Personal Data Notice (KVKK)

Last updated: [TO BE COMPLETED: publication date]

This notice tells the people who visit cpleks.com, who buy or use a cpleks licence, and who write to us how their personal data is processed under Turkey’s Personal Data Protection Law No. 6698 (the “Law”). The same processing is described for readers outside Turkey in the Privacy Policy. This notice is published in Turkish and in this English translation; if the two differ, the Turkish text prevails.

1. Data controller

Your personal data is processed by Oyuncaklı Şeyler Turizm Organizasyon Sanayi ve Ticaret Ltd. Şti. (the “Company”, “we”) as data controller.

• Address: Etiler Mah. Evliya Çelebi Cad. Remel Plaza No:23/106, Beşiktaş, İstanbul, Türkiye
• MERSİS number: [mersis — to be supplied]
• Email: tunc@oyuncakliseyler.com
• Registered electronic mail (KEP): [kep — to be supplied]
• Telephone: [phone — to be supplied]
• Website: https://cpleks.com

cpleks licences are sold by Paddle as the seller (see Sales and Delivery Terms). What you give Paddle at checkout — payment details, billing address and the like — Paddle processes on its own behalf, as a separate data controller, under Paddle’s privacy notice. Your card or other payment details never reach us.

2. The personal data we process, why, and on what legal basis

For each processing activity below we state which data we process, for what purpose, on which legal basis in Article 5(2) of the Law, and by what method it is collected. None of our processing relies on your explicit consent, so we do not ask for it. The site uses no analytics, advertising or tracking tools, and your personal data is not processed for marketing.

2.1 Visiting the site

• Data: your IP address, the date and time of the request, the address of the page requested, the server’s response code and size, the page you came from (referrer), the identification your browser sends (user agent) and the response time.
• Purpose: running and securing the site, and investigating errors and attempts at abuse.
• Legal basis: processing is necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms (Article 5(2)(f)).
• Method: written automatically to log files by the web server on every request, including the requests your server makes to the licence service (section 5).
• Retention: web server logs are rotated daily, or sooner if a log grows large, and the oldest is deleted once 14 older logs exist, so a line is kept for about two weeks at most. The site’s application log records events (for example “a licence was bound”) with licence numbers, customer numbers and machine codes, and no IP address. It records no email address either, with one exception: when a message to you cannot be sent, the mail server’s refusal is written to it, and such a refusal usually repeats the recipient’s address. The application log is deleted after at most 8 daily rotations.

When you open the purchase page, or the page for buying another year of updates for a licence you hold, the page has your browser download the script of Paddle’s checkout from Paddle’s address cdn.paddle.com. This happens as soon as the page opens, whether or not you ever open the checkout, and the request gives Paddle your IP address, the identification your browser sends and the fact that the request comes from cpleks.com (sections 3 and 4). The purpose is that the buy and renew buttons can open the checkout; the legal basis is our legitimate interests (Article 5(2)(f)).

2.2 Preventing abuse

• Data: how many requests were made in a period of time: requests for a sign-in link, counted per email address and per IP address; and the activation, release and daily check-in requests your server makes to the licence service, actions on the account page, and submissions of the site’s administration form, each counted per IP address. The address itself is not stored in this record; a keyed digest of it is.
• Purpose: limiting the number of such requests to stop mass guessing and abuse.
• Legal basis: our legitimate interests (Article 5(2)(f)).
• Method: automatically, when the request is made.
• Retention: a counter is no longer used once its time window has passed, and is deleted by a clean-up that runs every day.

2.3 Purchases and renewals

• Data: what Paddle’s signed notifications to us contain and we keep: your Paddle customer number, the transaction and price numbers, the amount and currency paid, the time of payment, and whether a payment was refunded or charged back; the language of the page you bought from. We also read your email address from Paddle’s system, with an access key that can only read.
• Purpose: creating the licence you bought and setting its update period, delivering your licence key, and applying renewals, refunds and chargebacks to the licence.
• Legal basis: processing the personal data of the parties to a contract is necessary for, and directly related to, entering into or performing that contract (Article 5(2)(c)).
• Method: from Paddle, electronically and automatically.
• Retention: as described in 2.4.

