Legal
KVKK Privacy Notice (Aydınlatma Metni)
Version 1
Draft under legal review. The approved text will replace this page, and the date above will change with it.
This is the English text of the notice (aydınlatma metni) required by Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. In case of any difference between this text and the Turkish version, the Turkish version prevails.
1. Data controller
The data controller is Partnerfy.co ("Partnerfy"), the developer and operator of the Kambloo platform, with registered address Partnerfy Bilgi Teknolojileri ve Pazarlama Sanayi Ticaret Ltd. Şti., Orta Mah. Kavaklar Cad. No:15 Ofisada Plaza D:104, Adapazarı, Sakarya, Türkiye and registration number MERSIS 0722116506400001, trade registry no. 43130 (Adapazarı), tax no. 7221165064.
Data protection contact: [email protected].
2. Our role, and the role of store owners
Partnerfy acts in two different capacities.
As data controller for the personal data of people who use kambloo.com, create a Kambloo account, operate a store, purchase from the App Market, or contact us. This notice covers that processing.
As data processor for the personal data of people who shop in a store built on Kambloo. For that data, the store owner is the data controller and determines the purposes and means of processing. Partnerfy processes it only on the store owner's documented instructions under a Data Processing Agreement. Shoppers should read the notice published by the store they buy from and direct requests to that store.
3. Categories of personal data we process
| Category | Examples |
|---|---|
| Identity | Name, surname |
| Contact | Email address, billing address, phone number if provided |
| Account and security | Hashed password, two-factor authentication secrets (encrypted), sign-in provider identifiers, session records, failed login attempts |
| Store and domain | Store name and address, custom domain names, DNS verification records, plan and settings |
| Financial | Hosting plan, invoices, tax identification number, payment references from payment providers, card brand and last four digits (never the full card number) |
| App Market | Orders, activation codes (hashed), licenses, refunds |
| Consent and agreement | Versions of terms, agreements, and consents accepted, with date and IP address |
| Transaction and usage | Server logs, IP address, user agent, rate-limit counters, per-store resource meters, audit logs of account actions |
| Communication | Contact form messages, support correspondence, abuse reports |
We do not process special categories of personal data under Article 6 of KVKK, and we ask you not to send us such data.
4. Purposes of processing
We process personal data for the following purposes:
- Creating and managing your account and verifying your identity.
- Creating, hosting, and operating your store, including connecting custom domains and issuing certificates.
- Delivering platform updates and security patches.
- Billing, invoicing, and collecting hosting fees.
- Selling, activating, and supporting App Market products.
- Sending transactional communications about your account, store, billing, and security.
- Sending marketing communications, only with your explicit consent.
- Ensuring the security of the platform, preventing fraud and abuse, and enforcing the terms of service.
- Keeping audit and consent records required by law or needed to demonstrate compliance.
- Responding to your requests and complaints.
- Fulfilling legal obligations and handling legal disputes.
- Measuring site traffic with aggregate, cookieless analytics.
5. Legal bases
Personal data is processed on the legal bases in Article 5 of KVKK, as follows:
| Legal basis (Article 5) | Purposes above |
|---|---|
| Processing is necessary for the establishment or performance of a contract to which you are a party (Art. 5/2-c) | 1, 2, 3, 4, 5, 6 |
| Processing is necessary for the data controller to comply with a legal obligation (Art. 5/2-ç) | 4, 9, 11 |
| Processing is necessary for the establishment, exercise, or protection of a right (Art. 5/2-e) | 9, 11 |
| Processing is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms (Art. 5/2-f) | 8, 10, 12 |
| Explicit consent (Art. 5/1) | 7, and transfers abroad where no other mechanism in Article 9 applies |
You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
6. Method of collection
Personal data is collected through electronic means: the registration and account forms on kambloo.com, the store admin panel, the go-live wizard, the App Market checkout, the contact form, email correspondence, sign-in providers you choose to use, server and application logs generated automatically when you use the service, and payment providers that return transaction references to us.
7. Transfer of personal data
7.1 Domestic transfers (Article 8)
Personal data may be transferred within Türkiye to payment providers (iyzico, PayTR), to legal, tax, and accounting advisers, and to competent public authorities when required by law, on the legal bases in Article 5.
