Privacy Notice under the Turkish Personal Data Protection Law (KVKK)

1. Data controller

Your personal data is processed by [COMPANY LEGAL NAME] (“katalog4b”, “we”) as the data controller.

• Address: [COMPANY ADDRESS]
• MERSIS number: [MERSIS NO]
• Email: [KVKK REQUEST EMAIL]
• Registered electronic mail (KEP): [KEP ADDRESS]

2. Personal data we process

We do not process special categories of personal data (such as health or biometric data). We do not build marketing profiles and do not use advertising or cross-site tracking cookies. We recommend avoiding people in your product photos.

3. Purposes of processing

• Creating your account, verifying your email address, and handling sign-in and password resets;
• Providing the Service: storing product photos, extracting product attributes from photos with artificial intelligence, generating catalogues and PDFs, previews, share links and QR codes;
• Tracking plans, periods and analysis credits, reviewing upgrade requests and, once a payment provider is integrated, processing payments;
• Sending in-app and push notifications, verification codes and password reset emails;
• Ensuring information security, preventing unauthorised access and abuse, rate limiting, detecting and fixing errors;
• Monitoring usage statistics and service costs to keep the Service reliable and improve it;
• Responding to support requests and communicating with you;
• Complying with legal obligations, responding to requests from competent authorities and protecting our rights in potential disputes.

4. Legal grounds

We process your personal data on the following legal grounds under Article 5 of the KVKK:

• Establishment or performance of a contract (Art. 5/2-c): opening your account, providing the Service, AI analysis, catalogue generation, notifications and plan management.
• Compliance with a legal obligation (Art. 5/2-ç): statutory retention and disclosures to authorities.
• Establishment, exercise or protection of a right (Art. 5/2-e): using records as evidence in a dispute.
• Legitimate interest (Art. 5/2-f): information security, activity logs, error monitoring and aggregated usage statistics, provided this does not harm your fundamental rights and freedoms.
• Explicit consent (Art. 5/1): only where none of the above applies and, for transfers abroad, where the other conditions of Article 9 of the KVKK cannot be relied on — given through the consent box at sign-up. You may withdraw consent at any time; withdrawal does not affect prior processing.

5. Transfers of personal data

We transfer personal data only for the purposes above and only to the extent necessary, to the following recipients:

Transfers abroad

Our AI, email and push notification providers are located abroad (USA). These transfers are made under Article 9 of the KVKK by putting in place one of the appropriate safeguards, such as signing the standard contractual clauses announced by the Personal Data Protection Board and notifying them to the Authority, or, where that is not possible, under the statutory exceptions and your explicit consent.

Only the product photo and the attribute list are sent to the AI provider. Under its commercial terms, the provider commits not to use content processed through its API to train its models. Your photos are only read to extract attributes; your product is never altered.

6. How we collect data

Personal data is collected electronically through the mobile app, web pages and email — either entered by you or collected automatically while you use the Service (device and activity logs).

7. Retention periods

When a retention period ends, personal data is deleted, destroyed or anonymised.

8. Your rights

Under Article 11 of the KVKK you have the right to apply to the data controller to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether it is used accordingly,
• know the third parties in Türkiye or abroad to whom it is transferred,
• request correction if it is incomplete or inaccurate,
• request deletion or destruction under the conditions of Article 7 of the KVKK,
• request that correction, deletion or destruction be notified to third parties to whom the data was transferred,
• object to a result against you arising exclusively from automated processing,
• claim compensation for damages arising from unlawful processing.

You can delete your account at any time in the app (Profile → Delete account) or on the account deletion page.

9. How to apply

You can submit requests in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, together with information verifying your identity, by email to [KVKK REQUEST EMAIL] from the email address registered to your account, via registered electronic mail to [KEP ADDRESS], or in writing to [COMPANY ADDRESS].

Your request will be concluded free of charge as soon as possible and within 30 days at the latest; if the process requires an additional cost, the fee set by the Personal Data Protection Board may be charged. If your request is rejected, the answer is insufficient or not given in time, you may lodge a complaint with the Personal Data Protection Board.

10. Changes

We may update this notice to reflect changes in law or in the Service. The current version is always published on this page, and we will notify you in the app of significant changes.