Data Subject Information pursuant to KVKK Art. 10 and GDPR Art. 13
Version 1.0 | June 2025
1. DATA CONTROLLER
This Privacy Notice has been prepared by GXLOCAL TEKNOLOJİ VE DIŞ TİCARET A.Ş. in its capacity as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and Article 13 of the EU General Data Protection Regulation (GDPR 2016/679).
| Company Name | GXLOCAL TEKNOLOJİ VE DIŞ TİCARET A.Ş. |
| Address | Barbaros Mah. Begonya Sk. Alive Tower 7/14 Ataşehir/Istanbul, Turkey |
| MERSİS No | 0411114263900001 |
| Data Protection Contact | [email protected] |
| Website | https://www.gxlocal.com |
2. PERSONAL DATA PROCESSED, PURPOSES AND LEGAL BASES
| Category | Data Types | Purpose | Legal Basis |
|---|---|---|---|
| Identity Data | Name, surname, username | Identity verification, contract formation | KVKK 5/2(c) / GDPR 6/1(b) — Contract |
| Contact Data | Email, phone (optional) | Notifications, support, password reset | KVKK 5/2(c) / GDPR 6/1(b) — Contract |
| Company Data | Name, address, tax number | B2B service, invoicing, contracts | KVKK 5/2(c) / GDPR 6/1(b) — Contract |
| Technical Data | IP address, device info, logs | Security, fraud detection | KVKK 5/2(f) / GDPR 6/1(f) — Legitimate interest |
| Usage Data | Platform interactions, clicks | Service quality and improvement | KVKK 5/2(f) / GDPR 6/1(f) — Legitimate interest |
| Payment Data | Card/payment ref. no (paid plans) | Payment processing, accounting | KVKK 5/2(a) / GDPR 6/1(c) — Legal obligation |
| Marketing Data | Email open/click statistics | Personalised commercial communications | KVKK 5/1 / GDPR 6/1(a) — Explicit consent |
3. DATA RETENTION PERIODS
| Category | Retention Period | Legal Basis |
|---|---|---|
| Membership and contract data | Duration + 10 years | Turkish Commercial Code |
| Email consent records | 3 years from first message | Law No. 6563 |
| Log and access records | 2 years | Law No. 5651 |
| Payment and invoice records | 10 years | Tax Procedure Law |
| Marketing preferences | Until consent withdrawn or 3 years | Law No. 6563 |
4. DATA TRANSFERS
4.1 Domestic Transfers (Turkey)
Personal data may be shared with infrastructure providers, payment processors, and authorised public institutions and courts where legally required. All domestic transfers comply with KVKK Art. 8.
4.2 International Transfers
Data may be transferred internationally for cloud infrastructure, email delivery services, and analytics tools. Transfers are made to countries with an adequate level of protection, or under Standard Contractual Clauses and other appropriate safeguards pursuant to KVKK Art. 9 and GDPR Art. 46. Details of transfer destinations and safeguards are available upon request at [email protected].
4.3 Third-Party Agreements
Data Processing Agreements (DPAs) compliant with KVKK Art. 12 and GDPR Art. 28 are in place with all third-party processors.
5. DATA SECURITY
Gxlocal implements the following technical and administrative measures to protect your personal data:
- SSL/TLS encryption for all data in transit
- Role-based access control (least privilege principle)
- Regular security vulnerability scans and penetration testing
- Employee data protection training
- Data breach response plan
In the event of a data breach, notification will be made to the Personal Data Protection Authority within 72 hours (KVKK Art. 12/5; GDPR Art. 33) and to affected data subjects without undue delay (GDPR Art. 34).
6. YOUR RIGHTS AS A DATA SUBJECT
You have the following rights under KVKK Art. 11 and GDPR Arts. 15–22:
| Right | Scope | KVKK / GDPR Reference |
|---|---|---|
| Right to be informed | Know whether your data is being processed | KVKK 11/a — GDPR 15 |
| Right of access | Obtain information on categories and copies of data | KVKK 11/b — GDPR 15 |
| Right to rectification | Correct inaccurate or incomplete data | KVKK 11/d — GDPR 16 |
| Right to erasure | Request deletion where conditions are met | KVKK 11/e — GDPR 17 |
| Right to restriction | Restrict certain processing activities | GDPR 18 |
| Right to portability | Receive data in a structured, machine-readable format | GDPR 20 |
| Right to object | Object to legitimate interest processing or profiling | KVKK 11/g — GDPR 21 |
| Right to compensation | Seek redress for damage caused by unlawful processing | KVKK 11/h — GDPR 82 |
How to Exercise Your Rights
Submit a written request to [email protected] with sufficient information to verify your identity. Requests will be responded to within 30 days (extendable to 60 days where justified). Responses are free of charge; a reasonable fee may be charged for manifestly unfounded or excessive requests.
If your request is not answered or you are unsatisfied with the response, you may lodge a complaint with the Personal Data Protection Authority (www.kvkk.gov.tr) in Turkey, or with the competent EU supervisory authority in your country of residence.
7. COOKIES AND TRACKING TECHNOLOGIES
| Cookie Type | Purpose | Retention | Disableable? |
|---|---|---|---|
| Essential Cookies | Session management, authentication | Session | No |
| Functional Cookies | Language and preference storage | 1 year | Yes |
| Analytics Cookies | Usage statistics (e.g. Google Analytics) | 2 years | Yes |
| Marketing Cookies | Targeted advertising | 2 years | Yes |
Cookie preferences can be managed via the Cookie Policy page at gxlocal.com and through browser settings. Processing for marketing and behavioural analytics purposes is managed through these cookie preferences.
8. UPDATES TO THIS NOTICE
When this Notice is updated, the new version will be published on the Platform and a notification sent to the registered email address. Significant changes that require re-consent will be accompanied by a new consent request.
EXPLICIT CONSENT — COMMERCIAL ELECTRONIC COMMUNICATIONS (revised)
The following consent requires your explicit consent under KVKK and GDPR and is collected during registration through a separate, optional checkbox; declining it does not affect your access to the Platform.
☐ Commercial Electronic Communications: I consent to receiving product updates, campaigns, and educational content from GXLOCAL TEKNOLOJİ VE DIŞ TİCARET A.Ş. via email, SMS, and push notifications. I may withdraw this consent at any time.
Processing for marketing and behavioural analytics purposes is not handled in the registration form but through your cookie preferences (see Section 7).
Important notes:
- Declining this consent does not restrict your access to the Platform.
- You may withdraw your consent at any time by notifying
[email protected]. - Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.