Privacy Policy & KVKK

1. Personal Data We Process

Depending on your use of our site, the following data is processed:

• Membership data: Name-surname, email address, secure (hash/cryptographic) digest of your password, membership and last login date-time.
• Order data: Name-surname, email, phone (optional), order note, order code, product information, amount, order status, license key, payment/approval dates and download records.
• Contact data: The name, email, subject, and message content you send via the contact form.
• Newsletter data: Only your email address (if you have given explicit consent).
• Transaction security data: IP address (partial/redacted forms), user info (user-agent), session identifiers, CSRF tokens, request rate limit records, preview token records, download logs, and server logs.
• Consent records: Records (with proof obligation) of your explicit consents given for the Terms of Use, Privacy Policy, Distance Sales Agreement, and digital product return/cancellation information, kept along with date-time and IP information.
• Credit card data: It is never processed or stored. Payments are made directly to the bank via bank transfer/EFT.

2. Processing Purposes and Legal Bases

Your personal data is processed for the following purposes only, based on the legal grounds in Art. 5 of the GDPR:

Processing Purpose	Legal Basis (KVKK Art. 5/2)
Creation and management of the membership account, verification of entries	(c) Conclusion/execution of the contract
Order receipt, payment matching, license key generation, delivery, and download support	(c) Conclusion/execution of the contract
Identity verification in account, order, and download processes to prevent misuse.	(e) Legitimate interest
Proof of explicit consents obtained via checkboxes in the order step	(e) Legitimate interest + legal obligations
The preservation of payment records, accounting and tax obligations	(c) Legal obligation (VUK, Law No. 6563, etc.)
Prevention of cyber security, fraud, and abuse (IP, logs, rate limits)	(e) Legitimate interest
Request/complaint management, support, and communication	(e) Legitimate interest / (c) Contract execution
Newsletter and campaign emails	(a) Explicit consent (in exceptional cases, announcements related to existing membership — legitimate interest)
Information is provided upon request from legal authorities	(c) Legal obligation

Your data, to the extent not necessary for the purposes automated decisions or profiling is not subject to. Sensitive financial data is not collected during payment transactions.

3. Transfer of Personal Data

Your data is not sold, rented, or shared with third parties for commercial purposes. It may only be transferred in the limited cases below and to the necessary minimum extent:

• Hosting/server provider: Database and log hosting for the site to operate (domestic/international data center infrastructure). Our server provider has limited access only for technical hosting purposes.
• Bank: Payment records for matching your bank transfer/EFT payment.
• Legal Authorities: Public authorities with obligations arising from court decisions or legislation.
• Advisors: Accounting/legal advisors under legal obligation and confidentiality pledge (only relevant data).

If data transfer abroad is necessary, it will not be made without meeting the conditions in KVKK Art. 9 (explicit consent or Board decision/standard contract procedures).

4. Collection Method and Legal Reasons

Your data; through the membership form, order form, contact form, newsletter form, payment notification, session and security mechanisms, server logs, and cookies electronically is collected. Collection is based on the legal reasons listed in the table above and the information/disclosure obligations arising from Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Distance Contracts. If you do not provide all or part of your data, the relevant service (e.g., order delivery or membership) cannot be provided; this is a legal obligation for us and a requirement for service performance.

5. Cookies and Similar Technologies

Our site uses strictly necessary cookies and browser storage to keep your session, protect forms against CSRF attacks, and run security checks. Details about cookie types, durations, and management options are on our Cookie Policy page. You can delete or block cookies in your browser settings; however, blocking necessary cookies may break login and ordering processes.

6. Retention and Destruction Periods

• Order and payment records: Pursuant to Tax Law 10 year; confirmation/proof records are for contract and consumer disputes 10 year.
• Membership data: Duration of active membership + after account closure 3 year (legal security); order-related data is stored with order records.
• Contact messages: From the time of response 2 year.
• Newsletter records: Until your subscription; upon cancellation request, it is immediately deleted (cancellation records are stored for the legally required period).
• Security logs: 1 year (Compliance with Art. 12 of KVKK and incident response).
• When time periods expire, data is deleted, destroyed, or anonymized.

7. Data Security

We take technical and administrative measures to protect your data: all site traffic HTTPS/TLS ; passwords are stored with irreversible hash algorithms; the admin panel, sessions, and CSRF protection, request rate-limiting, and IP-based monitoring are protected; the database is kept outside the web root; access is permission-based and logged; software is kept up to date. Despite all precautions, in case of any breach, you and the Authority will be notified as soon as possible pursuant to Article 12 of the KVKK. If you notice anything suspicious, please notify us immediately.

8. Your Rights under KVKK Article 11

by applying to the data controller under KVKK (Law no. 6698) Art. 11;

• Your personal data's learn whether it is being processed,
• If processed, information related to this request information,
• the purpose of processing and its suitability to the purpose learn whether it has been used,
• Data within/outside Turkey know the third parties to whom it has been transferred,
• If processed incorrectly/incompletely its correction request,
• Within the conditions stipulated in the GDPR. deletion or destruction request,
• These processes, to third parties to whom the data is transferred notification request,
• As a result of analysis carried out exclusively by automated systems leading to a result against you object,
• In case of damage caused by unlawful processing Demand compensation for damages you have the right to

9. Application Method

You can submit your requests along with information that identifies you info@copypromt.com you can submit it via email to ("KVKK Information Request" subject). Your application; at the latest 30 day is responded to free of charge. If the process additionally incurs a cost, the fees specified in the tariff determined by the KVKK Regulation may be applied. In case of rejection of your request, if the response provided is deemed insufficient or if no response is given within the timeframe, from the time we are served with the response, 30 day you have the right to file a complaint with the Personal Data Protection Board.

10. Commercial Electronic Messages (Law No. 6563)

When you subscribe to our newsletter, commercial electronic messages will be sent to your email address for campaign and new product announcements explicit consent This confirmation is obtained in accordance with the Law on the Regulation of Electronic Commerce and the Regulation on Commercial Electronic Messages and is recorded. You can always withdraw your confirmation, free of charge and without giving any reason: via the unsubscribe link in emails unsubscribe you can click the link or info@copypromt.com you can write to {d}. Withdrawal of consent immediately stops the process. Service announcements related to your membership (order confirmation, license delivery, etc.) are not considered commercial messages and are sent.

11. Children's Personal Data

Our services are not directed to individuals under 18. If we discover that someone under 18 has provided us with data, we will delete it without parental consent. If you are a parent and believe your child has shared data with us, please contact us.

12. Changes to the Policy

This text may be updated according to legal and operational changes. The current version is always published on this page and is indicated by the "Last update" date at the top of the page. For important changes, a site announcement and/or email notification will be made. Continuing to use the site with the current version means you accept the updated text.