Privacy Notice

1. Who is responsible

The data controller is , (). Contact for privacy matters: . [VERBİS registration number, if the company is required to register: to be completed.]

2. What we process, why, and on what basis

• Account and company profile (name, username, email, password stored only as a hash, company details, logo, certificates you list). To create and run your account and show your company to other members. Basis: performance of the contract (KVKK Art. 5/2-c).
• Content you create (projects, techpacks, images, messages, offers and order history). To provide the service and to let you work with the companies you choose. Basis: performance of the contract.
• Membership and billing (plan, invoices, payment status, card brand, last four digits and expiry). To bill you and issue receipts. Full card details go to the payment provider and are not stored by us. Basis: contract and legal obligation (Art. 5/2-ç, tax and accounting law).
• Security and technical data (IP address, browser, sign-in sessions, logs). To keep accounts and the service secure and to prevent abuse. Basis: legitimate interest (Art. 5/2-f) and legal obligation.
• Records of your consents (what you accepted, which version of the text, when, from which IP address). To be able to show that you agreed. Basis: legitimate interest and legal obligation.
• Marketing emails, only if you opt in. Basis: your explicit consent (Art. 5/1), which you can withdraw at any time.
• Analytics cookies, only if you accept them (see the Cookie notice). Basis: your explicit consent.

We do not process special categories of personal data on purpose; please do not put them into messages or profiles. We do not make decisions about you by automated means alone.

3. Who sees your data

• Other members. Your company profile is visible to other members. Projects, offers and messages are visible to the members you share them with.
• Service providers who process data for us: hosting and database provider [name, country]; email delivery (Mailgun); payment provider for memberships [iyzico, Türkiye, once enabled]; error and log tools [if any].
• Authorities when the law requires it.
• Buyers or investors in a sale of the business, under confidentiality, if that ever happens; you would be told.

We do not sell personal data.

4. Transfers abroad

Some providers above are located or store data outside Türkiye. We transfer personal data abroad only as KVKK Article 9 allows (adequacy decision, standard contractual clauses notified to the Personal Data Protection Authority, or another permitted safeguard). [Safeguard used for each provider: to be completed with counsel.]

5. How long we keep it

• Account and content: while your account is open. When you delete your account we remove or anonymise your personal data; trade records that involve another company stay in anonymised form so that the other company keeps its own history.
• Invoices and payment records: for the period the tax and commercial law requires (currently up to 10 years in Türkiye), then deleted.
• Consent records: for as long as needed to show consent, plus the limitation period.
• Security logs: [retention period to be set, for example 12 months].

6. Your rights

Under KVKK Article 11 you may ask us to:

• tell you whether we process your personal data and give you information about it;
• tell you why we process it and whether it is used for that purpose;
• tell you which third parties, in Türkiye or abroad, receive it;
• correct data that is incomplete or wrong;
• delete or destroy your data when the reasons for processing no longer exist, and tell the third parties we passed it to;
• object to a result against you that comes from analysing your data only by automated means;
• claim compensation if you suffer loss because of unlawful processing.

You can download your data and delete your account yourself in Account → Privacy and data, and withdraw marketing consent there. For anything else, write to ; we answer within 30 days. You may also complain to the Personal Data Protection Board (kvkk.gov.tr). If you are in the European Economic Area or the United Kingdom you have the corresponding rights under the GDPR.

7. Security

Passwords are stored as hashes, connections are encrypted, access to data is limited to the people who need it, and we log and review security-relevant events. No system is perfectly secure; if a breach affects you we will notify you and the Authority as the law requires.

8. Children

Textilevisor is for businesses and is not meant for anyone under 18.

9. Changes

If we change this notice in a way that matters, we will tell you in the app or by email. The version at the top shows which text applies.