Turkiye Privacy Notice (KVKK)

This notice adds Turkiye-specific information to the Tanqory Global Privacy Policy. It gives the information Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") requires when KVKK applies to how Tanqory Inc. ("Tanqory", "we", "us") handles your personal data. Where this notice and the Global Privacy Policy differ for a person in Turkiye, this notice applies.

Official references:

• Personal Data Protection Authority (KVKK): https://www.kvkk.gov.tr/
• Law No. 6698 (official text): https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5

---

1. Who is responsible

• Tanqory Inc. is the data controller for personal data about merchants, developers, visitors to Tanqory websites and users of Tanqory apps. Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA.
• Merchant stores: when you buy from a store that runs on Tanqory, the merchant is the data controller and Tanqory processes that data on the merchant's behalf under our Data Processing Addendum. Ask the merchant first about your rights; we help the merchant answer.
• Contact: privacy@tanqory.com. Please write "KVKK request" in the subject line.

2. What we collect and why (Articles 5 and 10)

The categories of data, how we collect them (electronically, through our websites, apps, support channels and service providers), purposes, recipients and retention periods are listed in the Global Privacy Policy (sections "Personal Data We Collect", "How We Use Personal Data", "Sharing of Personal Data with Third Parties" and "Data Retention and Deletion"). The KVKK legal ground we rely on for each purpose is:

We do not ask for special categories of personal data (Art. 6), such as health, religion, biometric or criminal records data, to use Tanqory.

3. Your rights (Articles 11, 13 and 14)

Under Article 11 you can ask us:

• whether we process your personal data, and for information about that processing;
• the purpose of the processing and whether the data is used for that purpose;
• which third parties in Turkiye or abroad receive your data;
• to correct incomplete or inaccurate data, and to delete or destroy data under Article 7, and to tell the third parties who received it;
• to object to a result against you that arises only from automated analysis of your data;
• for compensation if you suffer damage because of unlawful processing.

You can also withdraw consent at any time: use the unsubscribe link, your account settings, or email us. Withdrawing does not affect processing done before.

Send requests in writing to privacy@tanqory.com. We will check your identity before we act. We answer free of charge as soon as possible and within 30 days at the latest (Art. 13). If the reply takes significant extra cost, the Law allows a fee set by the Board; we will tell you before charging anything.

If we reject your request, do not reply in time, or you find our answer insufficient, you can complain to the Personal Data Protection Board within 30 days of our answer, and in any case within 60 days of your request (Art. 14).

4. Children

Tanqory is built for businesses and is not meant for children. You must be 18 or older to open a merchant account. We do not knowingly collect data from children. If we learn that we did without a valid legal ground, we delete it.

5. Cookies and similar technologies

Strictly necessary cookies are always on. For other cookies (analytics and ad measurement) on Tanqory websites, visitors in Turkiye see our cookie notice and can switch them off at any time in the cookie settings. We also honour Global Privacy Control signals from your browser. The full list is in our Cookie Policy.

6. Transfers outside Turkiye (Article 9)

Tanqory is a US company. Today our platform data is hosted by DigitalOcean in Singapore, and some of our service providers process data in the United States and other countries (see the subprocessor list). When personal data leaves Turkiye we rely on a ground that Article 9 allows: appropriate safeguards such as the standard contracts published by the Board, or, for occasional transfers, a ground such as performing our contract with you. You can ask us which safeguard applies to your data.

7. Security and data breaches (Article 12)

We protect personal data with the measures described in the Global Privacy Policy section "Data Security Measures". If personal data is obtained by others unlawfully, we notify the Personal Data Protection Board within 72 hours of becoming aware of it, as the Board's decision 2019/10 expects, and tell the people affected as soon as possible after we identify them.

8. How long we keep data (Article 7)

We keep personal data only as long as the purposes in section 2 need, or longer if a law requires it (for example tax records). Periods are listed in our Data Retention Policy. After that we delete, destroy or anonymise the data.

9. Changes and language

We will post changes to this notice here and change the "Last updated" date. For a material change we will also tell you prominently, for example by email or with a notice on our website or app. This notice is in English.

Change history