This notice is issued under Turkish Law No. 6698 on the Protection of Personal Data ("the Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It is a translation provided for convenience; the Turkish version prevails.
1. Data controller
| Legal name | BASE9 Bilişim Teknolojileri Ticaret Anonim Şirketi |
| Address | Yamanevler Mah. Ömer Faik Atakan Cad. Yılmaz Plaza No: 3 İç Kapı No: 2, Ümraniye / İstanbul |
| MERSİS | 0143159385600001 |
| [email protected] |
2. Personal data processed and purposes
| Category | Examples | Purpose |
|---|---|---|
| Identity | Name, surname | Account creation, contract formation, invoicing |
| Contact | Email, phone, address | Service notifications, invoices, support |
| Customer transactions | Organization and network names, memberships, roles, network assignments, rule definitions, audit records | Providing the service, security, dispute resolution |
| Transaction security | IP address, browser information, session records, device name and in-network IP address | Secure provision of the service, abuse prevention |
| Finance | Billing details, transaction reference returned by the payment institution | Payment collection, legal retention |
| Business customer details | Legal name, tax office, tax number | Invoicing |
Card details and the Turkish ID number are not stored by us; they are passed directly to the payment institution during checkout.
3. Legal grounds
Your personal data is processed on the following grounds listed in Article 5 of the Law:
- processing is directly related to the formation or performance of a contract (Art. 5/2-c);
- processing is necessary for the controller to fulfil a legal obligation (Art. 5/2-ç) — tax and commercial legislation, Law No. 6563;
- processing is necessary for the legitimate interests of the controller, provided it does not harm your fundamental rights (Art. 5/2-f) — security, audit log;
- your explicit consent for product and campaign announcements (Art. 5/1).
4. Method of collection
Data is collected electronically through our website and panel during actions such as creating an account, creating a network, inviting members, enrolling devices, making payments and submitting support requests, and automatically through the technical records needed to run the service.
5. Transfers
Your personal data may be transferred, under the conditions of Articles 8 and 9 of the Law, to the following recipients:
| Recipient | Purpose |
|---|---|
| Authentication provider (Zitadel) | Sign-in and account management |
| Payment institution (iyzico Ödeme Hizmetleri A.Ş.) | Payment collection and subscription management |
| Hosting provider (Codit) | Hosting the service |
| Our email server (abroad) | Delivering service emails |
| Competent public authorities | Legal obligations |
Our service servers are located in Türkiye. Because the email server that delivers service emails is located abroad, the data needed to send an email (email address, name and the content of the email) is transferred abroad; the conditions of Article 9 of the Law are observed for this transfer.
6. Retention periods
| Data | Period |
|---|---|
| Account and network data | 30 days after account closure |
| Audit records | 1 year after the network is deleted |
| Invoices and payment records | 10 years (Tax Procedure Law No. 213, Turkish Commercial Code No. 6102) |
| Technical logs | 90 days |
7. Your rights (Article 11 of the Law)
By applying to the data controller you have the right to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of processing and whether it is used accordingly;
- know the third parties to whom it is transferred, domestically or abroad;
- request correction if it is incomplete or inaccurate;
- request deletion or destruction under the conditions of Article 7;
- request that corrections, deletions and destructions be notified to third parties to whom the data was transferred;
- object to a result arising against you from analysis performed exclusively by automated systems;
- claim compensation for damage caused by unlawful processing.
8. How to apply
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your application:
- to [email protected] from the email address registered in our system;
- in writing to Yamanevler Mah. Ömer Faik Atakan Cad. Yılmaz Plaza No: 3 İç Kapı No: 2, Ümraniye / İstanbul.
Applications are concluded free of charge within 30 days at the latest. If the process incurs an additional cost, the tariff set by the Personal Data Protection Board may apply.
Contact person: Süleyman Ergen