Privacy Policy and KVKK Disclosure

1. Scope of this notice

This notice covers the website at bulutegra.com, the forms on it, the blog subscription and the live chat. Order and buyer data processed inside the Bulutegra panel sits in a different legal relationship, described separately in section 8.

Cookies and similar technologies have their own document: Cookie Policy.

The technical measures we apply are described on this page: Security and data protection.

Our company details are published here: Legal notice.

The notice is written to meet the disclosure duty under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and to provide the information required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

2. Two roles: when we are a controller, when we are a processor

On the website we are the controller. When a visitor fills in a form, subscribes to the blog newsletter or opens the live chat, we decide why and how that data is processed. Sections 3 to 7 describe this role.

In the panel we are a processor. For the order records, buyer names and delivery addresses read from a customer's marketplace and ERP accounts, the controller is the customer who passes that data to us. They decide the purpose and the means; we process only under the contract and on their instructions.

This split is not a drafting preference, it is how the business works: the party that enters into the sales contract with the buyer, ships the product and carries the delivery obligation is our customer. If a buyer contacts us directly, we route the request to the relevant customer and support them in answering it.

3. Identity of the controller

For website data, the controller is the company that builds and operates Bulutegra. The current details are below; the full set of corporate identifiers is published here: Legal notice.

Controller established in Türkiye

For data subjects resident in Türkiye, the group company below acts as controller. You may address KVKK requests to that company as well.

4. Personal data we process on the website

Quote, demo, contact, partner and API request forms. These forms process your name, company name, email address, phone number, the topic you selected and the message you wrote. The record is written to a database on our own server, and a notification is sent from our own mail server to the company's own address. The forms use no third-party CAPTCHA or verification service; verification runs on our own server.

Blog subscription. A subscription record holds your email address, the language you chose, the time of sign-up and the page the sign-up came from. The unsubscribe link in every email is generated with a signed token, so leaving the list needs no account and no password.

Visit counter. Our own visit counter does not store your IP address. So that two page views by the same visitor can be counted as one, it derives a one-way hash salted with a secret key that changes every day, and keeps only the first part of it; the hash cannot be turned back into an IP address. Alongside it we record the path of the page, the referring domain (blanked when it is our own), the page language and, if the visitor is a crawler, the crawler's name. No browser details of human visitors are stored.

Live chat. When you press the chat button at the bottom right, the Chatwoot software running on our own server is loaded and what you type reaches us. Until you press that button the software is not loaded and no data is sent. Chat content does not go to a third-party company.

5. Purposes of processing

Form data is processed to evaluate your request, get back to you, prepare a quote and carry out pre-contractual discussions. It is not turned into a marketing list, not sold, and not shared with third parties for advertising.

The blog subscription is used only to send the content you subscribed to. The visit counter, and Google Analytics if you have consented, are used to see which content is useful and to improve the site, never for advertising personalisation. Live chat data is processed to answer your question.

Beyond that, we process personal data to keep the system secure, to prevent abuse and unwanted form submissions, and to meet obligations imposed on us by applicable law.

6. Legal bases

Quote, demo and contact forms: processing is directly related to the conclusion or performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)) and rests on our legitimate interest in assessing the request (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).

Blog subscription and commercial electronic messages: your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)). You can withdraw it with one click from any message, with no reason given; withdrawal does not affect the lawfulness of processing before it.

Analytics cookies (Google Analytics): your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)). No analytics cookie is written unless you press Accept on the cookie banner.

Our own visit counter, security measures and abuse prevention: our legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)). We balance that interest against your rights by never storing an IP address in the counter and by not keeping browser details.

Statutory retention and disclosure duties: processing is necessary for compliance with a legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).

7. Retention

We keep personal data for as long as it is needed for the purpose it was collected for, and until the retention periods set by applicable law expire. Once the period ends or the purpose falls away, the record is deleted or irreversibly anonymised.

In practice: form records are kept for as long as the resulting contractual relationship requires, or, where no contract follows, for as long as we need to keep track of the request history. A blog subscription is kept until you unsubscribe, and afterwards only to the extent needed to make sure the same address is not written to again. Visit counter records are already held in a form that does not identify a person and are cleared out regularly.

