Data Protection Notice (KVKK)

This Notice has been prepared by SETURA YAZILIM VE TİCARET LİMİTED ŞİRKETİ, in its capacity as data controller, in accordance with Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

It explains the scope, purposes and legal grounds on which we process your personal data. For a general description of our data practices, see our Privacy Policy, and for cookies and similar technologies our Cookie Policy. This Notice does not repeat those policies.

1. Identity of the Data Controller

SETURA YAZILIM VE TİCARET LİMİTED ŞİRKETİ
Address: Fenerbahçe Mah. İğrip Sok. No: 13/1, Kadıköy / İstanbul, Türkiye
MERSIS No: 0764-0921-2410-0001  ·  Trade Registry No: 1124126
Tax Office / No: Göztepe / 7640921241
Email: [email protected]
Website: setura.tr

2. Scope of This Notice

Your personal data is processed across two distinct channels of our business. Which channel you use also determines who is responsible for processing your data:

• Direct sales through setura.tr: Digital software products together with installation, support and service packages are sold directly through this website. In these sales Setura is the seller and Turkish distance sales legislation applies. Order, payment, invoicing and delivery data is processed by Setura as data controller.
• App publishing on the App Store and Google Play: In this channel the app is sold and distributed to the user by Apple or Google. Payment, billing, subscription management and refunds are governed by the relevant store's own terms, and the personal data relating to those operations is processed by that store under its own privacy policy, not by Setura. Setura is the data controller only for the data it processes itself while the app is running.

3. Categories of Personal Data Processed

Depending on how you use our services, the following categories of data may be processed:

• Identity data: Name and surname; for individual invoices, Turkish national ID number; for corporate invoices, company title, tax office and tax identification number.
• Contact data: Email address, phone number and billing address.
• Customer transaction data: Order number, purchased products and services, order date and status, your order note, and your support, refund and complaint correspondence.
• Financial data: Invoice details, payment method, payment amount and the transaction/reference number returned by the payment institution.
• Transaction security data: IP address and browser information (User-Agent); transaction and access records (logs) relating to order confirmation, payment, email delivery and digital product downloads; the text and version of the agreement you approved; sign-in and session records for your member account; and the irreversible cryptographic hash under which your password is stored.
• Mobile app and device data: If you use our mobile apps, the device and usage information required for the app to work (device model, operating system and app version, language and region settings, error and crash reports), together with the preferences and settings you create inside the app. As a rule those preferences and settings remain on your device.
• Advertising data: In our ad-supported mobile apps (e.g. Karpuzo), the advertising identifiers (IDFA on iOS, Advertising ID on Android) that may be processed through Google AdMob in order to serve and measure ads, together with device, usage and approximate location data. These are not processed in our apps without ads or on the setura.tr website.
• Marketing data: Not processed. We do not process personal data for marketing purposes, do not send commercial electronic messages, and do not build profiles of your habits and preferences on our own systems. The emails we send you are transactional notices about your order, delivery and account only. Ad serving in our ad-supported apps is described under "Advertising data" above.

We do not process the special categories of personal data defined in Article 6 of the KVKK; please do not send us data of that nature.

4. Method of Collecting Personal Data

Your personal data is collected electronically, by fully or partly automated means, through the setura.tr website and our mobile apps: when you complete order and membership forms, contact us by email, and use our services. We do not collect your personal data in physical form.

Transaction security data is additionally generated automatically by our servers during operations such as order confirmation, payment, email delivery and download.

As a rule, the app stores provide us with sales and usage reports in aggregated form, that is, in a form that does not identify or make identifiable any individual. If you send us a request, review or support message through a store, the data in that correspondence is processed.

Advertising data, on the other hand, is obtained automatically from your device only in our ad-supported apps, through the Google AdMob software development kit (SDK) embedded in the app.

5. Purposes of Processing and Legal Grounds

Your personal data is processed for the purposes below, on the legal ground stated against each purpose:

• Running the order process, delivering digital products and service packages, and creating and managing your member account — KVKK Art. 5/2-c (directly related to the conclusion or performance of a contract).
• Taking payment, ensuring payment security, and detecting and preventing fraud and abuse — KVKK Art. 5/2-c and Art. 5/2-f (legitimate interest).
• Issuing invoices and other financial documents, retaining books and records, and complying with obligations under tax, commercial and consumer legislation — KVKK Art. 5/2-ç (legal obligation).
• Proving that the digital product was delivered and evidencing the agreement text you approved, and establishing evidence in any dispute, chargeback or refund process — KVKK Art. 5/2-c and Art. 5/2-f.
• Handling your support, information, refund and complaint requests — KVKK Art. 5/2-c and Art. 5/2-f.
• Operating the website and mobile apps, fixing errors, and ensuring system and transaction security — KVKK Art. 5/2-f.
• Responding to requests from authorized public institutions and judicial authorities — KVKK Art. 5/2-ç.
• Serving and measuring ads in our ad-supported apps — KVKK Art. 5/2-f (our legitimate interest in being able to offer the app free of charge); and, as regards personalizing those ads through the advertising identifier on your device, explicit consent under KVKK Art. 5/1.

