KVKK Notice · simurgh.media

I

SECTION I

Identity of the data controller

The data controller within the meaning of KVKK Art. 3/1-(ı) is Simurgh Medya Yazılım Ticaret Limited Şirketi, established in Türkiye (the "Company", "simurgh.media", "we"). The personal data of everyone who visits our website, uses the client portal, buys services from the Company or contacts the Company is processed as described in this Notice.

Two companies, one portal. Some services under the simurgh.media brand are sold by SIMURGH MEDIA, LLC, established in the United States (Delaware, EIN 38-4335560). The company named on your order or invoice is the controller of your data relating to that service. The client portal and the domain and hosting systems are shared by both companies, so data about your portal account is shared between them with the safeguards described in Section VI. For personal data on sites you host with us, or in projects you give us to work on, you are the controller and we are the processor.

II

SECTION II

Definitions

The terms in this notice are used as defined in KVKK Art. 3:

Personal Data: Any information relating to an identified or identifiable natural person.
Special Category Personal Data: Data on race, ethnic origin, political opinion, philosophical belief, religion, sect, appearance and dress, membership of associations, foundations or trade unions, health, sex life, criminal convictions, security measures, and biometric and genetic data.
Data Subject: The natural person whose personal data is processed.
Data Controller: The natural or legal person who determines the purposes and means of processing and is responsible for setting up and managing the filing system.
Data Processor: The natural or legal person who processes personal data on behalf of the controller, under the authority the controller gives.
Explicit Consent: Consent relating to a specific matter, based on information and given freely.
Anonymisation: Making personal data impossible to link to an identified or identifiable natural person, even when matched with other data.
VERBİS: The Data Controllers' Registry Information System — the official registry where controllers meet their registration duty.

III

SECTION III

Categories of personal data processed

Depending on our relationship with you (visitor, prospect, client, client representative, domain registrant, job applicant), we process the following categories of data:

01

Identity

First and last name, title/position; for invoices issued to individuals, the Turkish ID number where tax law requires it.

02

Contact

E-mail address, phone number, postal address, city, country.

03

Client Transactions

Orders, services, proposals, projects, support tickets and correspondence, language and currency preference.

04

Finance

Tax office/number, invoice and payment records; for card payments, the reference (token) from the payment provider, card brand, last 4 digits and expiry date; an IBAN for refunds. The full card number never reaches us.

05

Transaction Security

Password hash, two-step verification secret and recovery codes, session data, IP address, browser details, portal sign-in and activity records, the result of bot protection (Cloudflare Turnstile).

06

Domains and Hosting

Domain registrant and contact details, name servers, hosting account details, hosting traffic records; for smApp licence activations, the domain, installation ID, version and IP address.

07

Marketing

Newsletter subscription and consent to commercial electronic messages (only with your explicit consent).

08

Requests and Applications

Company, role, topics, budget and timeline from the project request form; message content; CVs for job applications.

Special category data: we do not ask for special category data under KVKK Art. 6; please do not include it in forms or support tickets. If sites you host or your projects contain such data, you are its controller and a separate data processing agreement is made.

IV

SECTION IV

Purposes of processing

Your personal data is processed in line with the principles in KVKK Art. 4 and the conditions in Arts. 5–6, for the following purposes:

01 Preparing proposals, concluding and performing contracts; providing agency, hosting, domain and licence services
02 Opening the client portal account, authentication, two-step verification and running "Sign in with simurgh" (OpenID Connect)
03 Invoicing, collecting payments, charging saved cards for automatic renewals and handling refunds
04 Issuing e-Archive invoices / e-Invoices and running finance and accounting
05 Registering, renewing and transferring domains and meeting ICANN and registry rules (registration data verification, WHOIS/RDAP)
06 Setting up, managing and suspending hosting accounts and preventing abuse
07 Activating and verifying smApp licences
08 Communication, support and request handling; service notices (renewal, invoice and security e-mails)
09 Running information security; preventing fraud and bot attempts
10 Meeting legal obligations (tax, Law No. 5651, commercial records) and informing competent authorities
11 Sending newsletters and commercial electronic messages (only with your explicit consent)
12 Handling legal disputes; assessing job applications

V

SECTION V

Legal basis for processing

Your personal data is processed on the following legal grounds:

Art. 5/2 (a)

Expressly provided for by law

Record-keeping required by the Tax Procedure Law, the Turkish Commercial Code, Law No. 5651, Law No. 6563 and similar legislation.

