KVKK Data Protection Notice

1. Data controller

Under the Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by [Company legal name] ([Address]; MERSİS: [MERSİS number]) ("Poki") as data controller, within the scope described below. This notice is prepared under Article 10 of the KVKK and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

2. Categories of personal data processed

• Identity: first name, last name.
• Contact: e-mail address, phone number (optional), business address (for invoicing).
• Customer transactions: subscription plan, credit transactions, order and invoice details, support requests.
• Transaction security: IP address, session and access logs, device and app version, password hash, connected-account access tokens (encrypted).
• Marketing and content: business and brand information, uploaded product photos and videos, generated content, performance metrics of connected social media and ad accounts, incoming messages if the DM assistant is enabled.
• Visual and audio records: personal data contained in the images, videos and audio files you upload (e.g. photos of people), voices chosen for voice-over.
• Finance: amount, date and reference of payment transactions (card details are not stored by Poki).

3. Purposes

• Managing membership and account processes, authentication.
• Providing the Service: brand analysis, content planning, AI content generation, social media publishing, ad management, reporting.
• Running subscription, payment, invoicing and accounting processes.
• Information security processes, error detection, abuse prevention.
• Handling user requests and complaints, communication activities.
• Measuring service quality and product development (with anonymised, aggregated data).
• Informing authorised persons, institutions and organisations; fulfilling legal obligations.
• With your explicit consent: sending commercial electronic messages.

4. Legal bases

Your personal data is processed on the following legal bases in Articles 5 and 6 of the KVKK:

• Processing being necessary for the establishment or performance of a contract to which you are a party (art. 5/2-c).
• Processing being necessary for the data controller to comply with a legal obligation (art. 5/2-ç).
• Processing being necessary for the legitimate interests of the data controller, provided it does not harm your fundamental rights and freedoms (art. 5/2-f).
• Processing being necessary for the establishment, exercise or protection of a right (art. 5/2-e).
• Explicit consent (art. 5/1): for transfers abroad, commercial electronic messages and other processing not covered by the bases above.

5. Transfers of personal data

Limited to the purposes above and in line with Articles 8 and 9 of the KVKK, your personal data may be transferred to the following recipient groups:

• In Türkiye: hosting and infrastructure providers [provider name], accounting and legal advisers, authorised public institutions and organisations.
• Abroad: AI providers (OpenAI, Google Gemini, Higgsfield, ElevenLabs — USA), social media and advertising platforms (Meta Platforms, Google), payment and store services (Stripe, Apple, Google Play), error monitoring (Sentry) and any hosting/storage providers located outside Türkiye.

Transfers abroad are carried out under Article 9 of the KVKK on the basis of your explicit consent or of the safeguards set by the Personal Data Protection Board (countries with an adequacy decision, a standard contract notified to the Board, an undertaking or binding corporate rules). AI content generation and social media integrations require transfers abroad because these providers are located outside Türkiye; your explicit consent to the relevant transfer is obtained before you start using these features.

6. Collection method

Your personal data is collected by partly automated and automated means through the forms in the mobile app and web panel, the files you upload, your interactions within the app, the APIs of the social media and ad accounts you connect, transaction notifications from payment and store providers, error monitoring tools and your correspondence with us.

7. Retention period

Your personal data is kept for the period required by the processing purpose and by the limitation and retention periods set in applicable legislation; at the end of that period it is deleted, destroyed or anonymised. When you delete your account, your data is deleted within 30 days, except for records subject to statutory retention (e.g. invoices — 10 years); removal from backups is completed within a further 14 days at most. Detailed periods are given in the Privacy Policy.

8. Your rights under Article 11 of the KVKK

As a data subject, by applying to Poki you have the right to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether the data is used in line with it,
• know the third parties to whom it is transferred, in Türkiye or abroad,
• request correction if it is incomplete or inaccurate,
• request erasure or destruction under the conditions in Article 7 of the KVKK,
• request that correction, erasure and destruction be notified to third parties who received the data,
• object to a result to your detriment produced exclusively by automated analysis,
• claim compensation for damage caused by unlawful processing.

9. How to apply

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests with documents proving your identity: in writing to [Address], to our registered electronic mail (KEP) address [KEP address], with a secure or mobile electronic signature, or from the e-mail address registered in our system to [Privacy / data-protection e-mail].

Your request is answered free of charge as soon as possible and within 30 days at the latest, depending on its nature. If the operation involves an additional cost, the fee in the tariff set by the Board may be charged. If your request is rejected, you find the answer insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board.