PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

As IFM Teknoloji A.Ş. ("Company"), in our capacity as data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), we would like to inform you about the processing of your personal data. This privacy notice has been prepared in accordance with Article 10 of KVKK and the Communiqué on Procedures and Principles to be Followed in Fulfilling the Obligation of Disclosure.

1. Identity of the Data Controller

Your personal data is processed by the data controller whose information is provided below:

• Company Name: IFM Teknoloji A.Ş.
• Address: Bağlarbaşı Mah. Sakarya Sok. Malte Plaza No: 35/1 Maltepe - İSTANBUL
• Email: info@iyifikirmedya.com
• Phone: 0216 599 00 39

2. Personal Data Processed

The following categories of your personal data are processed within the scope of providing SERP Takip services:

2.1. Identity Information

• First and last name
• Username

2.2. Contact Information

• Email address
• Phone number (optional)
• Billing address

2.3. Account and Security Information

• Password (stored as one-way encrypted/hashed)
• Account creation date
• Last login date and time
• Email verification status
• Two-factor authentication preferences

2.4. Financial Information

• Billing information
• Payment history
• Subscription plan and status
• Tax identification number (for corporate customers)

2.5. Usage and Transaction Information

• Created projects and keywords
• Ranking tracking data
• Report generation history
• Activities on the platform

2.6. Technical and Log Information

• IP address
• Browser type and version
• Operating system
• Device information
• Cookie data
• Session information
• Error logs

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

3.1. Service Delivery

• Providing SERP tracking services
• Conducting keyword ranking analyses
• Creating and presenting reports
• Managing user accounts
• Processing subscription transactions

3.2. Communication

• Sending service updates and notifications
• Responding to support requests
• Delivering ranking change notifications
• Providing billing and payment information

3.3. Security and Legal Obligations

• Ensuring account security
• Preventing fraud and abuse
• Fulfilling legal obligations
• Using as evidence in legal disputes

3.4. Improvement and Analysis

• Improving service quality
• Enhancing user experience
• Detecting and resolving technical issues
• Conducting statistical analyses

4. Method of Collecting Personal Data

Your personal data is collected through the following methods:

4.1. Data Collected Automatically

• Through cookies and similar technologies when you visit our website
• Through system logs when you use our platform
• Automatically during email communications

4.2. Data Collected Directly from You

• When you fill out the registration form
• When you update your account information
• When you create a support request
• When you make a payment transaction

5. Legal Grounds for Processing Personal Data

Your personal data is processed based on the following legal grounds within the scope of Articles 5 and 6 of KVKK:

5.1. Performance of Contract (Article 5/2-c)

Your data is processed for the establishment of user and subscription agreements and the fulfillment of our obligations under these agreements.

5.2. Legal Obligation (Article 5/2-ç)

Your data is processed to fulfill our obligations under tax legislation, e-commerce legislation, and other legal regulations.

5.3. Legitimate Interest (Article 5/2-f)

Your data is processed within the scope of our legitimate interests, such as improving our services, ensuring security, and preventing fraud, without harming your fundamental rights and freedoms.

5.4. Explicit Consent (Article 5/1)

Your data is processed based on your explicit consent for marketing communications and non-essential cookies. You may withdraw your consent at any time.

6. Transfer of Personal Data

6.1. Domestic Transfer

Your personal data may be transferred to the following parties for the realization of the purposes stated above:

• Payment service providers (PayTR, etc.)
• Email delivery service providers
• Cloud infrastructure service providers
• Authorized public institutions and organizations when legally required
• Courts and enforcement offices in legal disputes

6.2. International Transfer

Some infrastructure services we use to provide our services (servers, databases, email delivery, etc.) may be located abroad. These transfers are carried out under Article 9 of KVKK:

• To countries with adequate protection
• To data controllers who commit to adequate protection
• When your explicit consent is obtained

7. Retention Period of Personal Data

Your personal data is retained for the period required by the processing purposes:

• Account information: As long as your account is active and 2 years after account closure
• Financial data and invoices: 10 years as required by tax legislation
• Log records: 2 years as required by Law No. 5651
• Communication records: 3 years
• Cookie data: Until the end of the session or maximum 1 year depending on cookie type

8. Your Rights as Data Subject

You have the following rights pursuant to Article 11 of KVKK:

1. To learn whether your personal data is being processed
2. To request information about processing if your personal data has been processed
3. To learn the purpose of processing your personal data and whether they are used in accordance with their purpose
4. To know the third parties to whom your personal data has been transferred domestically or abroad
5. To request correction of your personal data if it has been processed incompletely or incorrectly
6. To request deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of KVKK
7. To request that correction and deletion operations be notified to third parties to whom your personal data has been transferred
8. To object to the occurrence of a result against you through analysis of processed data exclusively by automated systems
9. To claim compensation for damages if you suffer damage due to unlawful processing of your personal data

9. Application Method

You can apply using the following methods to exercise your rights stated above:

• Email: By sending an email containing your identity verification to info@iyifikirmedya.com
• Mail: By sending a wet-signed petition to Bağlarbaşı Mah. Sakarya Sok. Malte Plaza No: 35/1 Maltepe - İSTANBUL
• Registered Email: By sending from your registered email address to our company's registered email address

Your application should clearly state your name, surname, Turkish ID number, notification address, email address if any, phone number, and subject of your request. Your applications will be concluded free of charge within the shortest time and within 30 (thirty) days at the latest, depending on the nature of your request.

10. Changes to the Privacy Notice

This privacy notice may be updated due to changes in legal regulations or changes in our data processing activities. In case of significant changes, you will be notified through our website or by email. You can always access the current privacy notice on our website.