Art. 5/2 (c)

Concluding or performing a contract

Processing needed for the portal account, orders, providing services, domain registration, hosting, licences, invoicing and payment.

Art. 5/2 (ç)

Legal obligation

Issuing e-Archive invoices/e-Invoices, keeping books and records, answering authority requests, notifications to the KVKK Authority.

Art. 5/2 (e)

Establishing, exercising or defending a right

Collecting receivables and keeping records to be used as evidence in disputes.

Art. 5/2 (f)

Legitimate interest

Information security, sign-in rate limiting, bot and fraud prevention, service quality and support records.

Art. 5/1

Explicit consent

Newsletters and commercial electronic messages; non-essential cookies (if used); occasional transfers abroad under Art. 9/6 after you are told the risks.

VI

SECTION VI

Transfers of personal data

6.1 Transfers within Türkiye (Art. 8)

Limited to the purposes above and in proportion to them, your personal data may be transferred to the following recipients:

Competent public authorities — the Revenue Administration, the KVKK Authority, BTK, courts and prosecutors (where the law requires or a lawful request is made)
Payment and financial institutions — banks and, for card payments, iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), used for the Turkish Company's card payments
e-Invoicing and accounting — Paraşüt, for the Turkish Company's e-Archive invoices/e-Invoices; our accountants and independent auditors
Legal advisers — as far as needed to protect our rights and handle disputes
Our service providers — hosting infrastructure and technical support providers, only as far as the service requires

6.2 Transfers abroad (Art. 9)

Some of our services are provided with providers abroad. Under KVKK Art. 9 as amended by Law No. 7499, transfers abroad are made where one of the processing conditions in Art. 5 or 6 exists; since there is no adequacy decision, primarily with appropriate safeguards such as the standard contracts announced by the KVKK Board (Art. 9/4-c) and, where these cannot be provided and the transfer is occasional, under the exceptions in Art. 9/6 (for example where it is necessary to perform a contract). Standard contracts are notified to the Authority within 5 business days of signing.

Recipient	Country	Data category	Safeguard
SIMURGH MEDIA, LLC (group company)	USA	Portal account, contact, order and invoice records	Standard contract (Art. 9/4-c)*
Stripe, Inc.	USA / EU	Payment details, card reference, invoice amount (card payments to the US company)	Standard contract (Art. 9/4-c)*
Enom (Tucows group), domain registries, ICANN data escrow provider	USA, Canada and the registry's country	Domain registrant and contact details	Occasional transfer necessary to perform the contract (Art. 9/6-b)
Resend	USA	E-mail address, name, content of transactional e-mails	Standard contract (Art. 9/4-c)*
Cloudflare, Inc. (Turnstile)	USA (global network)	IP address, browser and device signals (on form and sign-in pages)	Standard contract (Art. 9/4-c)*
Google LLC (Google Fonts) and the jsDelivr CDN	USA (global network)	IP address and browser details (when the page loads fonts and library files)	[To be assessed: self-hosting or standard contract]
[Hosting infrastructure provider]	[Server location]	Data on the site, the portal and hosting accounts; backups	[Safeguard]
AI providers (client projects only)	USA / EU	Only the data agreed in the project contract; site and portal visitor data is not sent	Project data processing agreement + standard contract*

* Signing of the standard contracts and their notification to the Authority: [to be confirmed]. Where an occasional transfer relies on your explicit consent, you can withdraw it at any time; withdrawal takes effect for the future.

VII

SECTION VII

How personal data is collected

Your personal data is collected electronically or on paper, by partly or fully automated means, through these channels:

Website forms

E-mail correspondence

Phone and messaging

Client portal

Contracts and invoices

Cookies and system logs

Payment providers

Domain and hosting systems

VIII

SECTION VIII

Retention and destruction

Personal data is kept for the period set by law or required by the purpose of processing. When that period ends or the conditions for processing no longer exist, it is deleted, destroyed or anonymised as part of periodic destruction.

