Legal
Privacy Notice
Version: taslak-2026-10-24
This English translation is provided for information only. In case of any conflict, the Turkish text prevails.
This notice is provided under Article 10 of Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to explain how we process the personal data of people who buy e-books on vertadanismanlik.com.tr or contact us.
1. Data controller
| Data controller | Verta Mali Danışmanlık ve Denetim A.Ş. |
|---|---|
| MERSİS number | 6438691465934996 |
| Address | Headquarters: Verta Mali Danışmanlık ve Denetim A.Ş. Şehit Adem Yavuz Sokak 8/15 06420 Kızılay/ANKARA, Türkiye Telephone: +90 553 144 06 56 |
| nkuyanik@yahoo.com.tr | |
| Telephone | +90 553 144 06 56 |
2. Personal data we process
| Category | Data |
|---|---|
| Identity | First name, surname; Turkish identity number (T.C. kimlik numarası) for the invoice and for buyer verification by the payment institution (foreign buyers without a Turkish identity number are not asked for one) |
| Contact | E-mail address, telephone number, address, city, country |
| Customer transaction | Order number, e-book purchased, price, VAT rate, amount paid, number of instalments, payment status and payment institution transaction numbers, invoice number, number and time of downloads, refund records, correspondence with us |
| Transaction security | IP address used when placing the order and accepting the agreement, date and time of acceptance, versions of the texts accepted, result of the payment institution's fraud check |
Card numbers and other card details are entered on iyzico's payment page; we do not see, process or store them. No special categories of personal data are processed.
3. How we collect personal data
We collect your personal data by wholly or partly automated means through the order form on our website, the payment result notifications sent to us by the payment institution, and your e-mails, calls or letters.
4. Purposes and legal bases
| Purpose | Data | Legal basis (KVKK Art. 5(2)) |
|---|---|---|
| Concluding and performing the distance sales agreement: taking the order and payment, delivering the e-book, sending the download link and order e-mail, personalising the file with the buyer's details, handling support and refund requests | Identity, contact, customer transaction | (c) Directly related to the conclusion or performance of a contract |
| Issuing e-Arşiv invoices, keeping and retaining accounting records | Identity (incl. Turkish identity number), contact, customer transaction | (ç) Compliance with a legal obligation (Tax Procedure Law No. 213, Turkish Commercial Code No. 6102) |
| Proving that preliminary information was given and the agreement was accepted; retaining distance sales records | Identity, contact, customer transaction, transaction security | (ç) Compliance with a legal obligation (Law No. 6502 and Distance Contracts Regulation, Art. 20); (e) establishment, exercise or protection of a right |
| Preventing fraud and abuse, limiting excessive use of the order form, detecting unauthorised sharing of e-books | Transaction security, identity, contact, customer transaction | (f) Our legitimate interests, provided your fundamental rights and freedoms are not harmed |
| Handling complaints, disputes and requests from authorities | All relevant data | (ç) Legal obligation; (e) establishment, exercise or protection of a right |
Your personal data is not used for marketing or advertising, and we do not send you commercial electronic messages.
5. Recipients
Your personal data is shared with the following recipient groups, only for the purposes above:
- Payment institution: iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (Türkiye). Your identity, contact, customer transaction and IP address data is sent to iyzico to take the payment, run fraud checks and process refunds (KVKK Art. 5(2)(c) and (ç)). iyzico's own privacy notice applies to its processing under payment services law.
- E-mail delivery service: Mailgun Technologies, Inc. (United States). The order e-mail (your name, e-mail address, order summary, and the telephone number and address contained in the preliminary information form and agreement attached to the e-mail) is sent through Mailgun via servers located in the European Union. Mailgun acts as a data processor on our behalf.
- Hosting: Our website and order database are hosted on servers located in Norway.
- Business e-mail service: E-mails you send us and order notifications sent to us are stored on the servers of our business e-mail provider.
- Turkish Revenue Administration and, if one is used for e-Arşiv invoicing, a private integrator: to issue and transmit the invoice (KVKK Art. 5(2)(ç)).
- Competent public authorities, courts and consumer arbitration committees: in response to legal requests and in disputes (KVKK Art. 5(2)(ç) and (e)).
Transfers abroad: Transfers to Mailgun and to servers outside Türkiye are transfers abroad under Article 9 of the KVKK. As the Personal Data Protection Board has not issued an adequacy decision for these countries, the transfers are based on the processing conditions in KVKK Art. 5(2)(c) and (f) and are made under the standard contract announced by the Board, in accordance with KVKK Art. 9(4)(c). The standard contract is notified to the Personal Data Protection Authority within five working days of signature.
6. Retention periods
| Record | Period |
|---|---|
| Order data underlying invoices and accounting records | 10 years from the calendar year following the relevant year (Turkish Commercial Code No. 6102, Art. 82; 5 years under Tax Procedure Law No. 213, Art. 253) |
| Records of preliminary information, acceptance of the agreement, payment and delivery (incl. IP address and time of acceptance) | At least 3 years (Distance Contracts Regulation, Art. 20); 10 years where they underlie an invoice |
| Complaint and support correspondence | For the applicable limitation periods after the request is closed |
When the retention period ends, personal data is erased, destroyed or anonymised in accordance with Article 7 of the KVKK and the related regulation.
7. Your rights under Article 11 of the KVKK
By applying to the data controller, you have the right to:
- learn whether your personal data is processed,
- request information about the processing if it is,
- learn the purpose of the processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom your personal data is transferred,
- request correction of incomplete or inaccurate data,
- request erasure or destruction of your personal data under the conditions in Article 7 of the KVKK,
- request that third parties to whom your data was transferred be notified of any correction, erasure or destruction,
- object to a result against you arising from analysis of your data exclusively by automated systems (for example, a payment declined by the payment institution's automated fraud check),
- claim compensation if you suffer damage because of unlawful processing of your personal data.
8. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, applications must be made in Turkish and can be sent:
- in writing with a wet signature to Headquarters: Verta Mali Danışmanlık ve Denetim A.Ş. Şehit Adem Yavuz Sokak 8/15 06420 Kızılay/ANKARA, Türkiye Telephone: +90 553 144 06 56,
- to nkuyanik@yahoo.com.tr, signed with your secure electronic signature or mobile signature,
- to nkuyanik@yahoo.com.tr from an e-mail address you have previously given us and that is registered in our system (for example the address used for your order).
Your application must state your name and surname, your signature if in writing, your Turkish identity number (for foreigners: nationality and passport number or identity number, if any), your residential or business address for notifications, your e-mail address and telephone number if any, and the subject of your request.
We will respond as soon as possible depending on the nature of the request and within thirty days at the latest, free of charge. If the request involves an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board. If your application is rejected, you find the answer insufficient or no answer is given in time, you may file a complaint with the Personal Data Protection Board within thirty days of learning of the answer and in any case within sixty days of your application, under Article 14 of the KVKK.