PDPL Disclosure Text

Last Update: June 21, 2025

Definitions/Parties

Definitions: Unless otherwise specified, the terms used on this page are the same as the terms in the User Agreement.

Data Controller:

Data Subject:

KVKK:

Disclosure Text:

Privacy Policy: It is a Site policy consisting of texts that inform the Member in a similar way to the Disclosure Text and that the Member must accept when registering. For information on to whom and for what purposes your personal data is transferred, you can visit the relevant page.

All Users / Data Subjects

Identity Information

Identity Information

  • • Name Surname
  • • Date of Birth
  • • T.C. Identity Information
  • • Identity Card/ID Photocopy

Personal Data Processing Purposes:

  • • Providing information to authorized persons, institutions, and organizations
  • • Conducting activities in compliance with legislation
  • • Executing and auditing business activities
  • • Executing storage and archiving activities
  • • Executing contract processes
  • • Ensuring the security of Data Controller operations
  • • Managing company/product/service loyalty processes
  • • Executing business activities
  • • Executing after-sales support services for goods/services
  • • Executing sales processes for goods/services
  • • Executing goods/services production and operation processes
  • • Executing customer relationship management processes
  • • Executing customer satisfaction activities

Legal Grounds:

  • • Clearly stipulated in laws
  • • Being necessary for the processing of personal data of the parties to a contract, provided that it is directly related to the establishment or performance of a contract
  • • Being mandatory for the Data Controller to fulfill its legal obligation
  • • Being mandatory for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Explicit consent

Contact Information

Identity Information

  • • Email Address
  • • Mobile Phone Number

Personal Data Processing Purposes:

  • • Carrying out communication activities
  • • Executing sales processes for goods/services
  • • Executing contract processes
  • • Carrying out advertising/campaign/promotion processes
  • • Tracking requests/complaints
  • • Executing marketing processes for products/services

Legal Grounds:

  • • Clearly stipulated in laws
  • • Being necessary for the processing of personal data of the parties to a contract, provided that it is directly related to the establishment or performance of a contract
  • • Being mandatory for the Data Controller to fulfill its legal obligation
  • • Being mandatory for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Explicit consent

Financial Information

Identity Information

  • • Bank Account Number (IBAN)
  • • Bank Account Holder Identity Information

Personal Data Processing Purposes:

  • • Conducting activities in compliance with legislation
  • • Executing finance and accounting operations
  • • Executing and auditing business activities
  • • Executing sales processes for goods/services
  • • Executing contract processes
  • • Providing information to authorized persons, institutions, and organizations
  • • Executing storage and archiving activities
  • • Ensuring the security of Data Controller operations
  • • Explicit consent

Customer Transaction Information

Identity Information

  • • Invoice
  • • Support request information
  • • Order Information

Personal Data Processing Purposes:

  • • Conducting activities in compliance with legislation
  • • Executing after-sales support services for goods/services
  • • Executing sales processes for goods/services
  • • Providing information to authorized persons, institutions, and organizations
  • • Executing storage and archiving activities
  • • Ensuring the security of Data Controller operations
  • • Executing finance and accounting operations
  • • Executing and auditing business activities

Legal Grounds:

  • • Clearly stipulated in laws
  • • Being necessary for the processing of personal data of the parties to a contract, provided that it is directly related to the establishment or performance of a contract
  • • Being mandatory for the Data Controller to fulfill its legal obligation
  • • Being mandatory for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Explicit consent

Legal Transaction Information

Identity Information

  • • Correspondence with Official Institutions and Organizations
  • • Information in Court Files, within the scope of Warnings/Notifications

Personal Data Processing Purposes:

  • • Conducting activities in compliance with legislation
  • • Tracking and executing legal affairs
  • • Providing information to authorized persons, institutions, and organizations
  • • Executing storage and archiving activities
  • • Ensuring the security of Data Controller operations
  • • Executing risk management processes
  • • Tracking requests/complaints
  • • Auditing business activities

Legal Grounds:

  • • Being mandatory for the establishment, exercise, or protection of a right
  • • Being mandatory for the Data Controller to fulfill its legal obligation
  • • Being mandatory for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Explicit consent

Visual and Auditory Recording Information

Identity Information

  • • Auditory Recordings (Call Center Recordings)

Personal Data Processing Purposes:

  • • Carrying out communication activities
  • • Receiving and evaluating suggestions for improving business processes
  • • Executing customer relationship management processes
  • • Executing marketing processes for products/services
  • • Carrying out advertising/campaign/promotion processes
  • • Tracking requests/complaints, Executing information security processes

Legal Grounds:

  • • Clearly stipulated in laws
  • • Being mandatory for the Data Controller to fulfill its legal obligation
  • • Being mandatory for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Explicit consent

Your personal data is stored and processed on our server in Frankfurt, Germany.

