Personal Data Protection Privacy Notice (KVKK)

Data Controller for FaStart-owned processing: FaStart Teknoloji A.Ş. Registered office: Cumhuriyet Mah. Şişecam Yolu Sk. Ar-Ge G3 No: 28, Gebze/Kocaeli, Türkiye. Privacy contact: privacy@fastart.co.

This notice has two layers: (1) the public marketing site, which includes waitlist, contact and partnership processing; and (2) FaStart platform processing, which applies only to the corresponding activated production service and must be supplemented by merchant-facing and transaction-specific notices. For merchant-controlled shopper data, the merchant may be the controller and FaStart may be the processor; see the Data Processing Addendum and Subprocessor Register.

The first-layer disclosures below are presented next to the relevant form. The required checkbox records that the notice was read; it is not explicit consent. Optional marketing permission is collected separately.

The current marketing code evidences the first layer below. The Backend schema and provider DTO review identifies the conditional platform categories; those categories apply only when the relevant service is activated and the person supplies the data:

Identity Data

• First and last name submitted through contact and partnership forms
• Conditional platform account, merchant, shopper, recipient, reviewer, support and moderation identity records
• A Turkish national identity number or other identity number may be sent to an enabled payment provider when its verified flow requires it; the current marketing endpoints do not collect it
• Company name may be submitted in a partnership application or store setup; its role depends on the activated flow

Contact Data

• Email address submitted to the waitlist, contact or partnership form
• Optional phone number submitted to a contact or partnership form
• Conditional account, shopper, recipient, billing, shipping, support and provider contact data
• Delivery and billing addresses, postal codes, districts and location details in an activated checkout, order, return or fulfillment flow; the verified marketing endpoints do not collect them

Financial Data

• No credit-card information is collected by the verified marketing endpoints
• Conditional order, tax, discount, shipping, payment, refund, commission and billing references and amounts
• If Iyzico is enabled, the provider-bound request can contain card details and buyer identity/contact/address/IP data; FaStart's identified payment schema stores protected provider tokens and last-four metadata, not full PAN or CVC columns
• No bank-account information, statement data or live subscription charge is represented in the verified marketing endpoints; financial records supplied for company administration are not part of this public notice

Store Data

• Optional store name and use-case text submitted to the waitlist
• Company, business type and experience submitted in a partnership application
• Conditional organization, store, domain, theme, catalog, product, price, inventory, media and publication data
• No production store domain, product, price, image or inventory data is processed by the verified marketing endpoints alone

Transaction Data

• Contact or partnership request status and consent record
• Waitlist submission time and whether an email has already joined
• Conditional cart, checkout, order, fulfillment, return, cancellation, refund, review, support, report and dispute records
• The current marketing endpoints do not process a production order, sale, commission, subscription, payment, refund or cancellation record

Technical Data

• NEXT_LOCALE language preference and signed guest_session_id waitlist cookie
• Request metadata necessarily received by the marketing APIs and used for bounded request handling
• Conditional account/session metadata such as session identifiers, IP address, user-agent, device information, authentication times, expiry and security events
• Conditional media metadata such as file name, type, size, checksum, ownership, tenant/store references and evidence purpose
• No optional analytics metric transfer is enabled by the current marketing build
• Any future analytics, profiling, automated-decision or AI provider requires separate documentation and legal-basis review before activation

Marketing Data

• Consent version and acceptance time recorded for contact and partnership submissions
• Waitlist email and optional store/use-case text submitted by the person
• No email open/click tracking or SMS campaign permission processing is verified in the current marketing endpoints
• Product marketing preferences may exist in an activated profile flow; their purpose, channel and withdrawal method must be documented before use

• Responding to contact messages and partnership applications
• Recording and managing waitlist requests
• Remembering the visitor's language choice
• Operating, protecting and troubleshooting the public marketing endpoints
• Creating and securing accounts, sessions, organizations, stores, memberships and invitations in an activated product flow
• Operating activated cart, checkout, order, return, refund, review, support, media, payment and fulfillment workflows
• Calling enabled identity, payment, shipping and media providers and resolving their operational outcomes
• Measuring marketing-page performance only after a separately documented and consent-gated service is enabled
• Meeting legal obligations and handling data-subject requests
• Sending marketing communications only where a separate valid permission and functioning delivery process exist
• No active Backend generative-AI provider or AI training purpose was verified in this review

Depending on the specific marketing request, processing may rely on the following grounds under Article 5 of KVKK. The applicable ground must be assessed for the actual processing activity:

• Steps requested by the person: responding to a contact or partnership request and recording a waitlist request
• Taking steps to enter into or perform an activated account, merchant or buyer service
• Legal obligation: retaining or disclosing information where applicable law requires it
• Legitimate interest, subject to a balancing assessment: protecting and measuring the public marketing service
• Legitimate interest or performance of the merchant's documented instructions where FaStart acts as a processor; the merchant must determine the appropriate controller ground for shopper data
• Explicit consent or other valid permission where required for marketing communications, optional analytics, special-category processing or other activity; form consent is not blanket consent to future product processing

