Personal Data Protection Privacy Notice (KVKK)

Data Controller: FaStart Teknoloji A.S. Address: Hacıhalil Mah. 1219. Sk. Nalbur İş Hanı No:8/305 Gebze/Kocaeli, Turkiye. MERSIS No: 0385215794800001. Contact: privacy@fastart.co. FaStart is a technology company providing SaaS e-commerce platform services via www.fastart.co and myfastart.co domains.

This Privacy Notice applies to Sellers who register on the FaStart platform, Buyers (consumers) who shop from Sellers' stores, and all natural persons who visit www.fastart.co and myfastart.co domains.

The following categories of personal data are processed by FaStart:

Identity Data

• First name, last name
• Turkish national ID number or tax identification number (VKN)
• Trade name (for corporate sellers)

Contact Data

• Email address
• Phone number
• Physical address (including delivery and billing addresses)

Financial Data

• Credit card information (for subscription and commission collection from sellers' registered cards)
• Bank account details (where required)

Store Data

• Trade name and tax information
• Store name, logo and domain
• Product data (title, description, price, images, inventory)

Transaction Data

• Order history and order details
• Sales amounts and commission calculations
• Subscription plan information and payment history
• Refund and cancellation records

Technical Data

• IP address
• Browser type and version
• Cookie data
• Session logs and access timestamps
• Device information (operating system, screen resolution)

Marketing Data

• Email communication preferences (opt-in/opt-out)
• Campaign interactions (open and click rates)
• SMS marketing permissions

• Providing platform services, provisioning and maintaining store infrastructure
• Collecting subscription fees and commission charges from sellers
• Creating, managing and authenticating seller and buyer accounts
• Managing order processes and coordinating delivery
• Fulfilling legal obligations under Law No. 6563, Tax Procedure Law, Turkish Commercial Code and other applicable legislation
• Communicating with users: support requests, notifications, service updates
• Ensuring platform security, fraud detection and prevention
• Analytics and reporting: measuring platform performance, improving service quality
• Marketing communications (email, SMS campaigns) where explicit consent is given

Your personal data is processed based on the following legal grounds set out in Article 5 of KVKK:

• Performance of contract: Providing platform services, managing store accounts, collecting subscriptions and commissions
• Legal obligation: Record-keeping and reporting obligations under Tax Procedure Law, Turkish Commercial Code, Law No. 6563 and related legislation
• Legitimate interest: Platform security, fraud prevention, service improvement and analytics
• Explicit consent: Marketing communications, campaign notifications and personalized content

Your personal data may be transferred to the following recipient groups:

• POS providers (iyzico, etc.): To process payment transactions via the payment institution connected by the seller
• Shipping and logistics companies (Navlungo, etc.): To ensure order delivery
• Infrastructure service providers: Hosting, CDN, email delivery and cloud infrastructure services
• Analytics and monitoring tools: To measure platform performance
• Legal authorities: To competent public institutions, courts and enforcement offices where legally required
• Tax and accounting advisors: To fulfill legal obligations

Your personal data is retained for the duration required by the processing purpose and within the framework of legal retention obligations:

• Financial data (invoices, payment records): 10 years per Tax Procedure Law
• Transaction data (orders, sales, commission records): 10 years per Turkish Commercial Code
• Contract and membership data: During the contract and the subsequent statute of limitations period (10 years)
• Marketing data: Until explicit consent is withdrawn
• Technical data (logs, cookies, session data): 2 years
• Communication records (support requests): 3 years
• Pre-sales contact form leads: 12 months from submission

FaStart takes the necessary technical and organizational measures pursuant to Article 12 of KVKK to protect your personal data:

• Data transmission security with SSL/TLS encryption
• Database encryption and access control mechanisms
• Regular security tests and vulnerability scans
• Access authorization and role-based controls
• Personal data processing inventory and data classification
• Employee awareness training and confidentiality commitments
• Data breach notification procedures to the Data Protection Board and data subjects

You have the following rights under Article 11 of KVKK:

• Learn whether your personal data is processed
• Request information about processing if your data has been processed
• Learn the purpose of processing and whether data is used in accordance with its purpose
• Know the third parties to whom your personal data is transferred domestically or abroad
• Request correction of incomplete or inaccurate personal data
• Request deletion or destruction of personal data under the conditions set out in Article 7 of KVKK
• Request notification of correction, deletion and destruction to third parties to whom data has been transferred
• Object to outcomes arising exclusively from automated analysis of processed data

To exercise the rights listed above, you may apply to FaStart pursuant to Article 13 of KVKK via one of the following methods: written application (in person or via notary with a wet-signed petition) or via the email address registered in the FaStart system to privacy@fastart.co.

• Data Controller: FaStart Teknoloji A.S. — MERSIS No: 0385215794800001
• Address: Hacıhalil Mah. 1219. Sk. Nalbur İş Hanı No:8/305 Gebze/Kocaeli, Turkiye
• Email: privacy@fastart.co
• Applications will be concluded free of charge as soon as possible and no later than 30 (thirty) days depending on their nature. If the process requires additional costs, fees may be charged according to the tariff set by the Data Protection Board.

For detailed information about cookies used on the FaStart website and store fronts, please refer to our separately published Cookie Policy.

This Privacy Notice became effective on 10.06.2026. FaStart reserves the right to update this notice in accordance with changes in applicable legislation, decisions of the Data Protection Board, or changes in data processing activities.

For questions about the processing of your personal data, please contact privacy@fastart.co.