Version 2026-09-19.2 ·
KVKK Privacy Notice
This notice addresses personal-data processing for business accounts, support and service security under Turkish Law No. 6698. It is separate from consent and is not a marketing permission request.
1. Controller and scope
The controller is the operator identified below. Anonymous visitor counters do not contain visitor IDs or per-person browsing histories. Google sign-in, business account administration, support and security may involve personal data; this notice concerns those activities.
2. Data, collection and purposes
Identity/contact data includes name, email and any phone/address supplied. Customer-transaction data includes business authorization, account actions, accepted terms versions and any applicable billing records. Security records may include session, authentication and lawfully required technical records. Data is received through Google sign-in, forms, account actions, support correspondence and service infrastructure to establish accounts, deliver the service, communicate, bill where applicable, protect accounts and meet legal obligations.
3. Legal grounds
Processing necessary for the account/service contract relies on KVKK Article 5(2)(c); legal duties on 5(2)(ç), rights/claims on 5(2)(e), and proportionate security interests on 5(2)(f), subject to the required balancing. A statutory requirement may rely on 5(2)(a). Where another activity genuinely requires explicit consent, it is requested separately and specifically. Acknowledging this notice does not create consent.
4. Recipients, transfer and retention
Necessary data may be shared with authorized hosting, database, authentication, professional support providers and competent public authorities for the stated purposes, subject to KVKK Articles 8 and 9. International processing must use a lawful Article 9 transfer mechanism. Retention depends on the activity, applicable law and necessary claims periods; unnecessary personal data is deleted, destroyed or anonymized. The operator must finalize provider, transfer and retention details before publication.
5. Article 11 rights and applications
You may ask whether your data is processed, obtain information, learn purposes and recipients, request correction or lawful erasure/destruction and notification to recipients, object to adverse outcomes from exclusively automated analysis, and seek compensation for unlawful processing. Apply in writing to the address below or through another legally valid application channel with sufficient identification and the request's subject; do not send unnecessary sensitive documents. Applications are handled as soon as possible and within 30 days, subject to statutory exceptions and permitted costs.
Controller and contact
Gustola is operated by Mert Eren KARA.
Data Controller: Mert Eren KARA
E-mail: [email protected]