Data Protection Notice
This notice explains how GMY Bilişim Sanayi ve Ticaret Ltd. Şti., acting as data controller, processes your personal data under Turkish Personal Data Protection Law no. 6698 ("KVKK").
1. Data Controller
| Item | Detail |
|---|---|
| Legal name | GMY Bilişim Sanayi ve Ticaret Ltd. Şti. |
| Address | Cumhuriyet Mah. Yağmur Sok. Çamlık Sitesi C Blok Daire 5, 16140 Nilüfer / Bursa, Türkiye |
| admin@gmybilisim.com |
2. Categories of Personal Data
| Category | Examples |
|---|---|
| Identity and contact | Name, email address |
| Customer transaction | Subscription type, start and renewal dates, order records |
| Financial | Payment amount, payment status, billing details (card numbers are neither processed nor stored by us) |
| Transaction security | IP address, session and login records, device and browser information |
| App usage | Completed sessions and modules, progress state |
3. Purposes of Processing
- Concluding and performing the subscription agreement and providing the service
- Processing payments and issuing invoices
- User support and handling requests and complaints
- Ensuring the security of the service and preventing misuse
- Improving the service and resolving technical issues
- Meeting legal obligations under tax, commercial and consumer legislation
4. Legal Grounds
- Conclusion or performance of a contract (KVKK art. 5/2-c): subscription and payment processes
- Legal obligation (KVKK art. 5/2-ç): invoicing and accounting records
- Legitimate interest (KVKK art. 5/2-f): security, prevention of misuse, service improvement
- Explicit consent (KVKK art. 5/1): only where consent is expressly requested, for example marketing messages
5. How Data Is Collected
Personal data is collected electronically, by automated and partly automated means, through the website, the mobile apps, email correspondence and the payment infrastructure.
6. Transfers
Your personal data is shared with the following categories of service provider, only to the extent necessary to provide the service:
- Payment institutions and banks (to take and refund payments)
- Cloud infrastructure and database providers (to host the service)
- App stores (App Store, Google Play — for subscriptions bought through them)
- Accounting and audit service providers (for legal obligations)
- Competent public authorities (where required by law)
Some providers’ servers may be located abroad. Any transfer abroad is made under KVKK article 9 with the necessary safeguards in place.
7. Retention Periods
- Account and subscription data: while the account is active and for no more than 30 days after deletion
- Invoicing and accounting records: 10 years, as required by law
- Transaction security records: no more than 2 years
When the period expires, data is deleted, destroyed or anonymised.
8. Your Rights (KVKK art. 11)
- To learn whether your personal data is processed
- To request information if it has been processed
- To learn the purpose of processing and whether the data is used accordingly
- To know the third parties to whom data is transferred, in Türkiye or abroad
- To request correction if the data is incomplete or inaccurate
- To request erasure or destruction
- To request that correction, erasure or destruction be notified to third parties to whom the data was transferred
- To object to a result against you produced solely by automated analysis
- To claim compensation for damage caused by unlawful processing
9. How to Apply
You may send requests concerning your rights to admin@gmybilisim.com or in writing to the postal address above. Applications are concluded within 30 days. Where the request entails an additional cost, the fee in the tariff set by the Board may be charged.
If your application is rejected or not answered in time, you may lodge a complaint with the Personal Data Protection Board.