This notice has been prepared pursuant to Turkish Personal Data Protection Law No. 6698 (“KVKK”) to explain how your personal data is processed in connection with the services provided by Netbioca Creative Studio, its website, customer accounts, quotation requests, and communication processes.

1. Data Controller and Contact Details

Data controller: Netbioca Creative Studio

Address: Mithatpaşa, Bülent Ecevit Cd. No: 17 İç Kapı No: 408, 67100 Merkez/Zonguldak, Türkiye
Email: info@netbioca.com
Phone: +90 541 302 46 22

In this notice, “Netbioca” refers to the data controller.

2. Personal Data We Process

Depending on the nature of your relationship with Netbioca and the services you receive, the following personal data may be processed:

• Identity and contact information: First name, surname, telephone number, email address, and address details.
• Customer and transaction information: Account details, quotation requests, orders, services purchased, contracts, and support requests.
• Billing and payment information: Identity or tax information required for invoicing, billing address, payment amount, payment status, transaction references, and account details required for refunds.
• Communication content: Messages and attachments you submit through forms, email, online messaging applications, and other support channels.
• Transaction security information: IP address, access time, session and transaction logs, and device and browser information necessary to maintain service security.
• Website usage information: Pages visited, interactions, and cookie identifiers, depending on the analytics tools used.

Please avoid sharing personal data unrelated to your request or special categories of personal data in your communications and support requests.

3. Purposes and Legal Bases for Processing

Your personal data is processed for the following purposes and on the legal bases specified below:

Quotations, membership, and service provision: Data necessary to evaluate your requests, prepare quotations, manage your customer account, fulfil your orders, send service-related notifications, and provide technical support is processed on the legal basis of the establishment or performance of a contract under Article 5(2)(c) of the KVKK.

Corporate customer communications: If you contact us as an employee or representative of a company, your business contact details and related correspondence are processed to manage the service relationship with your company, on the basis of legitimate interests under Article 5(2)(f) of the KVKK, provided that your fundamental rights and freedoms are not prejudiced.

Invoicing and legal obligations: Data necessary to issue invoices, maintain accounting records, and fulfil obligations towards competent authorities is processed under Articles 5(2)(a) and 5(2)(ç) of the KVKK, to the extent required by applicable legislation.

Protection of rights: Payment, contract, request, and transaction records are processed to resolve disputes and exercise or protect legal rights under Article 5(2)(e) of the KVKK.

Security and operations: Data necessary to prevent unauthorised access and misuse, maintain service security, and respond to general enquiries outside the scope of a contract is processed on the basis of legitimate interests under Article 5(2)(f) of the KVKK, provided that your fundamental rights and freedoms are not prejudiced.

Where a processing activity relies on explicit consent, you will be informed separately about that activity, and your consent will be obtained separately. This privacy notice does not constitute marketing permission or a declaration of explicit consent.

4. Methods of Collecting Personal Data

Your data is collected electronically or physically through website forms, registration and order pages, the customer panel, email, telephone, online messaging applications, SMS processes, contracts, and technical records generated during your use of the services.

Transaction results and delivery statuses received from payment and SMS providers may also be collected as part of delivering the relevant service.

Website usage data may be collected through cookies and similar technologies. Separate information must be provided regarding the purposes, durations, and legal bases of the cookies used.

5. Disclosure and Transfer of Personal Data

Your personal data may be shared with the following categories of recipients, limited to what is necessary for the relevant purpose:

• Payment service providers: Transaction, identity, and contact information necessary to process payments, collections, refunds, and payment security procedures.
• SMS service providers: Telephone numbers, message content, and transmission information necessary to send SMS messages and track delivery.
• Hosting and technical infrastructure providers: Information necessary to operate the website and customer panel, host data, and maintain technical security.
• Email and online communication service providers: Contact information, message content, and attachments necessary to transmit, store, and respond to correspondence, quotations, and support requests.
• Analytics and security service providers: Technical information and usage data processed by the relevant tools to measure website usage and identify automated or abusive requests.
• Competent public authorities and judicial bodies: Information necessary to fulfil statutory obligations and respond to lawful requests.
• Legal and financial service providers: Where such services are obtained, information necessary to fulfil accounting obligations and protect legal rights.

Transfers within Türkiye are subject to the conditions set out in Article 8 of the KVKK, in accordance with the relevant processing purpose and the legal bases explained in this notice.

The servers hosting our website are located in Türkiye. However, infrastructure outside Türkiye is used for email, online communication, visitor analytics, and security services. Depending on the service used, contact details, correspondence, attachments, IP addresses, device and browser information, and usage data may be processed on service providers’ systems outside Türkiye.

International transfers of personal data are subject to the conditions set out in Article 9 of the KVKK. Reading this notice or using our communication channels does not constitute explicit consent to international data transfers.

6. Retention Period

Your personal data is retained for the periods prescribed by applicable legislation and for as long as required by the purpose of processing. Retention periods are determined by considering the service relationship, statutory record-keeping obligations, and limitation periods relevant to the protection of rights.

When all conditions justifying processing cease to exist, the data is deleted, destroyed, or anonymised in accordance with applicable legislation.

7. Your Rights and How to Submit a Request

Under Article 11 of the KVKK, you may ascertain whether your personal data is being processed, request information if it has been processed, learn the purposes of processing and the recipients to whom data has been transferred, request the correction of inaccurate or incomplete data, request deletion or destruction where the statutory conditions are met, and exercise your other rights under that Article.

You may submit your request in writing to the address above or by emailing info@netbioca.com from an email address that you have previously provided to us and that is registered in our system. You may also use other application methods provided for by applicable legislation.

Your request must include the information specified in the Communiqué on the Procedures and Principles for Applications to the Data Controller. Requests will be resolved free of charge as soon as possible, depending on their nature, and no later than thirty days. If the process incurs an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.