KVKK Privacy Notice (Personal Data Protection Disclosure)

1. Data Controller

Your personal data is processed by DomainQ ("DomainQ", the "Company", or "we") in its capacity as data controller in accordance with the KVKK and the relevant legislation.

The identifying information relating to the data controller (trade name, MERSIS/tax number, full address, KEP (registered electronic mail) address), together with any VERBİS (Data Controllers' Registry) registration and information regarding the appointed contact person, are set out in the Company's official records and in the relevant sections of the website. You may submit any application within the scope of this notice to the Company through the channels specified in Sections 9 and 10.

The disclosure obligation is a unilateral notification and is not subject to the consent or signature of the data subject. For processing operations requiring explicit consent, your consent is requested separately by means of a document distinct from and independent of this notice.

2. Categories of Personal Data Processed

Depending on the nature of the service provided and the scope of the relationship established with you, DomainQ may process the following categories of personal data:

(a) Identity Information: full name, Turkish Republic ID number or tax identification number, trade name, and the registrant identity information required by the registry/TRABİS in connection with domain name registration.

(b) Contact Information: e-mail address, telephone/mobile number, invoicing and notification address, and the contact data contained in domain name records (WHOIS/RDAP).

(c) Customer/Transaction Information: customer account and panel username, service/order records, contract and request history, and support (ticket) correspondence.

(ç) Financial Information: invoicing information, payment amount, payment method, and the transaction/authorization references returned from the payment institution. Your card data is not stored on DomainQ servers; payment transactions are carried out through the infrastructure of authorized payment/banking institutions.

(d) Transaction Security and Log Information: IP address, date-time stamp, session and access records, and the traffic records that must be kept under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications.

(e) Marketing/Consent Information: solely subject to your explicit consent, commercial electronic message preferences, İYS (Message Management System) records, and data relating to your cookie preferences.

As a matter of principle, DomainQ does not process special categories of personal data (health, religion, biometric data, etc.) unless required by the nature of the service. In exceptional cases where special categories of data may appear in a document such as a copy of an identity document, the additional processing conditions set out in Article 6 of the KVKK are complied with.

3. Purposes of Processing Personal Data

Your personal data is processed for the purposes specifically set out below, within specific, explicit, and legitimate limits:

(a) Receiving your domain name registration, renewal, transfer, and management applications, transmitting them to the relevant registry, registrar, and TRABİS/nic.tr systems, and finalizing them.

(b) Setting up, providing, and maintaining server, hosting, e-mail, and related electronic services, and creating and managing the customer account/panel.

(c) Establishing and performing the contract, conducting order and service processes, and providing technical support and responding to customer requests.

(ç) Conducting invoicing, collection, and accounting processes, and fulfilling financial and legal obligations.

(d) Ensuring information security and system/network security, preventing fraud and misuse, and maintaining service continuity and capacity planning.

(e) Keeping log/traffic records as required by the relevant legislation and responding to the lawful requests of authorized public institutions and organizations.

(f) Retaining transaction records as evidence in dispute and litigation processes for the purpose of establishing, exercising, or protecting a right.

(g) Only where your explicit consent exists: sending commercial electronic messages/e-newsletters, campaign announcements, and cookie-based marketing activities.

Your data is not processed for purposes other than those set out in this notice, nor for vague, general, or indeterminate purposes that may arise in the future.

4. Legal Grounds for Processing

Each of the above purposes is carried out on the basis of one or more of the processing conditions set out in Articles 5 and 6 of the KVKK:

(a) Necessity for the establishment or performance of a contract (Art. 5/2-c): domain name registration/renewal, provision of hosting and e-mail services, creation of the account/panel, responding to technical support requests, and the invoicing-related parts directly connected with the contract (purposes 3(a), 3(b), 3(c), and 3(ç)).

(b) Being expressly provided for by law (Art. 5/2-a): cases where specific legislation directly mandates data processing, and certain obligations relating to registration and identity verification.

(c) Necessity for the data controller to fulfill its legal obligation (Art. 5/2-ç): issuance and retention of invoices/e-invoices (Tax Procedure Law), keeping of accounting records, retention of log/traffic records under Law No. 5651, keeping of records as required by TRABİS/registry legislation, and responding to the lawful requests of authorized public institutions (purposes 3(ç) and 3(e)).

(ç) Necessity for the establishment, exercise, or protection of a right (Art. 5/2-e): retention of contract and transaction records as evidence in the event of a dispute or litigation, and the pursuit of receivables (purpose 3(f)).

(d) Legitimate interest of the data controller (Art. 5/2-f): provided that no harm is caused to your fundamental rights and freedoms and taking into account the balance of interests (balancing test): ensuring system/network security, preventing fraud/misuse, enhancing the quality and continuity of the service, and basic statistics and capacity planning (purpose 3(d)).

(e) Explicit consent (Art. 5/1): commercial electronic message/e-newsletter marketing and cookie-based behavioral advertising activities (purpose 3(g)). Furthermore, pursuant to Article 9, transfers abroad in exceptional cases where no appropriate safeguard mechanism or adequacy decision exists may also be based on your explicit consent. These processing operations cannot be based on the ground of contract performance or legitimate interest; you may withdraw your explicit consent at any time.

In the event of a change in the purpose of personal data processing, the disclosure obligation is fulfilled separately prior to the relevant processing activity.

5. Method of Collecting Personal Data

Your personal data is collected through the website and online application/order forms, the customer panel, e-mail, the support (ticket) system, the call center/telephone, and other verbal, written, or electronic communication channels.

