Privacy Notice

1. Data Controller

Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK", the Turkish Personal Data Protection Law), your personal data is processed, in the capacity of data controller, by VENNYX YAZILIM DANIŞMANLIK A.Ş. (Muallimköy Mah. Deniz Cad. No: 143/8 - 1.1.C1 Blok - Zemin Kat - Kapı No: Z01 - 41400 - Gebze / Kocaeli, MERSİS No: 0924107273500001), within the scope explained below.

2. Personal Data Processed

Identity and contact data: full name, e-mail address, phone number (if any), invoicing/organization information.

Customer transaction data: subscription plan, billing history, payment status (card information is processed by iyzico and is not stored by the SELLER).

Usage and technical data: control panel session records, IP address, browser/operating system information, in-service transaction logs (domain/mailbox management, support requests).

E-mail traffic data processed by the nature of the Service: e-mail sending/receiving metadata relating to the BUYER's own domain (sender/recipient addresses, timestamps, delivery status) is processed only for the performance of the Service (mail routing, spam filtering, troubleshooting); e-mail content is not scanned for advertising purposes and is not sold to third parties.

3. Purposes of Processing Personal Data

Establishment and performance of the subscription agreement, account creation and authentication, the technical provision of the Service (e-mail hosting), execution of billing and payment transactions (iyzico/paraşüt integration), responding to customer support requests, ensuring service quality and security, fulfilling legal obligations, and the reporting/retention activities required by legislation.

4. Parties to Whom Personal Data Is Transferred, and the Purposes

Your personal data may be shared, within the conditions set out in Articles 8 and 9 of the KVKK, with iyzico (iyzico Ödeme Hizmetleri A.Ş.) for the execution of payment transactions, with the paraşüt e-invoice/e-archive integrator for billing purposes, with contracted server/cloud providers for hosting the Service, and with the relevant public authorities only when requested by an authorized official body.

Where your personal data must be shared with a sub-processor established abroad, it is transferred on the basis of your explicit consent or the adequate-protection conditions required by the KVKK.

5. Method and Legal Basis of Collecting Personal Data

Your personal data is collected through forms you complete on the website and control panel, electronic communication channels, and records automatically generated during use of the Service.

Legal grounds: being directly related to the establishment or performance of a contract (KVKK Art. 5/2-c); the data controller's compliance with a legal obligation (Art. 5/2-ç); being mandatory for the establishment, exercise, or protection of a right (Art. 5/2-e); and being mandatory for the data controller's legitimate interest (Art. 5/2-f).

6. Rights of the Data Subject (KVKK Art. 11)

Pursuant to Article 11 of the KVKK, everyone has the right to apply to the data controller to: learn whether their personal data is being processed; request information about it if it has been processed; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties to whom it is transferred domestically or abroad; request correction if it has been processed incompletely or incorrectly; request its erasure or destruction under KVKK Art. 7; request that any correction or erasure be notified to the third parties to whom the data has been transferred; object to an adverse outcome arising from the exclusively automated analysis of the processed data; and request compensation for damage suffered as a result of unlawful processing.

7. Method of Application

You may submit requests relating to the rights listed above, together with documents verifying your identity, to the vennyxyazilim@hs01.kep.tr KEP address, or in writing to Muallimköy Mah. Deniz Cad. No: 143/8 - 1.1.C1 Blok - Zemin Kat - Kapı No: Z01 - 41400 - Gebze / Kocaeli. Requests are concluded free of charge within no more than 30 (thirty) days pursuant to Article 13 of the KVKK; if the transaction itself requires an additional cost, a fee may be charged in accordance with the tariff set by the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu, the "KVKK Board").

8. GDPR Scope and Legal Bases (for Data Subjects Located in the EU/EEA)

If you are located in the European Union or the European Economic Area, your personal data is also protected under the EU General Data Protection Regulation (GDPR -- 2016/679), in addition to the KVKK. This section explains your additional rights, and our processing bases, under the GDPR; the data controller (controller) is the company identified in Article 1 above.

Legal bases for processing (GDPR Art. 6): (a) performance of a contract -- providing your subscription and billing (Art. 6(1)(b)); (b) legal obligation -- tax and commercial legislation (Art. 6(1)(c)); (c) legitimate interest -- service security, prevention of abuse, and protection of the infrastructure (Art. 6(1)(f)); (d) explicit consent -- only for optional commercial electronic messages/marketing communications (Art. 6(1)(a)), which you may withdraw at any time.

9. Your Rights Under the GDPR (Arts. 15-22)

Under the GDPR, you have the right to: access your data (Art. 15); rectification (Art. 16); erasure, or the "right to be forgotten" (Art. 17); restriction of processing (Art. 18); data portability -- receiving your data in a structured, commonly used, machine-readable format, or having it transmitted to another controller (Art. 20); object to processing (Art. 21); and not to be subject to a decision based solely on automated processing, including profiling (Art. 22).

For processing based on explicit consent, you may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise these rights you may contact us at destek@mila.cx or vennyxyazilim@hs01.kep.tr. Your requests will be answered no later than one month, pursuant to Art. 12 of the GDPR.

You also retain the right to lodge a complaint with the competent data protection supervisory authority in your EU/EEA member state; data subjects located in Turkey may apply to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu).

10. International Data Transfers

Your personal data may be transferred abroad depending on the location of the infrastructure and sub-processors used to provide the Service. Such transfers are carried out on the basis of an adequacy decision, appropriate safeguards such as the EU Standard Contractual Clauses (SCCs), or your explicit consent, within the meaning of GDPR Arts. 44-49; and, for purposes of the KVKK, by satisfying the conditions set out in Article 9.

11. Retention Periods

Your personal data is retained for the period required by the purpose of processing and for the statute-of-limitations/retention periods provided by applicable legislation (e.g., the statutory periods applicable to invoice records under tax and commercial legislation); at the end of that period it is deleted, destroyed, or anonymized. When you delete your account, data that is not subject to a legal retention obligation is deleted within a reasonable time.