; Tax Procedure Law, Commercial Code, Laws No. 6502 and 6563).

• Keeping consent records and defending our rights in disputes — Art. 5(2)(e) (establishment, exercise or protection of a right).

• Keeping the site secure, preventing abuse, keeping transaction logs — Art. 5(2)(f) (legitimate interest).

• Analytics and marketing cookies — only with your explicit consent (Art. 5(1)); you can withdraw consent at any time from the cookie preferences.

4. Transfers

Your data are transferred only for the purposes above and to the extent necessary, to the following categories of recipients:

• Payment institution (iyzico Ödeme Hizmetleri A.Ş., Türkiye): taking payment, fraud prevention and refunds.

• Hosting and infrastructure provider (Vercel Inc.) and database provider (Neon): hosting the site and data on servers located in the European Union (Frankfurt). These providers are headquartered abroad; the transfer is made under KVKK Article 9 with the safeguards required by the Personal Data Protection Board (standard contract).

• E-mail delivery provider: delivery of transactional e-mails (verification, orders, invoices, bookings).

• Accountant and e-invoice integrator: invoicing and accounting obligations.

• Competent public authorities: where legally required and limited to their request.

Your data are not sold or shared with third parties for marketing purposes.

5. Retention periods

• Order, payment and invoice records and the consent records linked to them: 10 years from the end of the relevant year under the Commercial Code (Law No. 6102) and the Tax Procedure Law (Law No. 213).

• Account details: as long as the account is open; deleted when the account is deleted (records subject to statutory retention are kept detached from your account).

• Quote and contact requests: 2 years after the request is closed.

• Booking records: together with the order they belong to.

• Transaction and security logs: 2 years.

• Cookies: the periods stated in the table in the Cookie Policy.

Data whose retention period has expired are deleted, destroyed or anonymised.

6. Your rights (KVKK Article 11)

By applying to the data controller you have the right to learn whether your personal data are processed; to request information if they are; to learn the purpose of processing and whether the data are used in line with it; to know the third parties to whom they are transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under KVKK Article 7; to request that these operations be notified to third parties to whom the data were transferred; to object to a result arising against you from analysis solely by automated systems; and to claim compensation for damage caused by unlawful processing.

7. How to apply

You can submit your application by e-mail to bildirim@kodzoft.com or in writing to ORG.NAFİZ GÜRMAN MAH. 7119 SK. NO: 41 İÇ KAPI NO: 2 BAYRAKLI/ İZMİR. Users with an account can request an export of their data and delete their account from the account page. Applications are concluded free of charge within 30 days at the latest, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Additional information may be requested to verify your identity.