The data is obtained by fully or partially automated means (e.g., completion of an online form, panel transactions, generation of log records by the system) or by non-automated means provided that it forms part of a data recording system (e.g., written documents/applications).

Owing to the nature of the service, part of your data may be obtained directly from you, and part may be obtained from process parties such as payment institutions, the registry/TRABİS, or the persons on whose behalf you act. Where the data is not obtained from you, the disclosure obligation is fulfilled within a reasonable period, at the moment of first communication where the data is used for the first time to communicate with you, or at the latest at the moment of first transfer.

6. Transfer of Personal Data (Domestic and International)

Your personal data may be transferred to the following recipient groups, limited to the fulfillment of the purposes set out above and in accordance with the conditions in Articles 8 and 9 of the KVKK:

(a) Domestic Transfers: (i) registry/registrar organizations and TRABİS/nic.tr for the purpose of domain name registration; (ii) authorized payment institutions and banks for the purpose of collection; (iii) data processors providing infrastructure for the provision of the service (data center, cloud, e-mail/SMS providers); (iv) advisors such as lawyers and financial consultants within the scope of legal and financial obligations; (v) authorized public institutions and organizations making lawful requests as required by the relevant legislation (e.g., BTK (Information and Communication Technologies Authority), courts, public prosecutor's office). Each transfer is limited solely to the relevant transfer purpose.

(b) International Transfers: Your personal data may be transferred abroad in the event of international domain name registrations made through a foreign registry or the use of cloud/CDN/e-mail service providers located abroad. Such transfers are carried out, in accordance with the regime of Article 9 of the KVKK as amended by Law No. 7499: primarily where an adequacy decision announced by the Board exists; in the absence thereof, where appropriate safeguards such as standard contracts, binding corporate rules, or undertakings are provided; or where the incidental exceptions listed in Article 9/6 exist. In exceptional cases where such safeguards cannot be provided, the transfer may only be carried out on the basis of your explicit consent.

We inform you that, within the scope of WHOIS/RDAP records, registrant data may be transmitted to the relevant registration organizations in accordance with ICANN policies and registry requirements, and that such transfers constitute a mandatory element of the domain name registration service.

For detailed information on the technical and administrative measures relating to data security and on the general principles regarding transfers, you may refer to the DomainQ Privacy and Personal Data Protection Policy.

7. Retention Periods of Personal Data

Your personal data is retained for the period necessary for the purpose for which it is processed, taking into account the minimum/maximum periods prescribed in the relevant legislation.

(a) Data relating to the contract and the customer relationship is retained throughout the duration of the service relationship and, following its termination, for the applicable general statute of limitations periods.

(b) Invoice, accounting, and tax records are retained for the periods prescribed under the Tax Procedure Law and the Turkish Commercial Code (as a rule, 5 and 10 years).

(c) Traffic/log records within the scope of Law No. 5651 are kept for the periods prescribed in the relevant legislation.

(ç) Commercial message/marketing data based on explicit consent is retained until your consent is withdrawn; in the event of withdrawal of consent, the relevant processing is ceased immediately.

Upon the expiry of the retention period or the disappearance of the purpose of processing, your personal data is deleted, destroyed, or anonymized in accordance with DomainQ's Personal Data Retention and Destruction Policy.

8. Rights of the Data Subject (Article 11 of the KVKK)

Pursuant to Article 11 of the KVKK, by applying to DomainQ as the data controller, you have the following rights:

(a) to learn whether your personal data is being processed,

(b) to request information if your personal data has been processed,

(c) to learn the purpose of processing your personal data and whether it is used in accordance with its purpose,

(ç) to know the third parties, whether domestic or abroad, to whom your personal data is transferred,

(d) to request the rectification of your personal data if it has been processed incompletely or inaccurately,

(e) to request the erasure or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK,

(f) to request that the operations carried out pursuant to subparagraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred,

(g) to object to the emergence of a result to your detriment through the analysis of the processed data exclusively by automated systems,

(ğ) to request the remedy of the damage in the event that you suffer damage due to the unlawful processing of your personal data.

9. Exercising Your Rights and Application Method

You may submit your requests relating to the rights listed above to DomainQ in accordance with the procedures prescribed in the Communiqué on the Procedures and Principles of Application to the Data Controller, together with information verifying your identity.

You may submit your application by e-mail from your e-mail address registered in our system to [email protected], to DomainQ's KEP (registered electronic mail) address using a secure electronic signature/mobile signature, or in writing to the Company's address suitable for service, either in person or through a notary public. Where an application form is provided on our website, you may also use that form.

Your application is concluded free of charge as soon as possible and in any event within thirty (30) days at the latest, depending on the nature of the request. Where the operation additionally requires a cost, the fee set out in the tariff determined by the Board may be charged.

In the event that your application is rejected, that you find the response given insufficient, or that no response is provided within the prescribed period, you have the right to lodge a complaint with the Personal Data Protection Board within thirty (30) days from the date you learn of the response and, in any event, within sixty (60) days from the date of the application.

10. Contact

For your questions within the scope of this Privacy Notice and your requests relating to your personal data, you may contact DomainQ via the e-mail address [email protected] or through the official communication channels specified on the website.

For more detailed information on data security measures, cookie practices, retention and destruction principles, and marketing processes contingent upon explicit consent, you may review the DomainQ Privacy and Personal Data Protection Policy, the Cookie Privacy Notice, and the Commercial Electronic Message Explicit Consent Text, which complement this notice.

DomainQ reserves the right to make changes to this Privacy Notice in line with amendments to the legislation and updates to its service processes; the current text is always published on the website.