Personal Data Protection Notice (KVKK)

1. Data controller

This notice has been prepared under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

The data controller is the person who operates the bulcax platform at www.bulcax.com. The data controller's name or trade name and address will be published in this section; until then, you can send all your applications and questions to iletisim@bulcax.com.

2. Personal data processed

You can use bulcax without an account. When you register or use certain features, the following data is processed:

• Identity and contact: your email address and, if you wish, the name shown on reviews (on reviews your name is shortened, for example as "Aylin K.").
• Account security: your password (only an irreversibly encrypted form of it is kept), session information, and records of email verification and password reset links.
• User content: the product reviews and ratings you write, the products you add to your favourites, the reports and notes you send with "Report a problem", and the questions you write in the decision chat.
• Transaction security: your IP address, only to prevent abuse (for example, to limit repeated failed sign-in attempts), never stored as it is but as a digest (hash), for at most 1 day.
• Usage records: records created when you open a product page, make a comparison or are sent to a seller with "See current price", kept for statistics and for affiliate settlement.

3. Purposes of processing and legal bases

Your personal data is processed for the following purposes and on the legal bases listed in KVKK Article 5(2):

• Creating and managing the account, signing in, sending email verification and password reset messages — being directly related to the formation or performance of a contract (Art. 5(2)(c)).
• Providing the review, rating, favourites and problem report features; publishing and moderating reviews — performance of the contract (Art. 5(2)(c)) and the data controller's legitimate interest (Art. 5(2)(f)).
• Keeping the platform secure, preventing abuse and fraud, fixing errors — the data controller's legitimate interest (Art. 5(2)(f)).
• Counting referrals to sellers, settling affiliate commissions, improving the service statistically — the data controller's legitimate interest (Art. 5(2)(f)).
• Fulfilling legal obligations and the requests of authorized bodies (for example, obligations under Law No. 5651) — being expressly provided for by law and legal obligation (Art. 5(2)(a) and Art. 5(2)(ç)).
• Establishing, exercising or protecting a right — Art. 5(2)(e).

4. Method of collection

Data is collected electronically and by automated means, through the forms you fill in and the actions you take when you register, sign in and use the platform. Cookies that the platform needs to work are used; the details are in the Cookie Policy.

5. Transfers

Your personal data is not sold and is not shared with third parties for marketing. Only the data needed to provide the service is transferred to the following service providers, under service contracts and with data security obligations:

• Hosting and application infrastructure: Vercel Inc. (USA; the application servers run in the European Union, in the Frankfurt region; the content delivery network is global).
• Database: Supabase Inc. (your data is stored on servers in the European Union, in the Frankfurt region).
• Email delivery: an email hosting provider established in Türkiye (account verification and password reset messages).
• Images: listing images are stored in the Vercel Blob storage service (they contain no personal data).
• Decision chat: when you use this feature, the questions you write may be sent to an artificial intelligence service provider (Anthropic PBC, USA) to produce an answer. We recommend that you do not write personal information in the chat.
• Authorized public institutions and judicial authorities: only where required by law and to the extent requested.

6. Transfers abroad

Some of the infrastructure providers above are established abroad. These transfers are made under KVKK Article 9 with one of the appropriate safeguards provided for in the Law, above all the standard contracts announced by the Personal Data Protection Board. Where a transfer cannot be based on these safeguards, the occasional transfer cases listed in Article 9(6) apply (for example, where the transfer is necessary to perform the contract made with you).

7. Retention periods

Data is kept for as long as the purpose of processing requires and for the periods set by the relevant legislation; at the end of that period it is erased, destroyed or anonymized. The main periods:

• Account information: as long as your account is open; after the account is closed, for the statutory limitation periods, in case of disputes.
• Session: 12 hours.
• IP address digest (abuse prevention): 1 day.
• Records of emails sent: deleted 30 days after sending.
• Problem reports: until reviewed; 180 days after review.
• Reviews: until you ask for them to be deleted or your account is closed; reviews taken down are kept as long as needed for moderation.

8. Your rights

Under KVKK Article 11, by applying to the data controller you have the right:

• to learn whether your personal data is processed,
• if it is, to request information about it,
• to learn the purpose of the processing and whether the data is used in line with that purpose,
• to know the third parties in Türkiye or abroad to whom it is transferred,
• to ask for it to be corrected if it is incomplete or wrong,
• to ask for it to be erased or destroyed under the conditions in KVKK Article 7,
• to ask for corrections, erasures or destructions to be notified to the third parties the data was transferred to,
• to object to an outcome against you arising from the analysis of the processed data exclusively by automated systems,
• to claim compensation if you suffer damage because of unlawful processing.

9. Applications

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send requests about your rights to iletisim@bulcax.com from the email address registered to your account, with enough information for us to verify your identity (full name, the email address registered to your account, the subject of your request), or send them in writing.

Your application is concluded free of charge as soon as possible according to the nature of the request, and within 30 days at the latest. If the process requires an additional cost, the fee set by the Board may apply. If your application is rejected, the answer is found insufficient or no answer is given in time, you can complain to the Personal Data Protection Board.