KVKK / GDPR Notice

Data Controller

This notice has been prepared by Liber Teknoloji (liber.tr) as data controller, pursuant to Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to provide you with information about the processing of your personal data.

Categories of Personal Data Processed

Identity: First name, last name
Contact: E-mail, phone, address
Customer Transaction: Order details, invoice contents, license records
Financial: Payment confirmation data (card numbers are not stored)
Transaction Security: IP address, session data, hashed password
Professional: Company name, tax number (corporate accounts)

Purposes of Processing Personal Data

Creating memberships and accounts
Accepting orders, collecting payments, and delivering digital products/licenses
Managing processes related to the conclusion and performance of contracts
Fulfilling invoicing and accounting obligations
Managing customer service and technical support processes
Providing information to authorised public authorities when required by law
Conducting information security processes

Legal Bases for Processing Personal Data

Order and contract management → Directly related to the conclusion or performance of a contract (KVKK Art. 5/2-c)
Invoicing and accounting → Fulfilling a legal obligation (KVKK Art. 5/2-ç)
Security and fraud prevention → Legitimate interest (KVKK Art. 5/2-f)
Marketing communications → Explicit consent (KVKK Art. 5/1) — only where consent has been given

Recipients to Whom Personal Data May Be Transferred

iyzico: For conducting payment transactions
Hosting and infrastructure providers: Under confidentiality agreements
Authorised public authorities: Upon lawful request
Financial advisor / accounting firm: For invoicing and tax processes

Retention Periods

Account and order records: Duration of active account + 10 years (Turkish Commercial Code)
E-invoices and financial records: 10 years (Tax Procedure Law)
Session data: 30 days
System access logs: 90 days
Support correspondence: 3 years

Your Rights as a Data Subject (KVKK Article 11)

By applying to the data controller, you may exercise the following rights:

To learn whether your personal data is being processed
To request information about processed data
To learn the purpose of processing and whether data is used in accordance with that purpose
To know the third parties to whom data is transferred domestically or abroad
To request correction of incomplete or inaccurate data
To request deletion or destruction of data under the conditions prescribed by KVKK
To request that correction/deletion be notified to third parties to whom data was transferred
To object to a result reached exclusively by automated systems that is unfavourable to you
To claim compensation for damage caused by unlawful processing

How to Apply

To exercise your rights, send an e-mail to [email protected] with the subject line "KVKK Application". Requests are answered free of charge within 30 days after identity verification.