KVKK

1. Identity of the Data Controller

The operator of Postid and data controller under KVKK is:

• Name: Codian Limited
• UK Company Number: 16333262
• Registered address: Suite 8791, 5 Brayford Square, London, United Kingdom, E1 0SG
• Contact: [email protected]

Codian Limited is a private limited company registered in the United Kingdom. Because we offer goods or services to data subjects in Türkiye, we are subject to the provisions of KVKK that apply to data subjects located in Türkiye.

2. Categories of Personal Data Processed

The categories of personal data we process in connection with the Service are:

For a detailed data inventory, see the Privacy Policy, Section 2.

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Creating your Account and verifying your identity.
• Providing the core functionality of the Service, including Workspace, Connected Account, and content management.
• Operating Subscription billing and payment flows.
• Performing our contractual obligations to you.
• Complying with our legal obligations relating to tax, accounting, audit and similar matters.
• Sending transactional notifications such as email verification, password reset, and account-security alerts.
• Securing the Service; detecting, preventing, and responding to abuse, fraud, and security incidents.
• Monitoring, diagnosing, and improving the Service.
• Responding to your requests and complaints.
• Sending marketing communications only with your explicit consent.

4. Legal Bases for Processing

Your personal data is processed on the following legal bases under KVKK Article 5:

• Necessary for the establishment or performance of a contract (KVKK Art. 5/2-c): account creation, providing the Service, Subscription management, transactional communication.
• Expressly provided for by law and necessary to fulfil a legal obligation (KVKK Art. 5/2-a and 5/2-ç): retention of invoices under tax law, responding to lawful requests from authorities.
• Necessary for the establishment, exercise, or protection of a right (KVKK Art. 5/2-e): audit logs, defending against legal claims.
• Necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed (KVKK Art. 5/2-f): Service security, abuse prevention, operating and improving the Service.
• Explicit consent (KVKK Art. 5/1): marketing communications, optional data sharing outside the scope of the Service.

5. Transfers of Personal Data

5.1 Domestic transfers

Your personal data may be shared within Türkiye in accordance with the conditions in KVKK Article 8 with:

• Competent public authorities (for the fulfilment of legal obligations).
• Legal advisors, tax advisors, and auditors (to the extent necessary).

5.2 International transfers

Because Codian Limited is based in the United Kingdom and some of our infrastructure providers are located outside the UK or the EU, your personal data may be shared with the following international recipients, based on your explicit consent or other applicable legal grounds under KVKK Article 9:

International transfers are protected by safeguards in our agreements with recipients, including the Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.

For the detailed sub-processor list and safeguards, see the Privacy Policy, Sections 4-5.

6. How We Collect Personal Data

We collect personal data through:

• Directly from you: information you provide during registration, profile updates, Workspace configuration, content uploads, and contact forms.
• From third-party platforms: information we receive via OAuth from Connected Accounts (Meta Graph API).
• Automatically while you use the Service: cookies, IP address, user agent, audit log and activity log entries.
• From payment service providers (such as Stripe): customer identity information once a payment flow is completed.

7. Your Rights Under KVKK Article 11

Under Article 11 of KVKK, by applying to the data controller you may exercise the following rights:

a) Learn whether your personal data is being processed. b) Request information about the processing of your personal data. c) Learn the purpose of processing and whether the data is used in accordance with that purpose. ç) Learn the third parties (domestic or international) to whom personal data has been transferred. d) Request correction of personal data that has been processed incompletely or inaccurately. e) Request erasure or destruction of personal data within the framework of the conditions in KVKK Article 7. f) Request that actions taken under (d) and (e) be notified to the third parties to whom the personal data was transferred. g) Object to a result that is to your detriment, where it arises solely from the analysis of processed data by automated means. ğ) Claim compensation for damages incurred due to unlawful processing of personal data.

8. How to Apply

In accordance with KVKK Article 13(1) and the Communiqué on the Procedures and Principles for Application to the Data Controller, you may submit your application:

• By email: to [email protected] from the email address registered in our system, together with information that verifies your identity.
• By post: addressed to Codian Limited, Suite 8791, 5 Brayford Square, London, United Kingdom, E1 0SG.

Your application must include:

• Your name and surname; if the application is in writing, your signature.
• For Turkish citizens, your TC ID number; for foreign nationals, your nationality, passport number, or other identification number.
• An address for service (residence or business).
• An email address, telephone, and fax number for notifications, if any.
• The subject of the request.

We will respond within 30 days. If your application is accepted, the response will be provided to you free of charge. If processing the request entails additional costs, the fee defined by the Turkish Data Protection Authority's tariff may be charged.

If your application is rejected, the response is found inadequate, or no response is provided within the time limit, you may file a complaint with the Personal Data Protection Board (KVK Kurulu) within 30 days of learning the response, and in any case within 60 days of the application date.

9. Retention Periods

Personal data is retained in line with KVKK Article 7 and applicable retention legislation only for as long as necessary for the purposes for which it is processed. For category-by-category retention periods, see the Privacy Policy, Section 7.

When the retention period expires, the data is deleted or irreversibly anonymised.

10. Data Security

The technical and organisational measures we take to protect your personal data under KVKK Article 12 are described in the Privacy Policy, Section 9.

Under KVKK Article 12(5), if your personal data is unlawfully obtained by others, we will notify the affected data subjects and the Personal Data Protection Board (KVK Kurulu) as soon as possible.

11. Changes to This Notice

We may update this Notice from time to time. Material changes will be notified by email or by an in-Service notice at least 30 days before they take effect.

The current version of the Notice is always available at https://postid.app/legal/kvkk.