1. Data controller
Data controller: [COMPANY LEGAL NAME] ("Demor Digital"), [REGISTERED ADDRESS], tax office / tax number [TAX OFFICE / TAX NUMBER], MERSİS number [MERSİS NO], registered electronic mail (KEP) address [KEP ADDRESS].
This English text is a translation provided for convenience; the Turkish KVKK Aydınlatma Metni is the official notice.
2. Personal data we process
| Category | Data |
|---|---|
| Identity | Name; for invoices, national identity number where Turkish invoicing rules require it |
| Contact | Email address, billing address, phone number (optional) |
| Customer transaction | Workspace name, team membership and invitations, projects, reports, subscription and invoice records, support messages, notification and language preferences |
| Transaction security | Password hash, session records (IP address, browser user agent), last login time, API token hashes, encrypted Google service account keys and OAuth tokens, activity logs |
| Finance | Billing details, tax office and tax number, payment provider customer reference, invoices (card details are not stored by us) |
| Other | SHA-256 hash of the email address sent to Gravatar; Search Console performance data and site data of the projects you add |
3. Purposes of processing
- Creating and managing accounts and workspaces and providing the Service;
- providing indexing, Search Console, site audit, change monitoring and reporting features;
- sending service, alert and summary emails;
- managing trials, subscriptions, payments and invoices;
- ensuring information security and preventing misuse;
- answering requests and complaints;
- meeting legal obligations and responding to requests of authorised public bodies.
4. Legal grounds and method of collection
Your personal data is collected electronically: through the registration and account forms, your use of the application, the Google connection you set up, the payment forms, email correspondence, cookies and automatic server records.
It is processed on these legal grounds in Article 5(2) of the KVKK:
- (a) it is expressly provided for by law (record-keeping duties under tax and commercial law);
- (c) processing is necessary for the establishment or performance of a contract with you (account, workspace, features, subscription);
- (ç) processing is necessary to fulfil our legal obligations (invoices, accounting and tax records, requests of authorities);
- (e) processing is necessary to establish, exercise or protect a right;
- (f) processing is necessary for our legitimate interests, provided this does not harm your fundamental rights and freedoms (information security, prevention of misuse, rate limiting, profile photos).
5. Transfers
Your personal data may be transferred, for the purposes above and in line with Articles 8 and 9 of the KVKK, to the following recipients:
| Recipient | Purpose | Location |
|---|---|---|
| Google LLC | Indexing API, Search Console API and OAuth connection | USA |
| Stripe | Card payments in USD | USA / Ireland |
| iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) | Card payments in TRY | Turkey |
| Automattic Inc. (Gravatar) | Profile photos | USA |
| [EMAIL PROVIDER] | Sending emails | [EMAIL PROVIDER LOCATION] |
| [HOSTING PROVIDER] | Servers, database and backups | [HOSTING LOCATION] |
| Authorised public bodies and courts | Fulfilling legal obligations | Turkey |
Transfers abroad are made under Article 9 of the KVKK on this basis: [TRANSFER SAFEGUARDS].
6. Retention
Personal data is kept for as long as the purpose of processing requires and deleted, destroyed or anonymised afterwards. Account data is kept while the account exists, project data while the project exists, submission and activity logs for 90 days and invoices for the period required by law ([LEGAL RETENTION PERIOD]). Details are in our Privacy Policy.
7. Your rights under Article 11
Under Article 11 of the KVKK you have the right to:
- learn whether your personal data is processed;
- request information about the processing if it is processed;
- learn the purpose of the processing and whether the data is used in line with that purpose;
- know the third parties in Turkey or abroad to whom your data is transferred;
- request correction of incomplete or inaccurate data;
- request deletion or destruction of your data under the conditions of Article 7 of the KVKK;
- request that the third parties to whom your data was transferred are notified of the correction, deletion or destruction;
- object to a result to your detriment that arises from the analysis of your data exclusively by automated systems;
- claim compensation if you suffer damage because your data is processed unlawfully.
8. How to apply
You can send your request in writing to [REGISTERED ADDRESS], by registered electronic mail (KEP) to [KEP ADDRESS], or by email to [KVKK CONTACT EMAIL] from the email address registered in your Rankrama account, as provided in the Communiqué on the Procedures and Principles of Application to the Data Controller.
We answer free of charge as soon as possible and within 30 days at the latest. If answering requires additional cost, the fee set by the Personal Data Protection Board may be charged. If your request is rejected, you find the answer insufficient or we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of learning of our answer, and in any case within 60 days of your application.