KVKK Privacy Notice

Data controller: [ŞİRKET UNVANI] (the “Company”).

Legal name

[ŞİRKET UNVANI]

Address

[ŞİRKET ADRESİ]

MERSIS No

[MERSİS NO]

Tax office / No

[VERGİ DAİRESİ] / [VERGİ NO]

Registered e-mail (KEP)

[KEP ADRESİ]

Email

muhammed@aliguc.com

Data protection requests

[KVKK BAŞVURU E-POSTASI]

• Identity and contact: email address; on paid plans, full name, Turkish ID number, phone and billing address (only to pass them to the payment institution).
• Customer transactions: organization, membership, role, invitation, plan and subscription details; support correspondence.
• Transaction security: hash of the authentication value derived on your device, key derivation parameters, public and encrypted keys, two-factor authentication details, session and device information, security and activity logs with masked IP addresses, short-lived IP information used to prevent abuse.
• Encrypted vault contents: items encrypted on your device that the Company cannot read.

Your personal data is collected electronically, by partly or fully automated means, through the web application, the browser extension and email correspondence. For organization invitations, your email address is provided by the organization administrator who invites you. On paid plans, card details are collected directly through the payment institution's payment form and never reach the Company.

• Service providers (hosting, encrypted backup, email delivery): providing and securing the service.
• Licensed payment institution (paid plans): payment and subscription processing.
• Authorized administrators of organizations you belong to: managing organization membership (member list, roles, organization activity logs).
• Competent public authorities and courts: fulfilling legal obligations.

Because your vault contents are encrypted, they are not disclosed in readable form to any recipient.

We use service providers located abroad for supporting services such as encrypted backup and email delivery. Personal data is transferred to these providers in accordance with Article 9 of KVKK and with appropriate technical and organizational measures; backups are encrypted before transfer.

Your personal data is kept for as long as required by the purpose of processing and by law, and is then deleted, destroyed or anonymized. The main retention periods are listed in the Privacy Policy. You can delete your account at any time in Settings.

Under Article 11 of KVKK, you may apply to the Company to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom your data is transferred,
• request correction if your data is incomplete or inaccurate,
• request deletion or destruction under the conditions in Article 7 of KVKK,
• request that corrections, deletions or destructions be notified to third parties to whom your data was transferred,
• object to a result against you arising from analysis exclusively by automated systems,
• claim compensation if you suffer damage due to unlawful processing.

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request in Turkish by one of the following methods:

• a petition with wet signature, in person or via a notary public: [ŞİRKET ADRESİ]
• registered electronic mail (KEP): [KEP ADRESİ]
• signed with a secure electronic signature or mobile signature, or from the email address registered to your MGVault account: [KVKK BAŞVURU E-POSTASI]

Your application must include your name, surname and, for written applications, signature; your Turkish ID number (for Turkish citizens) or nationality and passport or ID number (for foreign nationals); your residential or business address for notifications; your email address, phone or fax number for notifications, if any; and the subject of your request. We may ask for additional information to verify your identity.

Your request will be concluded free of charge as soon as possible, and within 30 days at the latest, depending on its nature. If the request requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.

If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of KVKK.