Privacy Notice (KVKK)

1. Identity of the data controller

• Trade name / brand: TestDaş (testdas.com)
• Contact: [email protected]
• Web: https://testdas.com

Legal entity name, MERSİS number, and registered address will be published in this section when updated. You may submit requests via the email above.

2. Categories of personal data processed

• Identity / contact: name and surname (if declared for payment or support), username, email, profile image
• Account / transaction security: session information, password (hash), OAuth identifiers, IP address, User-Agent
• Customer transaction: app listings, test participation, day progress, credit balance and movements, listing rights
• Visual / content: daily test proof screenshots; text / match results produced via OCR; feedback text
• Financial: order amount, payment status, payment institution transaction references (card data remains at the payment institution)
• Marketing / communication (if any): informational email preferences

3. Purposes of processing personal data

• Establishing and performing the membership contract; authentication; account management
• Providing closed-test matching; quota and duration tracking
• Reviewing daily proofs; preventing fraud, multi-account abuse, and misuse
• In-platform credit and listing-right accounting
• Executing payments; invoice / accounting / retention obligations
• Running notification, reminder, and support processes
• Information security processes; managing legal disputes; responding to competent authority requests
• Measuring service quality and product development (as anonymous / aggregate statistics where possible)

4. Legal grounds (KVKK Arts. 5 and 6)

Your personal data may be processed based on the following conditions listed in Article 5 of the KVKK:

• Establishment or performance of a contract (Art. 5/2-c): membership, test participation, listing, credit transactions
• Legal obligation of the data controller (Art. 5/2-ç): financial records, retention, official notifications
• Legitimate interest (Art. 5/2-f): information security, fraud / abuse prevention, service continuity — provided your fundamental rights and freedoms are not harmed
• Explicit consent (Art. 5/1): cases requiring consent (e.g. certain marketing communications or non-essential cross-border transfers) — without consent, the relevant processing is not performed

We do not aim to process special categories of personal data. Health or similar data that accidentally appears in proof images should not be processed; users should not upload such data. If detected, deletion / rejection may apply.

5. Collection method

Data is collected electronically via web interface forms, account creation and OAuth sign-in, file upload, automatic logging, payment provider callbacks, and support channels.

6. Transfers — domestic / abroad

6.1. Domestic

• Payment institutions (e.g. Iyzico), email processors, hosting / BaaS providers’ units in Türkiye
• Legally authorized public bodies; judicial / administrative authorities in disputes
• Other users on the Platform — only information necessary and limited for performance of the service (e.g. app listing fields)

6.2. Abroad

Servers of Supabase, email, or similar cloud services may be abroad. In that case, under KVKK Art. 9, transfer to countries with adequate protection, appropriate safeguards (contractual commitments, etc.), and explicit consent mechanisms where required are evaluated.

7. Retention and destruction

Personal data is kept for the period required by the processing purpose and statutory limitation / retention periods. At the end of the period, data is deleted, destroyed, or anonymized in accordance with the KVKK and relevant regulations.

• Membership and transaction records: contract term plus dispute periods
• Payment / accounting: minimum periods under financial legislation
• Proof files and security logs: reasonable period for review and abuse prevention

8. Data security

The Data Controller takes appropriate technical and administrative measures under KVKK Art. 12 to prevent unlawful processing and access and to ensure safekeeping (access authorization, encrypted transmission, role-based management, backups, subprocessor agreements, etc.).

9. Data subject rights (KVKK Art. 11)

By applying, you have the following rights:

1. Learn whether personal data is processed
2. Request information if it has been processed
3. Learn the purpose of processing and whether it is used in line with that purpose
4. Know third parties to whom data is transferred domestically or abroad
5. Request correction if processed incompletely or inaccurately
6. Request deletion / destruction under KVKK Art. 7
7. Request that third parties to whom data was transferred be notified of correction / deletion
8. Object to a result against you arising solely from automated analysis
9. Request compensation for damage arising from unlawful processing

You may send applications to [email protected] with information sufficient to verify your identity. Applications are concluded within the periods set in the KVKK and relevant communiqué. No fee is charged where a free response is required; if the process entails separate cost, tariffs in the communiqué may apply.

If your application is rejected, the response is insufficient, or no timely response is given, you may complain to the Personal Data Protection Authority (kvkk.gov.tr).

10. Updates

This privacy notice may be updated as processing activities change. The current version is published on this page; the “Last updated” date applies.