Effective: 16 June 2026 · Updated: 18 September 2026 · Version 1.1
1. Data Controller
BulutveBulut Information Technologies — Gökalp İSPİRLİ (sole proprietorship, Bursa, Türkiye) acts as the Data Controller within the meaning of Regulation (EU) 2016/679 (GDPR).
2. Lawful Basis
- Performance of contract (Art. 6(1)(b))
- Legal obligation (Art. 6(1)(c))
- Legitimate interests (Art. 6(1)(f)) — fraud prevention, security
- Consent (Art. 6(1)(a)) — marketing communications
3. Your Rights (Articles 15-22)
- Right to access
- Right to rectification
- Right to erasure ("right to be forgotten")
- Right to restrict processing
- Right to data portability
- Right to object
- Right not to be subject to solely automated decision-making
4. Data Transfers
Personal data is stored in Türkiye datacenters. Where transfers outside the EEA occur (e.g., for support tools), they are protected by Standard Contractual Clauses (SCCs) or other approved mechanisms.
5. Retention
Customer account data: retained while the account is active and up to 10 years for legal/tax compliance. Marketing data: until consent is withdrawn.
6. Cookies & Tracking
See our Cookie Policy for category-based consent options.
7. Supervisory Authority
EU residents may lodge complaints with their local Data Protection Authority. Turkish residents: KVKK (Personal Data Protection Authority).
8. Contact / DPO
Email: dpo@bulutvebulut.com · privacy@bulutvebulut.com
This is the MVP version. The final notice will be reviewed by EU-qualified privacy counsel before becoming binding.