Turkish Data Protection (KVKK) Notice

1. Data Controller

This notice is provided by KOF (kofbot.com), which operates the KOF platform from Turkey, in its capacity as data controller and in fulfilment of its obligation to inform under the Law No. 6698 on the Protection of Personal Data of the Republic of Turkey (the "KVKK"). This notice is prepared under, and governed by, the laws of the Republic of Turkey.

Your personal data may be processed, recorded, stored, classified, updated and, where permitted by law, transferred to third parties by KOF for the purposes described below, lawfully and in good faith.

If you live outside Turkey, the data protection law of your country, such as the EU General Data Protection Regulation (GDPR) or the UK GDPR, may give you additional rights. Those rights, and how to exercise them, are described in our Privacy Policy.

2. Personal Data We Process

We process personal data in the following categories through the platform:

3. Purposes of Processing Personal Data

We process your personal data for the following purposes:

• Creating and managing your member account
• Providing and improving the platform services (bot, forum, chat, store)
• Processing orders and payments
• Responding to customer support requests
• Keeping the platform secure and preventing fraud
• Complying with legal obligations (invoicing, tax, obligations towards the Turkish Financial Crimes Investigation Board (MASAK), etc.)
• Statistical analysis and service development
• Marketing and advertising activities, with your explicit consent

4. Legal Grounds for Processing Personal Data

We process your personal data on the following legal grounds set out in Articles 5 and 6 of the KVKK:

• Establishment and performance of a contract (Article 5(2)(c)): Creating your account, providing the services, processing payments
• Legal obligation (Article 5(2)(ç)): Complying with legal requirements (invoicing, tax, etc.)
• Legitimate interest (Article 5(2)(f)): Platform security, fraud prevention, service improvement
• Explicit consent (Article 5(1)): Marketing communications, advertising cookies, personalised content

5. Transfers of Personal Data

Your personal data may be transferred to the following parties for the purposes described above:

• Payment providers: To process payments securely
• Google (Analytics, Ads, reCAPTCHA): For analytics, advertising and bot protection (explicit consent/legitimate interest)
• Meta (Facebook Pixel): To measure advertising performance (explicit consent)
• Authorised public authorities and institutions: Where required by law

Your personal data is processed in Turkey and on servers located in the European Union, and may also be processed in the countries where these service providers or their servers are located. Transfers of personal data abroad are carried out in accordance with Article 9 of the KVKK and with the necessary security measures in place.

6. Data Retention Periods

We keep your personal data for as long as the purposes for which it is processed require:

When the retention period expires or the purpose of processing no longer exists, your personal data is deleted, destroyed or anonymised in accordance with Article 7 of the KVKK.

7. Data Security Measures

In accordance with Article 12 of the KVKK, we take the following technical and organisational measures to keep your personal data secure:

• Passwords are hashed with the bcrypt algorithm before being stored
• All data in transit is protected by SSL/TLS encryption
• Access controls and authorisation mechanisms are applied
• Regular security audits and updates are carried out
• In the event of a data breach, the Turkish Personal Data Protection Board and the data subjects concerned are notified in accordance with Article 12(5) of the KVKK

8. Your Rights as a Data Subject

Under Article 11 of the KVKK, you have the right to:

• Learn whether your personal data is processed
• Request information about the processing if your personal data has been processed
• Learn the purpose of the processing and whether your personal data is used in line with that purpose
• Know the third parties in Turkey or abroad to whom your personal data is transferred
• Request the rectification of your personal data if it is incomplete or inaccurate
• Request the erasure or destruction of your personal data within the framework of Article 7 of the KVKK
• Request that the rectification or erasure be notified to the third parties to whom your personal data has been transferred
• Object to a result to your detriment arising from the analysis of your data exclusively by automated systems
• Claim compensation for damage you suffer as a result of the unlawful processing of your personal data

The rights you may have under the GDPR, the UK GDPR or the data protection law of your country are described in our Privacy Policy.

9. How to Submit a Request

You can exercise the rights listed above using the following methods:

• Email: A written request sent to [email protected], together with information that allows us to verify your identity
• Contact Form: A request submitted through the kofbot.com/contact page

We will conclude your request free of charge as soon as possible, depending on its nature, and in any event within 30 days. If the action requires an additional cost, the fee schedule set by the Turkish Personal Data Protection Board applies.