Personal Data Protection and Processing Disclosure

1. Identity of the Data Controller

In accordance with KVKK, as the "Data Controller," Creasiv will record, store, update, and where permitted by legislation or necessary for the purpose for which they are processed, disclose or transfer your personal data to third parties within the framework of the purposes and limits described below, in compliance with law and principles of good faith.

2. Your Personal Data Processed

When you use our services, the following personal data may be processed depending on the nature of the relationship:

• Identity Data: Name, surname, national ID number, date of birth, title.
• Contact Data: Email address, phone number, residential/business address.
• Customer Transaction Data: Invoice details, order information, requests and complaints, contract details.
• Transaction Security Data: IP address, website entry-exit logs, password information, cookie data.
• Financial Data: Bank account number, IBAN, payment and invoice information.

3. Purposes of Processing Your Personal Data

Your collected personal data is processed for the following purposes within the scope of personal data processing conditions specified in Articles 5 and 6 of KVKK:

• To properly perform the design, software, consulting, and digital services offered by our company,
• To deliver products and services in accordance with contractual terms,
• To create customer records and manage accounts,
• To manage and finalize request, complaint, and support processes,
• To fulfill storage, reporting, and information obligations arising from legislation (e.g., Tax Procedure Law, Turkish Commercial Code, Law No. 5651),
• To conduct the administrative, financial, legal, and commercial processes of our company,
• With your explicit consent; to send you commercial electronic messages (email, SMS) about campaigns, promotions, discounts, and new services.

4. Transfer of Your Personal Data

Your personal data may be transferred within the framework of Articles 8 and 9 of KVKK, provided that the purposes stated above are fulfilled and our legal obligations are met, to:

• Authorized public institutions and organizations (Courts, Prosecutors, Ministries, etc.),
• Our suppliers and local/international business partners from whom we procure infrastructure/server/cloud computing services for the performance of our services (with necessary security measures taken),
• Independent audit firms, sworn financial advisors, and customs consultants for financial legislation obligations,
• Our contracted lawyers and legal advisors for the follow-up of legal processes.

5. Method and Legal Basis for Collecting Personal Data

Your personal data is obtained through automatic or fully/partially non-automatic means such as our company's website, contact forms, support panels, call center, email, physical documents, and contracts.

Our processing activities are based on the following legal grounds stated in Article 5 of KVKK:

• Being explicitly stipulated by laws,
• Being necessary for the processing of personal data of the parties to a contract, provided that it is directly related to the establishment or performance of a contract,
• Being mandatory for the data controller to fulfill its legal obligation,
• Being made public by the data subject themselves,
• Being mandatory for the establishment, exercise, or protection of a right,
• Being mandatory for the legitimate interests of the data controller, provided that fundamental rights and freedoms of the data subject are not harmed.

6. Rights of the Data Subject (KVKK Article 11)

As personal data subjects, your rights within the scope of Article 11 of KVKK are as follows:

• Learning whether personal data is being processed and requesting information,
• Learning the purpose of processing personal data and whether they are used in accordance with their purpose,
• Knowing third parties to whom personal data has been transferred domestically or internationally,
• Requesting correction if personal data has been processed incompletely or incorrectly,
• Requesting deletion (Right to be Forgotten) or destruction of data when conditions are met,
• Objecting to a result that arises against you through the analysis of processed data exclusively by automated systems,
• Requesting compensation for damages incurred due to unlawful processing.

7. Contact Form and Application Procedure

You may submit your requests regarding the exercise of the above-mentioned rights to us in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller: