Draft — requires lawyer review. This notice covers tappon's own users and website visitors. For visitor data that users collect on their bio pages, the user is the controller (see 05 Data Processing Agreement). Placeholders are shared with the Turkish version.
Part 1 — Privacy Notice (KVKK)
Prepared under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Obligation to Inform. Where the EU GDPR applies to you, this notice also serves as the information required by Articles 13–14 GDPR.
1. Controller
WebWorks 101 OÜ · Sepapaja tn 6, 15551 Tallinn, Estonia · Estonian Commercial Register code: 14816432 · Email: [email protected] VERBIS registration: [VERBİS: number / exemption status]
2. What we process, why, and on what legal basis
| Category | Examples | Purpose | Legal basis (KVKK Art. 5(2)) |
|---|---|---|---|
| Identity | Name, username | Opening the account and providing the Service | (c) conclusion/performance of contract |
| Contact | Email, phone (if given) | Account, security and service notices; support | (c) contract; (f) legitimate interest |
| Customer transaction | Plan (tappon Pro monthly/yearly), trial start/end dates and whether the trial has been used, subscription period, on-hold status, orders, support messages | Managing the subscription and trial, giving the trial only once per person, refunds, support | (c) contract; (f) legitimate interest for preventing repeat trials |
| Finance | Billing name/company, billing address, national ID or tax no where required, amount and status of payments (not card numbers) | Invoicing, accounting, tax duties | (ç) legal obligation; (c) contract |
| Transaction security | IP address, date-time, device/browser type, country/city for logins and content actions; session cookies | Account security, abuse prevention; keeping traffic data under Law No. 5651 | (a) expressly provided by law; (ç) legal obligation; (f) legitimate interest |
| Visual / content | Profile photo, bio page content | Publishing your bio page (public by your choice) | (c) contract; (d) made public by you |
| Verification (blue tick) | ID document image (sensitive fields masked), business documents, domain / social account checks | Assessing your verification request | (c) conclusion of contract (you apply) |
| Marketing | Consent preferences, clicks on campaign emails | Campaign and product news | Explicit consent and consent under Law No. 6563 |
| Legal | Complaints, appeals, official correspondence | Resolving disputes, answering authorities | (e) establishing, exercising or defending a right; (ç) legal obligation |
Special categories: we do not ask for special-category data (e.g. religion, blood type, health). Please mask these fields on ID documents uploaded for verification; if an unmasked document arrives we delete it without review and ask you to upload again.
No email open tracking. We use no invisible tracking pixels; only clicks on links in emails may be counted.
3. How we collect data
Electronically: from what you enter in sign-up, payment, support and verification forms; from logs created automatically on our servers when you use the Service; and through strictly necessary cookies (see the Cookie Policy). If you sign in with a social account, we receive only your name, email and profile ID from that provider. [KULLANILIYORSA: social login providers]
4. Website and bio page visitors
- We do not use Google Analytics, ad pixels or similar third-party trackers on tappon.bio. Fonts and weather data are served from our own server; your IP address is not sent to Google or any other third party for these purposes.
- Bio page statistics do not store visitor IP addresses. Country/city is derived on the fly from a local database on our server; the IP address is not saved.
- To filter fake and automated traffic, a keyed hash of the IP address is kept in cache for at most 10 minutes and then deleted automatically, based on our legitimate interest (security of the Service and accurate statistics).
- For data collected through forms on a bio page, and for tracking codes added by the page owner, the page owner is the controller; see their privacy notice.
5. Recipients
| Recipient | Purpose |
|---|---|
| Hosting provider: Contabo GmbH, servers in Germany | Technical operation of the Service |
| Payment institution: Stripe (Stripe Payments Europe, Ltd., Ireland) | Collecting tappon Pro subscription payments |
| Invoicing: Stripe | Issuing invoices |
| Email delivery: our own mail server (Contabo GmbH, Germany) | Delivering account and service emails |
| Backups: [YEDEK KONUMU] (encrypted) | Disaster recovery |
| Accountant, legal adviser | Legal duties, disputes |
| Competent public authorities and courts | Legal requests |
| Message Management System (İYS) | Recording consent to commercial messages (if you opt in) |
We do not sell your data or share it with third parties for advertising.
6. International transfers
Our servers are in Germany, so your data is transferred abroad. This transfer relies on the standard contract signed with the hosting provider under KVKK Article 9, notified to the Turkish Personal Data Protection Authority within 5 business days of signature. [DOLDURULACAK: notification date] The same safeguard applies to any other sub-processor located abroad (e.g. payment or email provider). [DOLDURULACAK: list] For EU residents, processing in Germany takes place inside the EU.
7. Retention
| Data | Period |
|---|---|
| Account data | Until the account is deleted; then within [SÜRE: 30] days from live systems and [YEDEK SAKLAMA SÜRESİ] from backups |
| Invoices and accounting records | 10 years (Tax Procedure Law, Turkish Commercial Code) |
| Traffic data under Law No. 5651 | Statutory period [AVUKAT TEYİT: 1 year] |
| Support messages | [SÜRE: e.g. 2 years] |
| Verification documents | Up to 30 days after the request is decided |
| Consent/opt-out records for commercial messages | 3 years after the consent ends |
| Spam-filter IP hash | Up to 10 minutes |
8. Your rights (KVKK Art. 11; GDPR Arts. 15–22 where applicable)
You may ask whether your data is processed; request information; learn the purpose and whether it is used accordingly; know the recipients; request correction, deletion or destruction and notification of these to recipients; object to an adverse outcome of solely automated analysis; and claim compensation for unlawful processing. Where GDPR applies you also have the rights to data portability, restriction and objection, and to complain to your local supervisory authority.
Send requests to [email protected] from the email registered with us, or in writing to Sepapaja tn 6, 15551 Tallinn, Estonia. We answer free of charge within 30 days. You can do most things (correction, export, deletion) yourself in the dashboard.
Part 2 — Explicit Consent and Opt-in Texts
Each text below is a separate checkbox, never pre-ticked, and none is a condition of using the Service. You can use tappon fully, free or paid, without them. Withdraw any time under "Account > Notification preferences" or via the link in any message.
A. Commercial electronic messages (Law No. 6563 / İYS)
☐ I want to receive tappon campaign, new feature and event news by email. ☐ I want to receive the same news by SMS. [KULLANILIYORSA]
Note (under the box): your consent is recorded in the Message Management System (İYS). Opt out free with one click in every message; opt-outs are processed within 3 business days. Service messages (account, security, invoices, changes to terms) do not depend on this consent.
B. Explicit consent to processing for marketing (KVKK)
☐ I give explicit consent to the use of my name, email, plan and in-app usage preferences (such as which blocks I use) to choose news and suggestions relevant to me.
Note: without this consent, news (if you opted in under A) is the same for everyone. Data is processed only within tappon and not passed to third-party ad networks. Withdraw any time; withdrawal does not affect earlier processing.
C. Explicit consent to being featured as an example
☐ I give explicit consent to tappon showing a screenshot of my public bio page, with my username and profile photo, as an example on the tappon.bio home page, the examples section and tappon's social media accounts.
Note: when you withdraw, the image is removed from our site within 7 days and not used in new posts; earlier social posts are removed on request.
Consents not used (for information)
- International transfer: the main transfer relies on the KVKK Article 9 standard contract, so no separate explicit consent is requested.
- Blue tick: verification relies on the conclusion of a contract; no explicit consent is requested.