Marketing data may be disclosed only as necessary for the current processing and subject to the applicable legal basis:

• Hosting, database and infrastructure providers required to operate the marketing forms
• No optional analytics provider is enabled by the current marketing build; any future provider must be documented before activation
• Authorized personnel or service providers handling the submitted contact, waitlist or partnership request
• For an activated product flow, merchant-controlled data may be shared with providers listed conditionally in the Subprocessor Register, including payment, shipping, media and identity providers
• An enabled Iyzico flow may receive buyer identity number, name, email, phone, address, IP, basket and amount data and card details in the provider request; an enabled Navlungo flow may receive shipment contact and address data
• Competent public authorities, courts or enforcement offices where legally required
• Provider country, international-transfer mechanism, onward recipients and safeguards are deployment- and contract-specific and are not inferred from source code

The following periods are evidenced by source/configuration review; they are not a complete production retention schedule:

• Contact and partnership records carry an automated deletion timestamp 12 months after submission
• NEXT_LOCALE has a one-year browser lifetime
• guest_session_id has a 51-day browser lifetime
• The current waitlist database schema does not evidence an automated deletion period; a deletion request may be submitted to privacy@fastart.co and retention governance must be defined before broader use
• Account verification and password-reset codes are configured for 10 minutes; login sessions have a 30-minute idle timeout and 30-day absolute lifetime; terminal login transactions have a configured 24-hour retention before their purge job can remove them
• The account cleanup scheduler and media cleanup jobs are feature-gated and their production activation must be confirmed
• The Backend source does not establish one fixed retention period for profiles, addresses, carts, checkout, orders, returns, reviews, support, media, payment attempts, provider tokens or audit records; legal holds, accounting obligations and merchant instructions may apply
• No optional analytics retention schedule is claimed because that processing is not enabled in the current marketing build
• No financial, order, commission or production-membership retention schedule is claimed without a verified production schedule

The controls verified for the public marketing surface, and the limits of this disclosure, are:

• Marketing responses configure HSTS, X-Content-Type-Options, Referrer-Policy and a restrictive Permissions-Policy
• security.txt publishes security@fastart.tech as the reporting contact; no public PGP key is offered
• The marketing pages do not currently emit a page-level CSP
• Backend source documents tenant/organization scope checks, hashed authentication secrets, secure __Host cookies, protected provider tokens and redacted/allowlisted logging rules
• Payment, media, provider callbacks and related runtime surfaces default to disabled in the reviewed base configuration
• Database encryption, production authentication/session controls, vulnerability scans, merchant role assignment, independent audits and formal certifications are not verified and are not claimed by this notice
• Applicable breach and data-subject obligations remain governed by law; this statement is not evidence of an implemented certification or audit program

You have the following rights under Article 11 of KVKK:

• Learn whether your personal data is processed
• Request information about processing if your data has been processed
• Learn the purpose of processing and whether data is used in accordance with its purpose
• Know the third parties to whom your personal data is transferred domestically or abroad
• Request correction of incomplete or inaccurate personal data
• Request deletion or destruction of personal data under the conditions set out in Article 7 of KVKK
• Request notification of correction, deletion and destruction to third parties to whom data has been transferred
• Object to outcomes arising exclusively from automated analysis of processed data
• Request compensation for damage caused by unlawful processing

To exercise the rights listed above under Article 13 of KVKK, submit a signed written application to the registered office below. An application may also be submitted through a KEP address announced by FaStart, secure/mobile signature, from an email address previously verified in FaStart systems to privacy@fastart.co, or another method allowed by law. An ordinary, previously unverified email may not by itself be sufficient to verify identity.

• Data Controller: FaStart Teknoloji A.Ş.
• Registered office: Cumhuriyet Mah. Şişecam Yolu Sk. Ar-Ge G3 No: 28, Gebze/Kocaeli, Türkiye
• Email: privacy@fastart.co
• Applications will be concluded free of charge as soon as possible and no later than 30 (thirty) days depending on their nature. If the process requires additional costs, fees may be charged according to the tariff set by the Data Protection Board.

For cookies and deployment-dependent measurement in the public marketing application, see the Cookie Policy. For merchant-controlled product processing and provider roles, see the DPA and Subprocessor Register. Product and storefront cookies must be added before activation.

This notice took effect on 11.08.2026. The public-site layer applies to the current deployment. The platform layer applies only to an activated service; transaction-specific roles, providers, transfers, retention and contacts are presented before Seller, Buyer, store, order or payment processing begins.

For questions about the processing of your personal data, please contact privacy@fastart.co.