CLARIFICATION TEXT REGARDING THE
PROCESSING OF CUSTOMERS' PERSONAL DATA

This Clarification Text (Aydınlatma Metni) has been prepared to explain to our customers (individual/corporate) for what purposes, by which methods their personal data is collected, to whom it may be transferred, and your rights within the scope of the Personal Data Protection Law No. 6698 (KVKK).

As a company, we attach importance to the privacy and security of personal data; we process your data in a manner that is compliant with the KVKK, limited to the relevant purpose, proportionate, and secure.

1) Personal Data Processed

Your personal data may be obtained directly from you, through forms/membership/purchase processes on our website, or via the information and documents you provide within the scope of our business relationship.

1.1. Data that may be processed if you are an individual customer

• Full name
• E-mail address
• Phone number
• Reference number
• Address
• Date of birth
• Turkish ID (T.C.) number

1.2. Data that may be processed if you are a corporate customer

• Full name
• Title / position
• Authorised person information
• Turkish ID (T.C.) number or tax number
• Phone number
• E-mail address
• Reference number

1.3. Additional data that may be processed within the scope of the service relationship

If an individual or corporate customer relationship is established, in addition to the above:

• Bank account information
• Signature circulars / authorisation documents
• Passport information (where required)
• IP address used to access the service, browser information and system logs
• Phone call recordings (for communication and service quality purposes)
• Social media account information where communication is established through social media
• Information on the cheque, if payment is made by cheque

may be processed.

1.4. Data processed within the scope of the AI plug-in / digital solutions

If you purchase and use a product/service via our website that contains an artificial intelligence plug-in or similar digital solutions, the commands/instructions/text and other content (prompt data) you submit for the provision of the plug-in, as well as IP address, browser information and system logs, may be processed by our business partners established abroad.

Since your prompt data may, depending on its content, qualify as personal data, we recommend that you only share the information that is necessary. You can find detailed information in the privacy policy of the relevant business partner.

1.5. Credit card payments

If payment is made by credit card, the card information is not stored in full in the Company's systems. For security and transaction confirmation purposes, only limited data such as the cardholder's name and surname, the first 6 and last 4 digits of the card, and the expiry date may be stored. Payment transactions are carried out through the relevant payment service providers.

2) Purposes of Processing Personal Data

Your personal data may be processed in accordance with the principles set out in Article 4 and the processing conditions set out in Article 5 of the KVKK, for the following purposes:

2.1. Account, customer relationship and service provision

• Creation and management of the customer account
• Verification that the account belongs to the relevant person, detection of suspicious situations and ensuring security
• Provision of services and execution of operations
• Management of customer support requests
• Receipt and resolution of requests, complaints and feedback

2.2. Order, payment, invoicing and financial processes

• Creation of orders and tracking of the ordering process
• Collection of payments and ensuring transaction security
• Carrying out invoicing and accounting processes
• Issuance of collection/disbursement receipts
• Retrospective tracking of order and transaction records

2.3. Domain, SSL and licence processes

• Domain account verification in line with ICANN rules
• Provision of the mandatory information required for .tr domain registrations and execution of registration processes
• Domain name registration transactions
• Execution of the mandatory processes for the issuance of certificates within the scope of SSL services
• Registration of licence products and execution of licence processes

2.4. AI plug-in / digital solutions

• Provision of the AI plug-in/digital solution
• Carrying out performance, security, development and improvement activities

2.5. Marketing and communication (including consent-based marketing)

• Increasing customer satisfaction and carrying out satisfaction calls
• Fulfilment of SMS/e-mail sending requests
• Carrying out direct/indirect marketing, personalised marketing and remarketing activities based on preferences
• Carrying out target audience determination, segmentation, cross-selling, internal reporting and analysis activities
• Sending commercial electronic messages (in accordance with the applicable legislation)

2.6. Legal obligations and protection of rights

• Fulfilment of obligations arising from legislation
• Conducting audit processes
• Fulfilment of the burden of proof in possible disputes
• Establishment, exercise and protection of rights

3) Transfer of Personal Data

The Company may transfer your personal data in accordance with the conditions set out in Articles 8 and 9 of the KVKK, limited to the relevant purpose.

3.1. Recipient groups to which transfers may be made within the country

• The relevant banks, payment service providers and certified financial advisors in the event of payment collection
• Certified financial advisors / suppliers from whom services are procured in financial processes for the fulfilment of financial obligations
• Business partners from whom call centre/switchboard services are procured (where used)
• BTK and TRABIS administration for .tr domain registration processes
• Licence manufacturers/intermediary firms for licence services
• SSL manufacturers/intermediary firms for SSL services
• Registrars/intermediary firms and authorised registration bodies for domain registration services
• Message Management System (IYS) – within the scope of legal obligations
• Suppliers from whom services are procured in marketing/communication, customer experience, market research and after-sales processes
• Audit firms
• Public institutions and official authorities legally authorised; law offices for legal proceedings

3.2. Transfer abroad (within the scope of Article 9 of the KVKK)

In accordance with the conditions set out in Article 9 of the KVKK and with the necessary data security measures taken, transfers may be made to:

• ICANN-accredited data storage firms, domain/SSL registration firms and the relevant intermediary firms
• Business partners and the servers abroad of the relevant service providers required for the provision of the AI plug-in/digital solution (e.g. OpenAI, Microsoft Azure, etc.)
• Third-party software in the event of remote technical support (e.g. AnyDesk, TeamViewer, WhatsApp, etc.)

may be subject to transfer.

Note: As a rule, the Company aims to operate its infrastructure/cloud services through data storage facilities located in Turkey. If, at the customer's request, the data is located in storage facilities abroad, the data transfer is carried out in accordance with Article 9 of the KVKK.

4) Methods of Collection of Personal Data and Legal Grounds

Your personal data may be collected through website forms, membership/purchase steps, e-mail, phone calls, contractual processes and as part of the performance of services. Your data may be updated throughout the business relationship.

Your personal data is processed in accordance with Article 5 of the KVKK on the basis of the following legal grounds:

• KVKK Art. 5/2-a: Expressly provided for in the law (Tax/Turkish Commercial Code, etc. obligations)
• KVKK Art. 5/2-c: Necessary for the establishment or performance of a contract
• KVKK Art. 5/2-ç: For the fulfilment of a legal obligation
• KVKK Art. 5/2-e: Establishment, exercise or protection of a right
• KVKK Art. 5/1: Explicit consent in respect of marketing activities

5) Your Rights as a Data Subject (Art. 11 of the KVKK)

Within the scope of the KVKK, you have the right to:

• find out whether your personal data is being processed,
• request information if it has been processed,
• learn the purpose of the processing and whether the data is used in accordance with that purpose,
• know the third parties to whom the data is transferred domestically/abroad,
• request rectification if processed incompletely or incorrectly,
• request erasure/destruction if the reasons for processing no longer apply,
• object to a result arising against you from automated system analyses,
• request compensation for damages resulting from unlawful processing.

You can submit your requests in this context to [email protected]. Applications will be finalised as soon as possible and within a maximum of 30 days, depending on the nature of the request. If the transaction requires an additional cost, a fee may be charged according to the tariff set by the KVKK Board.

6) Data Controller (Company Information)

Data Controller: PROJX Digital İnovatif Teknolojiler A.Ş

Address: Abide-i Hürriyet Cd. Bolkan Center A Blok 211/1/64 Şişli, İstanbul, Türkiye

Tax No: 7331198688

Tax Office: Şişli

E-mail: [email protected]