KVKK Disclosure Statement

1. Data Controller

Company: TABBYTE TECHNOLOGIES LTD

Address: London, United Kingdom

Email: info@e9e.io

2. Personal Data Processed

The following personal data belonging to you is processed:

2.1. Identity Data

• First name, last name
• National ID number (for invoicing transactions)
• Tax number (for corporate accounts)

2.2. Contact Data

• Email address
• Phone number
• Address information

2.3. Customer Transaction Data

• Order and invoice information
• Payment information
• Request and complaint records

2.4. Marketing Data

• Purchase history
• Preferences and interests
• Survey and campaign participation data

2.5. Digital Data

• IP address
• Cookie data
• Session information
• Device information

2.6. Prospect (Lead) Data

Note: This data is compiled from publicly available sources (mapping services, search engines, professional networks, social media, corporate websites).

• Business name, address, phone, email address, website
• Professional profile information (first and last name, job title, company name, location)
• Social media profile information (username, bio, follower count)
• Business rating and category information
• Geographic location information

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Carrying out membership transactions
• Providing and improving services
• Conducting order and payment transactions
• Customer service and support activities
• Fulfilling legal obligations
• Security and fraud prevention
• Marketing and campaign activities (subject to your consent)
• Statistical analysis and reporting
• Monitoring of legal processes
• Collecting, compiling and enriching data from publicly available sources in order to provide prospect information to our users
• AI-powered lead scoring and prioritization
• Verifying lead data and checking that it is up to date

4. Legal Grounds for Processing Personal Data

Your personal data is processed based on the following legal grounds set out in Articles 5 and 6 of the KVKK:

• Explicit consent: For marketing activities
• Establishment or performance of a contract: For service provision
• Legal obligation: For fulfilling legal requirements
• Legitimate interest: For improving service quality and security
• Legitimate interest (KVKK Art. 5/2-f): Compiling prospect data from publicly available sources and presenting it to users

5. Transfer of Personal Data

Your personal data may be shared with the following parties:

5.1. Domestic Transfers

• Business partners and suppliers
• Payment service providers
• Logistics companies
• Legal advisors
• Authorized public institutions and organizations

5.2. International Transfers

In order to provide services, your personal data may be transferred abroad to countries with adequate protection or with appropriate security measures in place.

Countries to Which Data Is Transferred:

• European Union countries
• United States (under Standard Contractual Clauses)
• United Kingdom

5.2.1. Categories of Service Providers to Which Data Is Transferred

All international transfers are carried out with the necessary security measures (Standard Contractual Clauses, undertakings) under Article 9 of the KVKK.

• Cloud infrastructure services (server hosting, database)
• Search engine API services
• Web data collection and enrichment services
• Artificial intelligence and natural language processing services
• Email delivery infrastructure

6. Retention Periods for Personal Data

Identity and Contact Data - Retention Period: Duration of membership + 10 years - Legal Basis: Turkish Commercial Code (TTK), Tax Procedure Law (VUK)

Transaction and Invoice Data - Retention Period: 10 years - Legal Basis: Tax Procedure Law (VUK) Art. 253

Log Records - Retention Period: 2 years - Legal Basis: Law No. 5651

Marketing Data - Retention Period: Until consent is withdrawn - Legal Basis: KVKK Art. 5

Prospect (Lead) Data - Retention Period: As long as the user account is active; deleted within 30 days upon a deletion request - Legal Basis: KVKK Art. 5/2-f (Legitimate Interest)

7. Data Security Measures

The following technical and administrative measures are taken to ensure the security of your personal data:

• SSL/TLS encryption
• Firewall systems
• Access control and authorization
• Regular security audits
• Staff training
• Confidentiality agreements
• Data backup procedures

8. Your Rights Under the KVKK

Pursuant to Article 11 of the KVKK, you have the following rights:

• To learn whether your personal data is being processed
• To request information if your personal data has been processed
• To learn the purpose of processing your personal data and whether it is used in line with that purpose
• To know the third parties to whom your personal data is transferred, domestically or abroad
• To request rectification of your personal data if it has been processed incompletely or inaccurately
• To request the erasure or destruction of your personal data within the conditions set out in Article 7 of the KVKK
• To request that rectification, erasure or destruction operations be notified to the third parties to whom your personal data has been transferred
• To object to a result that arises against you due to the analysis of the processed data exclusively through automated systems
• To request compensation for damages in the event that you suffer harm due to the unlawful processing of your personal data

9. Application Method

To exercise your rights under the KVKK, you can apply using the following methods:

9.1. Written Application

You can deliver your wet-signed petition, together with documents verifying your identity, to our company address in person or send it through a notary.

9.2. Application by Email

You can apply to info@e9e.io from the email address registered in our system.

9.3. Application via Web Form

You can apply online through the Data Deletion Request Form page (/tr/legal/data-request).

9.4. Through the Application

You can apply using the "KVKK Request" option in the account settings section.

10. Application Review Period

Your applications will be concluded within 30 days at the latest. If the process additionally requires a cost, a fee from the tariff determined by the Personal Data Protection Board may be charged.

11. Complaint to the Personal Data Protection Board

If your application is rejected, the response is found insufficient, or no response is given within the required period, you may file a complaint with the Personal Data Protection Board within 30 days from the date you learn of the response and in any case within 60 days from the date of application.

12. Updates

This disclosure statement may be updated in line with legal regulations or changes in company policies. The current version is always published on our website.

13. Contact

For all your questions regarding the KVKK:

• Data Controller: TABBYTE TECHNOLOGIES LTD
• Email: info@e9e.io
• Address: London, United Kingdom