Information Shared in Cases of Sales Agreement

If a Buyer creates an order for a listing or creates an order and makes a payment, they agree that their name/surname and contact information (phone number, email, etc.) will be shared with the Seller.

If a Seller adds a listing for sale, they agree that their name/surname and contact information (phone number, email, etc.) will be shared with the Buyer when an order is created for their listing or their listing is purchased.

Personal Data Processing Purposes:

  • • Smooth management of order processes
  • • Active and effective communication between Buyer and Seller
  • • Establishing a communication channel between Buyer and Seller in situations where the Site cannot operate effectively

How Long Are Your Personal Data Stored?

The retention period for your personal data is as follows:

If a period for data retention is determined in the law or relevant legislation, the data must be stored for at least this period.

Unless otherwise stipulated in the legislation, your personal data is generally stored for 10 years from the performance or termination of the contract.

Considering possibilities such as a court request or a request from an administrative authority authorized by law regarding the relevant data reaching us late, or the occurrence of a dispute to which we may be a party, a period of 6 months to 1 year is added to the retention periods stipulated in the legislation for data storage, and at the end of the determined period, the data is deleted, destroyed, or anonymized.

The data of Members who do not make any sales through the Site, only make purchases, or top up their balance, will be processed and stored for a minimum of 6 months, calculated from the date of the last transaction, due to the need to ensure trust in the buying and selling process, comply with legal regulations, and thus the obligation to process personal data.

The data of Members who make a successful sale through the Site will be processed and stored for a minimum of 3 years, calculated from the date of the last sale, due to the need to ensure trust in the buying and selling process, comply with legal regulations, and thus the obligation to process personal data.

If the legislation does not foresee a retention period for the data we process, your data is stored for the duration determined in the contract with you and as required by our relationship.

After the end of the aforementioned relationship or after the period determined in the contract, your data will be deleted, destroyed, or anonymized upon request, if the processing obligation ceases to exist.

What Are Your Rights as a Data Subject?

Within the scope of KVKK and relevant legislation regarding your personal data:

  • • You have the right to learn whether your personal data is being processed.
  • • If your personal data has been processed, you have the right to request information regarding this.
  • • You have the right to learn the purpose of processing your personal data and whether it is used in accordance with its purpose.
  • • You have the right to know the third parties to whom your personal data is transferred domestically or abroad.
  • • You have the right to request the correction of your personal data if it is incomplete or incorrectly processed.
  • • You have the right to request the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK legislation.
  • • When you request the correction of incomplete or incorrect data or the deletion or destruction of your personal data, you have the right to request that this situation be notified to third parties to whom we transfer your personal data.
  • • You have the right to object to a result arising exclusively from the analysis of processed data through automated systems against your person.

How Can You Exercise Your Rights?

You can submit your applications and requests regarding your personal data to the Data Controller's address above with a wet-signed petition and a photocopy of your ID.

In accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, the Data Subject must include their name, surname, signature if the application is written, T.C. identity number (passport number if the applicant is a foreign national), residence or business address for notification, email address if available for notification, phone number, and fax number, and information about the subject of the request in their application.

The Data Subject must clearly and understandably state the requested matter in the application, which includes explanations regarding the right they wish to exercise.

Information and documents related to the application must be attached to the application.

While the subject of the request must be related to the applicant's person, if acting on behalf of someone else, the applicant must be specially authorized in this regard and this authorization must be documented (special power of attorney).

Furthermore, the application must contain identity and address information and identity verifying documents must be attached to the application.

Requests made by unauthorized third parties on behalf of others will not be evaluated.

How Long Will Your Requests Regarding the Processing of Your Personal Data Be Answered?

Your requests for rights regarding your personal data will be evaluated and answered within a maximum of 30 days from the date they reach the relevant department.

If your application is evaluated negatively, the justified reasons for rejection will be communicated to you by mail to the address you provided in the application, and if possible, through the method by which the request was made.

Validity

The Disclosure Text will be valid as of the date of its publication by the Data Controller. The Data Controller may make changes to the Disclosure Text at any time if necessary.

Changes made by the Data Controller will become effective immediately upon publication of the Disclosure Text on Paytoskip.com.

Contact

If you have any questions or requests regarding this page, please contact us: [email protected]