Other than the personalization of ads, none of the above processing activities relies on explicit consent; where these statutory grounds apply, separate consent is not required. Personalizing ads in our ad-supported apps does rely on your explicit consent: on iOS 14.5 and later, App Tracking Transparency permission is requested, and users in the European Economic Area, the UK and Switzerland are shown a consent form through the Google User Messaging Platform on first launch. If you do not give consent, or later withdraw it in your device settings, you can keep using the app; only non-personalized ads are then shown. Apart from this, we do not carry out any processing for marketing or profiling purposes.

6. Payment and Card Details

Card payments are taken through the infrastructure of the payment institution iyzico, with 3D Secure verification. Your credit/debit card details are transmitted to iyzico over an encrypted connection solely in order to complete the payment; your full card number, expiry date and security code (CVV) are not stored on our systems and are never written to any record.

In order to prove the transaction and to handle refund and chargeback processes, only the first six digits (BIN) and last four digits of the card number, together with the card brand/type as returned in iyzico's transaction response, are kept with your order record. This data alone cannot be used to make a payment.

7. Purchases Made Through App Stores

If you obtain one of our apps from the App Store or Google Play, or start an in-app purchase or subscription, the counterparty to that transaction is the relevant store, not Setura. Payment method, invoicing, subscription renewal and refund requests are subject to Apple's or Google's own terms and must be directed to that store.

In this context we do not process your payment card details, your store account information or your purchase history, and we have no access to that data. Setura's controllership in this channel is limited to the device and usage data it processes while the app is running, the ad-serving data in our ad-supported apps, and the support correspondence you send us directly.

8. Recipients of Personal Data and Purposes of Transfer

Your personal data may be transferred to the following parties, solely for and limited to the purposes stated:

• Payment institution (iyzico): Completing the payment, 3D Secure verification, ensuring payment security and carrying out refunds.
• App stores (Apple, Google): Publishing and distributing our mobile apps and handling requests submitted through the store.
• Advertising partner Google (Google Ireland Ltd. / Google LLC — Google AdMob): Serving, capping and measuring ads in our ad-supported mobile apps. The advertising identifier together with device, usage and approximate location data is transferred for this purpose; personalization of ads depends on your explicit consent.
• Hosting, server and infrastructure providers: Delivering the service, storing and backing up data, and maintaining system security.
• Email delivery provider: Sending order, delivery and account notifications and recording that they were sent.
• Accountants and e-document service providers: Issuing invoices and meeting obligations arising from accounting and tax legislation.
• Authorized public institutions and judicial authorities: Fulfilling statutory obligations and responding to duly issued requests.

Transfers are carried out in accordance with the conditions set out in Article 8 of the KVKK. Because some hosting, email, app store and advertising services are provided abroad, transfers abroad in that context are made only where the conditions in Article 9 of the KVKK are met. We do not sell your personal data; sharing with our advertising partner is limited to our ad-supported apps and to the purpose stated above.

9. Retention Period

Your personal data is retained for as long as necessary for the purposes for which it is processed and for the limitation and retention periods prescribed by the applicable legislation. Order, contract and invoice records, together with the transaction and access records that evidence delivery, are kept for those periods. Once the period expires or the purpose of processing ceases, your data is deleted, destroyed or anonymized.

10. Rights of the Data Subject (KVKK Art. 11)

Under Article 11 of the KVKK, you may apply to the data controller to exercise the following rights:

• To learn whether your personal data is processed.
• To request information about the processing if your data has been processed.
• To learn the purpose of processing and whether the data is used in line with that purpose.
• To know the third parties in Türkiye or abroad to whom the data is transferred.
• To request correction of data that is incomplete or inaccurately processed.
• To request deletion or destruction of the data within the conditions set out in Article 7 of the KVKK.
• To request that correction, deletion and destruction operations be notified to the third parties to whom the data was transferred.
• To object to an adverse outcome arising from the analysis of your data exclusively by automated systems.
• To claim compensation where you suffer damage due to unlawful processing of your personal data.

11. How to Apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit requests relating to your rights in one of the following ways:

• By sending a written application bearing your wet signature, together with documents evidencing your identity, to Fenerbahçe Mah. İğrip Sok. No: 13/1, Kadıköy / İstanbul.
• Using a secure electronic signature, a mobile signature or your registered electronic mail (KEP) address.
• By emailing [email protected] from the email address you previously notified to us and which is registered in our system.

Your application must clearly state your name, surname, contact details and the subject of your request. If your identity cannot be verified, the request cannot be fulfilled. Under Article 13 of the KVKK your application will be concluded as soon as possible and within thirty days at the latest; where the request entails an additional cost, the fee set out in the tariff in the Communiqué may be charged.

You can also submit a request to delete your member account and the data linked to it through our Data Deletion Request page. If your application is rejected, if you find our response insufficient, or if no response is given within the statutory period, you retain the right to file a complaint with the Turkish Personal Data Protection Board.

12. Changes

This Notice may be revised in line with changes in legislation and updates to our data processing operations. The current version is always published on this page, and the date at the top of the page is updated accordingly.