KVKK Clarification Text

Data controller

Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller for figtures.com and for inquiry, sales, and contract processes is Büşra Diba Aktaş Mert (Figtures), İçerenköy Mah. Topçu İbrahim Sok. Quick Tower Sit. No: 8-10D, Ataşehir, İstanbul, Turkey, contact@figtures.com.

For products built for a client in which the client’s own users’ data is processed, controller and processor roles are defined in the project agreement and, where needed, a data processing agreement.

Personal data we process

• • Identity: name and surname; company name and role for business clients
• • Contact: email, phone, billing and correspondence address
• • Customer transaction: project request, proposal, contract, delivery, approval, and support records
• • Finance: billing details, amount, payment reference, and payment outcome (Figtures never receives card numbers or CVV)
• • Security: IP address, browser data, access and security logs
• • Marketing and measurement: cookie preferences and, only with consent, analytics and advertising data
• • AI tools: project text you enter into our free calculators and analysis tools

Collection methods, purposes, and legal bases

Data is collected through the contact form, email, phone, proposal and contract documents, payment notifications from the payment institution, cookies, and server logs.

Responding to requests, preparing proposals, concluding and performing contracts, delivery, and support: KVKK Art. 5/2(c).

Invoicing, bookkeeping, and notifications to authorities: KVKK Art. 5/2(ç) (legal obligation).

Site security, abuse prevention, and protection of rights in disputes: KVKK Art. 5/2(e) and 5/2(f).

Non-essential analytics and marketing cookies run only with your explicit consent under KVKK Art. 5/1. Submitting the contact form does not constitute marketing consent.

Recipients

• • Payment: İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico), to process card payments, prevent fraud, and meet payment regulations. iyzico acts as an independent controller under its own privacy notice.
• • Hosting and infrastructure: Amazon Web Services (hosting), Supabase (content management), Cloudflare (bot and spam protection).
• • Communication: Google Workspace (business email), EmailJS (delivering contact form messages).
• • Measurement and AI tools: Google Analytics and Google Tag Manager (consent only), Google Gemini (processing text you enter into AI tools).
• • Accountants and, where needed, legal advisors.
• • Competent public authorities and courts, on request and as permitted by law.

Cross-border transfers

Servers of Google, Amazon Web Services, Supabase, Cloudflare, and EmailJS may be located outside Turkey, so data processed through them is transferred abroad.

Such transfers rely on an adequacy decision where one exists and otherwise on the standard contractual clauses published by the Turkish Personal Data Protection Board, as required by KVKK Art. 9. Occasional, non-recurring transfers not covered by standard clauses rely on one of the incidental transfer grounds in KVKK Art. 9/6.

Retention periods

• • Inquiries that do not lead to a contract: 2 years from the last correspondence
• • Contracts, invoices, payment and accounting records: 10 years from the end of the relevant calendar year
• • Distance contract, pre-contract information, and consent records: 10 years together with contract records
• • Server access and security logs: 2 years
• • Analytics data: as configured in Google Analytics, up to 14 months
• • Your cookie choice: in your browser until you change it or clear browser data

Your rights

Under KVKK Art. 11 you may request access, information, correction, deletion or destruction, notification of third parties, object to adverse results of solely automated analysis, and claim compensation for unlawful processing. Send your request with identifying details to İçerenköy Mah. Topçu İbrahim Sok. Quick Tower Sit. No: 8-10D, Ataşehir, İstanbul, Turkey in writing or from your registered email to contact@figtures.com. Requests are answered free of charge within 30 days at the latest.

Authoritative language

The Turkish version of this notice prevails. This English version is provided for convenience.