1. Data controller
Under the Turkish Personal Data Protection Law No. 6698 (KVKK), your personal data may be processed by Piküp Medya Danışmanlık (the “Data Controller”) within the scope described below.
- Contact: info@digicardsystem.com
2. Personal data processed
In the course of providing the Service, the following may be processed: identity (name, surname), contact (e-mail, phone), customer transaction (account and subscription details), transaction security (IP, session and technical logs), marketing (with explicit consent) and the content users add to card profiles. As a rule, special categories of personal data are not processed; users are expected not to enter such data.
3. Purposes of processing
- Providing the platform service and performing the contract;
- Creating user accounts, authentication and authorisation;
- Invoicing and accounting, request/status management;
- Information security, fraud prevention, logging and auditing;
- Product/service development and statistics (anonymised/aggregated where possible);
- Fulfilling legal obligations and requests of competent authorities;
- Communication based on the data subject’s explicit consent (where given).
4. Method of collection and legal grounds
Data may be collected by automated or partly automated means through the website, the mobile-friendly interface, e-mail and support channels. The legal grounds, under KVKK Articles 5/2 and 6/3, are: being expressly provided for by law; being necessary for the conclusion or performance of a contract (save for factual impossibility); being necessary for the data controller to fulfil a legal obligation; being necessary for the establishment, exercise or protection of a right; legitimate interest (specific security and improvement activities); and, where required, the data subject’s explicit consent.
5. Transfers
Your personal data may be transferred, to the extent required by the Service and within a contractual relationship, to business partners such as server hosting, payment infrastructure, e-mail delivery, security and support. Where a transfer abroad takes place, the conditions of KVKK Articles 8 and 9 are observed. Requests of competent public authorities are reserved.
6. Retention period
Data is retained for as long as required by the relevant purpose of processing and by the statutory limitation and retention obligations we are subject to. At the end of the period it is deleted, destroyed or anonymised.
7. Rights of the data subject
Under KVKK Article 11 you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties to whom the data is transferred domestically or abroad; request correction of incomplete or inaccurate data; request deletion or destruction within the conditions set out in KVKK; object to a result that is to your detriment produced by automated analysis (if any); and claim compensation for damages.
8. Applications
To exercise your rights, you may apply to info@digicardsystem.com with information and documents that allow your identity to be verified. Requests are concluded free of charge within thirty (30) days at the latest, depending on their nature; if the transaction entails an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.
Your right to lodge a complaint with the Personal Data Protection Board is also reserved (www.kvkk.gov.tr).
9. Tenant users and visitor data
Administrators who use the platform on behalf of a business may create card content on behalf of their organisation. Where third-party (e.g. visitor) data is processed in this context, the relevant business may additionally need to fulfil its own notice and legal-basis obligations. The Data Controller operates the processes required for the technical delivery and security of the platform.