Privacy Policy and KVKK Disclosure Statement

Your personal data is processed by Stokzone Teknoloji Limited Şirketi ("Stokzone", the "Company", "we"), in its capacity as data controller, within the scope explained below.

• Legal title: Stokzone Teknoloji Limited Şirketi
• Address: Esentepe Mah. Büyükdere Cad. Levent 199 No: 199 İç Kapı No: 6, Şişli / İstanbul
• Tax office / no: Zincirlikuyu / 7811172592
• Trade registry no: 1158703
• Trade registry office: İstanbul Ticaret Sicili Müdürlüğü
• MERSİS: 0781117259200001
• Phone: 0850 840 15 46
• E-mail: [email protected]
• Web: stokzone.com / app.stokzone.com

Depending on how you use our services, the following categories of personal data may be processed:

• Account and identity information: name and surname, e-mail address and other information you provide when creating an account.
• Billing and subscription information: your subscription plan, billing details and transaction records relating to payment.
• Usage and log data: technical records generated while you use the service (IP address, session information, transaction and error logs).
• Integration credentials you connect: API keys, usernames, passwords and similar access information belonging to your marketplace, e-commerce, shipping and accounting accounts.

In order for the service to function, we need to store the API credentials (key, username, password, etc.) belonging to the marketplace, e-commerce, shipping and accounting platforms you connect.

These access credentials are stored in encrypted form and are used solely for the purpose of running the relevant integration. Such information remains yours; you may stop its use at any time by removing the relevant integration.

Your personal data is processed for the following purposes:

• Creating your account, verifying your identity and providing your access to the service.
• Setting up and running marketplace, e-commerce, shipping and accounting integrations.
• Carrying out order, stock, price, return and invoicing operations.
• Managing subscription and billing processes.
• Responding to your support requests and communicating with you.
• Ensuring the security of the service, detecting errors and misuse, and fulfilling obligations arising from the applicable legislation.

Your personal data is processed on the basis of the legal grounds set out in Articles 5 and 6 of the KVKK. The principal grounds are: being directly related to the conclusion or performance of a contract, enabling our Company to fulfil its legal obligations, the establishment, exercise or protection of a right, and being necessary for the legitimate interests of our Company provided that it does not harm the data subject's fundamental rights and freedoms. Where required, your explicit consent is obtained.

Your personal data is retained for the period necessary for the purpose for which it is processed, taking into account the statute of limitations and retention periods stipulated in the relevant legislation. When the purpose of processing ceases to exist and the statutory retention periods expire, your data is deleted, destroyed or anonymized.

Your personal data may be transferred, to the extent and for the purpose of providing the service, to our service providers that carry out services such as hosting/infrastructure, e-mail delivery and payment. Such transfers are limited solely to the scope required by the relevant service.

Some of the infrastructure and service providers we use in order to provide the service are located abroad. Accordingly, your personal data may be transferred abroad, limited to the purposes stated above and in accordance with the conditions set out in Article 9 of the KVKK.

In addition, where requested by authorized public institutions and organizations pursuant to the applicable legislation, your data may be shared with the relevant authorities within the framework of our legal obligations. Your data is not sold to third parties for purposes other than those stated in this statement.

The Stokzone Shopify app connects your store to your Stokzone account. Once connected, the fields Shopify classifies as "protected customer data" are processed solely to run your order operations.

• Fields processed: recipient name, shipping/billing address, phone, e-mail.
• Purpose: creating shipping labels and shipments, issuing invoices, managing returns/cancellations, order notifications.
• This data is never sold to third parties and is not used for advertising, profiling or AI model training.
• Deletion requests: customer data deletion requests received through Shopify are honoured; identifying fields are anonymised. Invoices and financial records are retained where legally required.
• When the app is uninstalled, upon Shopify's notification the personal fields of that store are anonymised and stored access tokens are deleted.

Appropriate technical and administrative measures are taken to prevent the unlawful processing of and unauthorized access to your personal data and to ensure its safekeeping. The integration access credentials you connect are stored in encrypted form.

Subscription payments are taken on the contracted payment institution's own secure page. You do not enter your card number or security code (CVV) into Stokzone screens; that information never reaches Stokzone systems and is not stored by us.

If you choose to save your card for future use, Stokzone keeps only the storage key (token) issued by the payment institution together with limited details that let you recognise the card: card brand, the first digits of the card number (BIN), its last four digits, the expiry month/year and the name on the card. The full card number and the security code are NOT included.

For this processing the payment institution acts as a separate data controller and applies its own privacy notice.

All traffic between your browser and Stokzone domains is encrypted with TLS (HTTPS). Unencrypted (HTTP) requests are redirected to the encrypted connection.

Certificates are obtained from a public certificate authority (Let's Encrypt) and renewed automatically.

Pursuant to Article 11 of the KVKK, by applying to the data controller you have the following rights:

• To learn whether your personal data is being processed.
• To request information if it has been processed.
• To learn the purpose of processing and whether the data is used in accordance with that purpose.
• To know the third parties, within the country or abroad, to whom the data is transferred.
• To request rectification if it has been processed incompletely or inaccurately.
• To request its erasure or destruction within the framework of the conditions set out in the legislation.
• To request that rectification, erasure and destruction operations be notified to the third parties to whom the data has been transferred.
• To object to a result arising against you as a consequence of the data being analyzed exclusively through automated systems.
• To request the remedy of any damage you suffer due to unlawful processing.

You may submit your requests regarding the above rights to us by sending an e-mail to [email protected]. Your applications are concluded within the periods stipulated in the KVKK and the relevant legislation.