Privacy & KVKK Information Notice

1. Identity of the Data Controller

The controller of your personal data is the business whose identity details appear below. These details are currently PLACEHOLDER values and will be replaced with the real registration information.

2. Purposes of Processing

• Responding to the requests and questions you send via the contact form and email.
• Scheduling and running the free introductory (demo) call.
• Where you consent, performing analytics to improve the site (analytics cookies).
• Delivering the Services, performing the contractual relationship, and meeting legal obligations.

3. Recipients & Purpose of Transfer

Your personal data may be transferred, on a limited and proportionate basis and only so the Service can be provided, to our infrastructure and service providers (data processors). These providers and the purposes of transfer are named in the “Cross-Border Transfer” and “List of Processors” sections. Your data is not sold to third parties for marketing.

4. Collection Method & Legal Basis (art. 5/6)

Your personal data is collected when you complete the contact form, send an email, book the demo call, and (where you consent) automatically via cookies.

• Being directly related to the conclusion or performance of a contract (request and demo processes) — KVKK art. 5.
• Being necessary for the controller to meet a legal obligation — KVKK art. 5.
• Legitimate interest, provided your fundamental rights and freedoms are not harmed — KVKK art. 5.
• Your explicit consent for non-essential cookies — KVKK art. 5 (consent is taken separately via the cookie banner).

5. Rights of the Data Subject (art. 11)

Under KVKK article 11, you have the following rights:

• To learn whether your personal data is processed and, if so, to request information about it.
• To learn the purpose of processing and whether it is used in line with that purpose.
• To know the third parties, in Turkey or abroad, to whom the data is transferred.
• To request correction of incomplete or inaccurately processed data.
• To request erasure or destruction of the data where the conditions are met.
• To request that corrections, erasure, or destruction be notified to the third parties to whom the data was transferred.
• To object to a result arising against you from analysis solely by automated systems.
• To claim compensation if you suffer damage due to unlawful processing of your data.

6. Retention Period & Plain Language

Your personal data is retained for as long as necessary for the purpose for which it is processed, taking into account the minimum/maximum periods required by the applicable legislation; when the purpose ceases or the legal periods expire, it is deleted, destroyed, or anonymised. The concrete retention periods will be finalised by the founder/lawyer and stated in this section. This notice is written in as clear and plain language as possible.

7. Separation from Consent (Açık Rıza)

This Information Notice is for information only and is not used to obtain consent (açık rıza). The only area where consent is required is non-essential (analytics/marketing) cookies; that consent is taken via a separate cookie banner (see the Cookie Policy). The fact that the information obligation has been met does not mean you have given any consent.

8. Cross-Border Transfer (art. 9) & the Art.9 Mechanism

For the site and Services to work, some of your data may be transferred abroad — in particular to the USA — via the following service providers:

• Cloudflare — hosting / CDN and security infrastructure (USA).
• Calendly — scheduling of the free demo call (USA).
• Brevo — transactional/notification email (USA/EU).
• Microsoft Clarity — consent-gated analytics and session recording (USA).
• Google — gtag / Google Ads conversion measurement, consent-gated (USA).

These cross-border transfers will rely on appropriate safeguards under KVKK article 9 — in particular the signing of a standard contract (standart sözleşme) and notification to the Board within 5 business days. The transfer is not based on bare consent; under the amendment introduced by Law No. 7499, consent covers only incidental transfers. The standard-contract-based article 9 filing is pending founder/lawyer action; it is not claimed to be completed yet.

9. List of Processors & Exercising Your Rights

The main service providers (processors) we rely on to process your personal data, their roles, and their location:

• Cloudflare — hosting/CDN and security — USA.
• Calendly — booking/scheduling — USA.
• Brevo — email delivery — USA/EU.
• Microsoft Clarity — analytics/session recording (with consent) — USA.
• Google — advertising/conversion measurement (with consent) — USA.

To exercise your rights under KVKK article 11, you may contact us at info@xcollective360.com. Your request will be concluded within the period stipulated in the applicable legislation.

10. GDPR / UK-GDPR Notice — Scope

This GDPR / UK-GDPR notice applies, under article 13, in particular to visitors from the United Kingdom (and to the EU only to the extent the targeting test is met). Our primary audience is Turkey; we state this honestly. The items below complement the KVKK disclosures above.

11. Legal Basis per Purpose (art. 6)

• Responding to your requests/questions and scheduling the demo call: pre-contract / performance of a contract (art. 6(1)(b)).
• Site security and basic operation: legitimate interest (art. 6(1)(f)) — security, abuse prevention, and service integrity.
• Analytics and marketing cookies: explicit consent (art. 6(1)(a)) — taken via the cookie banner and withdrawable.
• Compliance with legal obligations: legal obligation (art. 6(1)(c)).

12. Recipients

Your data is shared with the service providers named in the “List of Processors” section above (Cloudflare, Calendly, Brevo, Microsoft Clarity, Google). This section cross-references that list; the provider identifiers are not repeated here.

13. Third-Country Transfer & Safeguards

Your personal data may be transferred to service providers in the USA, as explained above. These transfers will rely on appropriate safeguards — Standard Contractual Clauses (SCCs) or equivalent appropriate safeguards. You may request a copy of the safeguard documents.

14. Retention

Data is retained for as long as necessary for the purpose of processing; it is deleted when the purpose ceases or the legal retention periods expire. Concrete periods will be set by the founder/lawyer (consistent with the KVKK retention section above).

15. Your Rights (incl. Withdraw & Complaint)

• The right of access, rectification, and erasure (to be forgotten).
• The right to restriction of processing and to data portability.
• The right to object to processing (in particular for legitimate-interest processing and direct marketing).
• The right to withdraw consent at any time — withdrawal does not affect the lawfulness of prior processing.
• The right to lodge a complaint with a supervisory authority — for the United Kingdom, the Information Commissioner’s Office (ICO).

To exercise these rights, contact us at info@xcollective360.com. For the United Kingdom, the Data Protection Act 2018 and the UK GDPR apply.

16. Automated Decision-Making

We do not make any decision based solely on automated processing (automated decision-making) that produces legal effects concerning you or similarly significantly affects you.