If you want the current period we apply to a particular type of data, write to destek@bulutegra.com and we will state it in writing.

8. Customer data in the panel: our role as processor

The data processed in the panel is the order record read from the customer's marketplace and ERP accounts: order number, amount, quantity, product, order status, carrier, and the buyer name and delivery address needed to ship the order. We do not collect this data; it arrives from the customer's own channels and is used only to make the integration work.

As a processor we undertake the following: we process the data only on the customer's instructions and within the contract; we do not use it for our own purposes; we do not use it for marketing; we do not sell it; we do not mix one customer's records with another's. Access inside the panel is limited by the roles you assign to your own users. Access from our side happens only to resolve a support request you have raised, and only to the extent needed.

The sub-processors we rely on are listed in section 9. We inform our customers before adding a new one. When the contract ends we return the data or, as far as statutory retention duties allow, delete it, according to the customer's choice.

Our customer remains responsible for informing its own buyers and for answering their requests. If a buyer contacts us, we route the request to the relevant customer and give them the technical support needed to fulfil it.

9. Transfers: to whom, why and where

We do not sell personal data and we do not share it for advertising. Transfers happen only as far as the service requires. The parties involved are:

Cloudflare — site traffic passes through the Cloudflare network, which is how the site is served and protected against attacks. Google (Google Analytics) — only if you consented on the cookie banner, and only for measurement. Our own mail server — form notifications and blog emails are sent from it; no third-party email service is used. The live chat software runs on our own server, so chat content is not transferred to another company. The site uses no third-party fonts and no external content delivery network.

Beyond that, data may be disclosed to competent public authorities where the law requires it, and to our legal, financial and technical advisers under a duty of confidentiality.

International transfers. Because the providers above may operate servers outside Türkiye, this processing involves a transfer abroad. We carry out such transfers in line with Article 9 of the KVKK and with the transfer rules in Chapter V of the GDPR; for analytics cookies the basis is your explicit consent, and the transfer stops when you withdraw it.

10. Your rights

Article 11 of the KVKK and Articles 15 to 22 of the GDPR give you the rights listed below. You do not need to give a reason for exercising them, and the request is free of charge.

11. How to reach us, and how long we take

Send your request by email to destek@bulutegra.com. State your name, an address we can reply to, and clearly describe what you are asking for. You may also submit the request in writing through the channels listed in the Turkish Communiqué on the Procedures and Principles of Application to the Controller.

We conclude requests as quickly as the nature of the request allows and in any case within thirty days, free of charge. Where the action genuinely creates a cost, we may charge the fee set in the tariff published by the Turkish Personal Data Protection Board.

If we cannot confirm that the person asking is the data subject, we may ask for further information to verify your identity. That step exists so that your data is not handed to someone else.

12. Right to complain

If your request is refused, if you find our answer insufficient or if we do not reply in time, you may lodge a complaint with the Turkish Personal Data Protection Board within thirty days of learning of the answer and in any event within sixty days of your original request.

If you are based in the European Union or the United Kingdom, you may also lodge a complaint with the supervisory authority of your own country. Your right to go to court remains unaffected in every case.

13. Security of the data

We apply technical and organisational measures to prevent unlawful processing of and unlawful access to personal data. The concrete measures we take — connection security, password and session handling, role-based authorisation, backups, how credentials are stored and how we notify security incidents — are described without exaggeration on this page: Security and data protection.

We do not imply measures that are not written there. If you need further detail before signing a contract, we will share it in writing.

14. Children's data

Bulutegra is a service for businesses; neither the website nor the panel is directed at people under eighteen, and we do not knowingly collect personal data from that age group.

If you notice that a child's data has reached us, write to destek@bulutegra.com and we will delete the record without delay.

15. Changes to this notice

We update this notice when the service, the law or the infrastructure we use changes. The effective date and last-updated date at the top of the page tell you which version you are reading.

When a change matters to you — a new transfer or a new purpose, for example — we notify our customers by email before it takes effect. Where processing rests on consent, we ask for your consent again.