Personal Data Processing Policy of the Ktotam.to service

1. General provisions

1.1. This Personal Data Processing Policy (the "Policy") has been developed in accordance with applicable legislation and sets out the procedure for processing personal data and the measures taken to ensure its security.

1.2. The personal data operator is PAYMASTER TECHNOLOGIES ELEKTRONIK PAZARLAMA DIS TICARET LIMITED SIRKETI (the "Operator").

1.3. This Policy applies to all personal data that the Operator processes in connection with the User's use of the Ktotam.to service (the "Service").

1.4. This Policy supplements the Service's Privacy Policy and does not replace it.

2. Key terms

• personal data — any information relating to a directly or indirectly identified or identifiable natural person;
• processing of personal data — any action or set of actions performed with personal data, including collection, recording, systematization, storage, correction, use, disclosure, anonymization, blocking, and destruction;
• operator — a person that organizes and/or carries out the processing of personal data and determines the purposes and content of such processing;
• personal data subject — a natural person to whom the processed personal data relates;
• consent of the data subject — a voluntary, specific, informed, and unambiguous expression of will by the subject to the processing of their personal data;
• anonymization of personal data — actions that make it impossible to determine that personal data belongs to a specific subject without using additional information;
• cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state to a foreign public authority, a foreign natural person, or a foreign legal entity.

3. Principles of personal data processing

• lawfulness and fairness of processing;
• limiting processing to specific, predetermined, and lawful purposes;
• correspondence between the volume and content of the data processed and the stated purposes of processing;
• the inadmissibility of combining databases created for incompatible purposes;
• accuracy and relevance of personal data, and its sufficiency for the purposes of processing;
• retaining personal data no longer than the purposes of processing require;
• destroying or anonymizing personal data once the purposes of processing have been achieved or the need to achieve them has been lost.

4. Conditions for processing personal data

4.1. The Operator processes personal data where at least one of the following conditions is met: the data subject has consented to the processing of their data; processing is necessary to perform a contract to which the subject is a party; processing is necessary to exercise the rights and legitimate interests of the Operator or third parties; or another basis provided for by law.

4.2. Consent to the processing of personal data may be given by the subject in any form that allows the fact of its receipt to be confirmed, including through implicit action — filling in and submitting the Service's forms.

5. Purposes of processing personal data

Personal data is processed for the purposes of:

• providing the Service's features and processing User requests;
• identifying the User when they contact support;
• communicating with the User, including sending notifications and responses to inquiries;
• improving the quality of the Service;
• ensuring information security and preventing fraud;
• complying with legal requirements.

6. Categories of data subjects and personal data processed

6.1. The Operator processes personal data of Service users, people who have submitted an inquiry through a feedback form, and people whose phone numbers are processed as part of the Service's features.

6.2. The data processed may include: contact details (name, email address), information about a phone number, technical data (IP address, browser and device information, cookies), and the content of User inquiries.

6.3. The Operator does not aim to process special categories of personal data, including information about health, political views, religious or philosophical beliefs, or intimate life.

7. Legal grounds for processing personal data

Personal data is processed in accordance with applicable legislation, on the basis of the data subject's consent, the Service's terms of use, and other grounds permitted by law.

8. Cross-border transfer of personal data

8.1. The Operator may carry out cross-border transfers of personal data to the territories of foreign states that provide adequate protection of data subjects' rights, to the extent necessary for the purposes of processing.

8.2. Cross-border transfer of personal data to the territories of foreign states that do not provide adequate protection of data subjects' rights may be carried out with the subject's written consent or on other grounds provided for by law.

9. Measures to ensure the security of personal data

The Operator takes the necessary organizational and technical measures, including:

• identifying threats to the security of personal data during its processing;
• using information-security tools that have undergone a conformity-assessment procedure;
• delimiting and controlling access to personal data;
• keeping records of persons granted access to personal data processing;
• detecting instances of unauthorized access to personal data and taking appropriate measures;
• assessing the effectiveness of the measures taken before putting a personal data information system into operation.

10. Rights of the data subject

The personal data subject has the right to:

• obtain information relating to the processing of their personal data;
• request the correction, blocking, or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
• withdraw consent to the processing of personal data where processing is based on consent;
• appeal the Operator's actions or omissions to an authorized data-protection body or in court;
• protect their rights and legitimate interests, including seeking damages and/or compensation for moral harm in court.

11. Procedure for the data subject's requests

To exercise their rights, the data subject may submit a request to the email address given below, together with information confirming their identity and allowing the relevant personal data and grounds for the request to be identified.

The Operator may request additional information needed to confirm that the request was made by the relevant data subject or their legal representative.

A response to the request is provided within the period established by applicable law.

12. Retention and destruction of personal data

Personal data is retained no longer than required by the purposes of its processing and any periods set by law or contract. Once the purposes of processing are achieved, or consent is withdrawn, personal data is subject to destruction or anonymization unless otherwise provided by law.

13. Changes to the Policy

The Operator may amend this Policy. The current version is published on the Service's website and takes effect from the moment of publication, unless a different date is stated in the new version itself.

14. Contact information

Operator:

PAYMASTER TECHNOLOGIES ELEKTRONIK PAZARLAMA DIS TICARET LIMITED SIRKETI

Address:

Merkez Mah. Kagithane Cad. A, office No 11/61, Kagithane/Istanbul/Turkey

Email:

info@ktotam.to