7.2 Transfers abroad (Article 9)
Some of our service providers process data outside Türkiye:
- Cloudflare: content delivery, DNS, TLS certificates, edge security, object storage for media and backups, form protection.
- Stripe: card payments and subscription billing.
- Email delivery provider: transactional and, with consent, marketing email.
Transfers abroad are made under the conditions in Article 9 of KVKK, using one of the mechanisms provided there: an adequacy decision of the Personal Data Protection Board where one exists, a standard contract notified to the Board, binding corporate rules, or a written undertaking approved by the Board. Where none of these applies, we ask for your explicit consent. The current list of recipients abroad is published as an annex to the Data Processing Agreement.
8. Retention
We retain personal data for the period necessary for the purposes above and for the periods required by law:
- Account, store, and domain data: for the life of the account, then deleted or anonymized after a 30-day cooling period following a deletion request.
- Store databases and media: as above; backup copies age out within 14 days (daily) and 3 months (weekly).
- Invoices and financial records: for the periods required by the Tax Procedure Law and the Turkish Commercial Code, up to 10 years.
- Consent and agreement records: for as long as necessary to demonstrate consent; anonymized on account deletion.
- Audit logs: 2 years at platform level, 400 days at store level, then archived.
- Communications: for as long as necessary to handle the matter.
When the retention period ends, data is deleted, destroyed, or anonymized in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.
9. Your rights under Article 11
Under Article 11 of KVKK, you have the right to:
a) learn whether your personal data is being processed; b) request information if it has been processed; c) learn the purpose of processing and whether the data is used in accordance with that purpose; ç) know the third parties, in Türkiye or abroad, to whom your personal data has been transferred; d) request correction of incomplete or inaccurate data; e) request deletion or destruction of your personal data under the conditions in Article 7; f) request that corrections, deletions, or destructions under (d) and (e) be notified to third parties to whom the data has been transferred; g) object to a result that is against you arising from analysis of your data exclusively by automated systems; ğ) claim compensation for damage arising from unlawful processing of your personal data.
10. How to exercise your rights
You may submit a request under Article 13 of KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller by any of the following methods:
- in writing, delivered in person or by notary, to Partnerfy Bilgi Teknolojileri ve Pazarlama Sanayi Ticaret Ltd. Şti., Orta Mah. Kavaklar Cad. No:15 Ofisada Plaza D:104, Adapazarı, Sakarya, Türkiye;
- by email from the email address registered on your Kambloo account to [email protected];
- through registered electronic mail (KEP), secure electronic signature, or mobile signature where available.
Your request must include your name and surname, signature if in writing, Turkish identity number or, for foreign nationals, passport number, residence or workplace address for reply, email address, telephone number if available, and the subject of the request. We may ask for additional information to verify your identity.
We respond as soon as possible and in any case within 30 days of receipt, free of charge. If responding involves a cost, we may charge the fee set by the Personal Data Protection Board. If we reject a request, we explain the reason in writing or electronically.
If your request is rejected, if you find our response insufficient, or if we do not respond within the period, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning our response and in any case within 60 days of the date of your request.
Account holders can also export their data and start deletion directly from account settings, as described in the Privacy Policy.
11. Cookies
By default, kambloo.com uses only strictly necessary cookies and cookieless analytics, so no consent is requested for cookies. If cookies requiring consent are introduced, they load only after explicit consent through a banner with equal accept and reject options. Details are in the Cookie Policy at kambloo.com/legal/cookies.
12. Changes
This notice is versioned. The current version is published at kambloo.com/legal/kvkk with its effective date. Material changes are notified to account holders by email.
13. Contact
Partnerfy.co (Kambloo) Partnerfy Bilgi Teknolojileri ve Pazarlama Sanayi Ticaret Ltd. Şti., Orta Mah. Kavaklar Cad. No:15 Ofisada Plaza D:104, Adapazarı, Sakarya, Türkiye Registration number: MERSIS 0722116506400001, trade registry no. 43130 (Adapazarı), tax no. 7221165064 Data protection contact: [email protected]