Personal Data Protection Notice
This text is issued for Demo Tahsilat A.Ş.. The version published on the Portal as of 2026-11-01 applies and must be read before payment is confirmed.
1. Data controller
Under Turkish Law No. 6698 on the Protection of Personal Data (KVKK), Article 10, and the Communique on the Procedures and Principles for Fulfilment of the Disclosure Obligation, the data controller is the business identified below. This notice is presented on the Portal when data is collected from the data subject. Disclosure is separate from consent and is not conditioned on a tick-box. Trade name: Demo Tahsilat A.Ş.. Workplace address: —. Tax office: —. Tax identification number: —. Phone: 0212 000 00 00. Email: destek@demo.mytahsilat.test. Requests and complaints: destek@demo.mytahsilat.test · 0212 000 00 00. Unless a representative is separately announced, applications are made directly to the controller.
2. Personal data processed
Identity: first and last name. Contact: phone, email, city, country and any address entered on the form. Customer transaction: title, tax details if declared, payment description, debt or invoice reference, amount, currency, instalment choice, time, transaction number and status. Transaction security: IP address, session data and 3D Secure result. Finance: only the last four digits of the card. The full card number, CVV and password are not processed or stored by the controller; they remain with the bank or virtual POS. Special-category data (health, biometrics, religion, trade-union membership and similar) is not requested or processed.
3. Purposes
Purposes are limited to this online collection activity, specific and legitimate: collecting a debt, due or service fee; allocating the payment to the correct account or debt; sending a receipt and notification; accounting and statutory retention; preventing fraud, duplicate charges and unauthorised card use; answering requests and complaints; displaying instalment and exchange-rate information. Data is not used for marketing, profiling or an unrelated purpose. If the purpose changes, a new notice is given before the new processing. Vague or open-ended purposes are not used.
4. Legal bases
The legal basis is stated separately from the purpose and falls under KVKK Article 5(2): necessity for the establishment or performance of the collection contract; a legal obligation arising from tax, commercial-book and limitation-period rules; establishment, exercise or protection of a right (refund, chargeback and dispute); and legitimate interest that does not override the data subject’s fundamental rights (payment security and abuse prevention). Where these conditions exist, separate consent is not required. Consent is requested only for a distinct purpose that lacks another legal basis, freely and apart from this notice.
5. Collection method
Data is collected wholly or partly by automatic means, in an electronic environment: the guest payment form, a member or dealer account, a payment link, a debt recorded by the Provider on the Portal, and the result message returned by the bank or virtual POS. Data is as a rule obtained from the data subject or a person the subject has authorised. Where a debt comes from the ledger, this notice is available at the first contact or before the first transfer.
6. Transfers
Data may be transferred, only for the stated purpose, to these recipient groups: the bank and virtual POS provider executing the payment; hosting and backup services; the email or SMS provider if notifications are configured; lawyers, accountants and auditors in a dispute; courts, enforcement offices, tax offices and other competent public authorities. The purpose is to complete collection, retain the record, deliver a notice or meet a legal duty. Transfer abroad occurs only if KVKK Article 9 conditions are met and only for that purpose. Collection records are primarily kept in Türkiye.
7. Retention and destruction
Accounting and tax records are kept for the periods required by the Tax Procedure Law and related legislation. Dispute, refund and chargeback records are kept for the limitation period and until the dispute ends. Support correspondence is kept for a reasonable time after the request is closed. Data is then deleted, destroyed or anonymised. Retention is proportionate to the purpose and stops when the purpose ends.
8. Security
Under KVKK Article 12, technical and organisational measures are applied against unlawful processing, unauthorised access and loss. The payment page is served over HTTPS. Staff access is limited by role and need. Card data is sent to a PCI DSS compliant POS channel. The controller does not store the full card number in its own database. Measures are updated in line with risk.
9. Rights of the data subject
Under KVKK Article 11 the data subject may apply to the controller to: learn whether personal data is processed; request information if it is; learn the purpose and whether processing is in line with that purpose; know the third parties to whom data is transferred in Türkiye or abroad; request correction if data is incomplete or inaccurate; request deletion or destruction under Article 7; request that correction or deletion be notified to transferees; object to a result against the subject arising solely from automated analysis; and claim compensation if harmed by unlawful processing.
10. How to apply
Applications are sent to destek@demo.mytahsilat.test · 0212 000 00 00 in line with the Communique on Application Procedures to the Data Controller, in writing or by a method that verifies identity, including registered electronic mail. The application states name, title if any, service address, email or phone, and the request. The controller concludes the request within thirty days. If the operation has an extra cost, the fee in the Board tariff may be charged. If the answer is insufficient, refused or not given in time, a complaint may be filed with the Personal Data Protection Board.
11. Effectiveness
This notice is effective as of 2026-11-01. The version published on the Portal applies to later transactions. It is a disclosure for this collection activity, not a general privacy policy covering unrelated processing.