GDPR Privacy Notice

Effective: 16 June 2026 · Version 1.0

1. Data Controller

GÖKTÜRK Cloud Systems (corporate entity to be finalized) acts as the Data Controller within the meaning of Regulation (EU) 2016/679 (GDPR).

2. Lawful Basis

• Performance of contract (Art. 6(1)(b))
• Legal obligation (Art. 6(1)(c))
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, security
• Consent (Art. 6(1)(a)) — marketing communications

3. Your Rights (Articles 15-22)

• Right to access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object
• Right not to be subject to solely automated decision-making

4. Data Transfers

Personal data is stored in Türkiye datacenters. Where transfers outside the EEA occur (e.g., for support tools), they are protected by Standard Contractual Clauses (SCCs) or other approved mechanisms.

5. Retention

Customer account data: retained while the account is active and up to 10 years for legal/tax compliance. Marketing data: until consent is withdrawn.

6. Cookies & Tracking

See our Cookie Policy for category-based consent options.

7. Supervisory Authority

EU residents may lodge complaints with their local Data Protection Authority. Turkish residents: KVKK (Personal Data Protection Authority).

8. Contact / DPO

Email: dpo@bulutvebulut.com · privacy@bulutvebulut.com

This is the MVP version. The final notice will be reviewed by EU-qualified privacy counsel before becoming binding.