Information Text Regarding the Protection and Processing of Personal Data.

This notice has been prepared within the scope of the Turkish Personal Data Protection Law No. 6698 (KVKK) in order to inform data subjects about the personal data processed in connection with membership, digital product/license sales, customer-specific product and service offers, payment, invoicing, support and security processes conducted through the Pitemati website.

1. Categories of Personal Data Processed

• Identity information: first name, surname; tax/Turkish ID information where required for invoicing or by applicable legislation.
• Contact information: email address, phone number, billing/contact address.
• Customer transaction information: membership, order, product/license, cart, payment status, refund/cancellation, customer-specific offer/package information, support and communication records.
• Financial information: payment method, transaction/collection and refund information, invoicing information. Sensitive card verification data such as the full card number and CVV/CVC are not stored in the Pitemati database.
• Transaction security information: IP address, session, access, security and system logs.
• Legal transaction and compliance information: preliminary information, agreements and legal consent records; records required in connection with requests/complaints, disputes and legal compliance.
• Customer-specific work information: the type, scope and deliverables of the proposed work, revision/performance conditions, and content, files, access credentials or technical information provided by the customer, only to the extent necessary for the establishment and performance of the service.

 

2. Purposes of Processing Personal Data

• Creating, verifying and managing the membership account.
• Establishing, processing and delivering/performing orders for digital products, licenses and customer-specific products/services.
• Displaying customer-specific offers only to the authorized user account and preventing unauthorized access.
• Processing payments and refunds and matching the payment result with the relevant order.
• Carrying out invoicing and accounting processes and fulfilling statutory record-keeping obligations.
• Managing customer support, requests, complaints and dispute processes.
• Ensuring information and transaction security and preventing misuse, fraud and unauthorized access.
• Fulfilling legal obligations and responding to requests from authorized institutions and authorities.

 

3. Legal Grounds for Processing Personal Data

Personal data may be processed on the legal grounds set out in Article 5 of the KVKK, including where processing is directly related to the establishment or performance of a contract, is necessary for the data controller to fulfil a legal obligation, is necessary for the establishment, exercise or protection of a right, or is necessary for the legitimate interests of the data controller. Where a separate processing activity requires explicit consent, such consent is obtained separately from this information notice.

4. Method of Collecting Personal Data

Personal data is collected electronically through membership and payment forms, WooCommerce order/account pages, customer-specific offer creation and display screens, communication and support channels, cookies and technical logs, invoicing information, information entered into the system by the user or administrator, and transaction result notifications received from payment service providers.

5. Transfer of Personal Data

• Payment service providers, banks and financial institutions: for collection, payment verification, refunds, fraud prevention and compliance with payment legislation. Where PayTR is used, the necessary data may be shared with PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. or may be processed separately by PayTR.
• Accounting/e-invoicing service providers and financial advisors: for the fulfilment of invoicing, accounting and tax obligations.
• Hosting, email, security and technical infrastructure service providers: for the operation and hosting of the service, email notifications, backups and security purposes, only to the extent required for the relevant service.
• Public institutions and organizations, and judicial/administrative authorities authorized by law: for the fulfilment of legal obligations.

 

Where personal data is transferred abroad, the applicable provisions of the KVKK concerning international data transfers and appropriate safeguards are applied. Whether an infrastructure provider used by Pitemati results in an international data transfer is assessed separately for each service.

6. Payment Data and PayTR

Within the PayTR integration, Pitemati may transmit to the payment infrastructure the order amount, order/transaction identifier, customer contact and invoicing information, and technical transaction data required to process the payment. Sensitive card verification data such as the full card number and CVV/CVC are not stored by Pitemati in its own database. PayTR may separately process personal data within the framework of the legislation applicable to it and its obligations under the KVKK.

7. Records of Legal Events and Consents

For legal events displayed according to the nature of the order, such as preliminary information, agreements, licenses, immediate digital delivery information or requests for early commencement of services, the version of the relevant text, the date/time it was displayed, its relationship with the order and user, and the corresponding confirmation/consent record may be retained for evidentiary purposes and compliance with applicable legislation.

8. Retention Periods

Personal data is retained for the period required by the relevant processing purpose and for the minimum retention periods prescribed by applicable legislation. Records concerning information, withdrawal, delivery and similar transactions under distance contracts may be retained for the periods prescribed by the relevant legislation; order, invoice, accounting and legal transaction records may be retained for the periods specified under applicable tax, commercial and consumer legislation. At the end of the applicable retention period, the data is deleted, destroyed or anonymized in accordance with the legislation.

9. Rights of the Data Subject

Data subjects may exercise the rights set out in Article 11 of the KVKK. These include the rights to learn whether their personal data is being processed, request information regarding such processing, learn whether the data is being used in accordance with its purpose and to whom it has been transferred, request correction of incomplete or inaccurate data, request deletion or destruction where the applicable conditions are met, and request compensation for damages arising from unlawful processing.

10. Application and Confirmation of Information

Requests under the KVKK may be submitted to iletisim@pitemati.com or through other communication channels announced by the data controller. Presentation of this information notice is not conditional upon any approval or explicit consent. If a technical confirmation record is obtained, such record must relate only to the fact that the notice has been read/information has been received and must not constitute “consent” or “acceptance” of the personal data processing activities described in this notice.