Data type	Retention period	Destruction method
Contracts, invoices and accounting records	10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253)	Deletion / physical destruction
Client account, order, service and support records	10 years after the contractual relationship ends (general limitation period, Code of Obligations Art. 146)	Deletion or anonymisation
Saved card references (tokens)	Until you remove the card or close the account	Deletion at the payment provider
Domain registration data	For the life of the registration; at the registrar, up to 2 years after it ends under ICANN rules	Deletion
Traffic data relating to hosting services	At least 1 and at most 2 years, under Law No. 5651 and its regulation	Automatic deletion
Portal security and activity records (IP, browser, sign-ins)	[2 years]	Automatic deletion
Contact and project request form messages	2 years (with the contract records if you become a client)	Deletion
Job applications	1 year	Deletion
Newsletter and commercial message consents	Until consent is withdrawn; consent and opt-out records 3 years after that	Deletion
Cookies	As set out in the Cookie Policy (from the session up to 1 year)	Automatic deletion

IX

SECTION IX · Art. 11

Rights of the data subject

Under KVKK Art. 11 you may apply to the controller to exercise the following rights:

(a)

To learn whether personal data is processed

You can ask whether we process any personal data about you.
(b)

To request information if it is processed

You can ask which data is processed, for how long and for what purpose.
(c)

To learn the purpose and whether data is used accordingly

You can ask whether your data has been used outside the stated purpose.
(ç)

To know the third parties it is transferred to

You can find out which third parties in Türkiye and abroad your data is transferred to.
(d)

To ask for correction of incomplete or inaccurate data

You can ask us to correct inaccurate or outdated data. You can update most of your portal account details yourself.
(e)

To ask for deletion or destruction

Within the conditions of KVKK Art. 7 you can ask for your data to be deleted, destroyed or anonymised. Records we must keep by law (for example invoices) are kept for the statutory period.
(f)

To ask that steps (d) and (e) be notified to recipients

You can ask that a correction or deletion also be notified to the parties your data was transferred to.
(g)

To object to an adverse result from solely automated analysis

You can object to results against you that come from analysis by automated systems alone.
(ğ)

To claim compensation for damage from unlawful processing

You can claim compensation for damage you suffer because of unlawful processing.

X

SECTION X · Art. 13

How to apply

Under KVKK Art. 13 and the Communiqué on the Procedures and Principles of Applications to the Data Controller, you can send requests through the channels below. Requests concerning SIMURGH MEDIA, LLC are received through the same channels. Requests are concluded within 30 (thirty) days at the latest.

10.1 What a request must include (Communiqué Art. 5)

Name, surname and, for written requests, a signature
Turkish ID number (for foreigners: nationality, passport number or ID number if any)
Residential or business address for notifications
E-mail address, phone and fax number for notifications, if any
The subject of the request

Supporting information and documents should be attached.

10.2 Channels

By post or notary

Send your signed written request by registered post with return receipt or through a notary to the address below.

Atatürk Mah. Ertuğrul Gazi Sk. A Blok No: 2E Kat: 21 D: 331, 34758 Ataşehir/Istanbul, Türkiye

By e-mail or KEP

You can apply from the e-mail address registered with us, with a secure electronic or mobile signature, or from your KEP address. KEP: [KEP address]

[email protected]

In person

You can apply in person at our office by showing valid ID.

To book a time: contact page

10.3 Application form

Data Subject Application Form

On request we e-mail you an application form with the fields required by the Communiqué. Using it is optional; any written request containing the details above is accepted.

Request the form by e-mail

10.4 Response time and fees

Under KVKK Art. 13/2 requests are concluded free of charge within 30 days. If the action involves an additional cost, the fee in the tariff set by the Board may be charged.

10.5 Complaint to the Board

If your request is refused, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your request.

Personal Data Protection Authority Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No: 4 Balgat / Ankara www.kvkk.gov.tr · +90 312 216 50 50