2.4 Your licence and your account

• Data: your email address and the language you use the site in; a random customer number we assign, which contains nothing about you; your Paddle customer number; your licence numbers; your licence keys (the key emailed after a purchase is stored encrypted on the site); the date your update period ends; for every server your licence has been bound to, its machine code, the binding and sequence numbers, the activation request your server made (which contains a digest of a secret the server keeps), the keys issued for it and, when the licence was released, the release code the server revealed; the one-time values used by the daily licence check-in and when each check-in was answered; refunds and chargebacks; and the actions we take on a licence at your request or on our own (for example freeing the seat of a server that was lost), with the reason.
• Purpose: binding your licence to your server, moving it, renewing it, or withdrawing it after a refund; deciding which releases your server may receive as updates; showing your licences on your account page; detecting one licence used on more than one server; and being able to rely on these records if there is a dispute.
• Legal basis: necessary for, and directly related to, entering into or performing the contract (Article 5(2)(c)); detecting one licence used on several servers is necessary for our legitimate interests (Article 5(2)(f)); keeping the records is necessary to establish, exercise or defend a right (Article 5(2)(e)).
• Method: from Paddle; from your server when you activate or release your licence and when it makes its daily check-in (section 5); from what you do on your account page. All electronically and automatically.
• Retention: your account is kept while you hold a licence. You can close it yourself on your account page, or ask us to. Closing it deletes your email address from your account and ends every sign-in — sessions and sign-in links — after which nobody can sign in to it; your licences, their records and your Paddle customer number stay, and the licences keep working. The record of the emails sent to you (2.6) keeps the address for the period stated there. [TO BE COMPLETED: whether a closed account’s Paddle customer number is to be deleted once the limitation period for claims under the contract has run, and whether the address in the record of emails sent is to go at closure rather than after its 12 months] The licence records are kept in a ledger that is, by design, only ever added to, so its entries cannot be deleted one by one; it contains no name, email address, postal address or IP address — only the numbers and codes above. Because a licence is perpetual, these records are kept for as long as the licence exists. [TO BE COMPLETED: whether ledger entries of a closed account are to be anonymised after a set period, and how]

2.5 Signing in to your account

• Data: your email address; a digest of the one-time sign-in link sent to you, with its expiry; a digest of your session number, with its expiry; the session cookie; the protection value carried in each form.
• Purpose: letting you sign in without a password, keeping you signed in, and protecting forms against forged requests.
• Legal basis: necessary for, and directly related to, entering into or performing the contract (Article 5(2)(c)).
• Method: from you, through the sign-in form; session details automatically.
• Retention: a sign-in link is valid for 15 minutes and can be used once; only its digest (SHA-256) is stored, and once the link has expired its record is deleted by a clean-up that runs every day. The code in the link comes after a # sign in its address, a part that browsers send to no server, so it does not reach the web server log (2.1). Your browser deletes the session cookie when you close it; a session also ends when you sign out and 30 days after sign-in at the latest. Only the session’s digest is stored: signing out deletes its record at once, and the record of a session that has expired is deleted by the daily clean-up. We store no passwords.

2.6 The emails we send you

• Data: your email address, and for each message its kind, its language, when it was sent and whether it left our server. The content of a message is not recorded.
• Purpose: sending your licence key after a purchase, sign-in links when you ask for them, and notices when your licence is bound to a server or released from one.
• Legal basis: necessary for, and directly related to, entering into or performing the contract (Article 5(2)(c)).
• Method: automatically, when the message is sent.
• Retention: 12 months from when the message was sent, after which a clean-up that runs every day deletes the record. [TO BE COMPLETED: confirm the period]

We send only messages about the licence you bought. We send no newsletters, campaigns or promotional messages.

2.7 What you write to us

• Data: your email address, the content of your message and anything else you include in it.
• Purpose: answering your questions; handling your refund, licence and personal data requests.
• Legal basis: necessary for, and directly related to, performing the contract (Article 5(2)(c)); for personal data requests, necessary for us to meet our legal obligations (Article 5(2)(ç)); for other correspondence, our legitimate interests (Article 5(2)(f)).
• Method: from you, by email, KEP or post.
• Retention: [TO BE COMPLETED: period — our proposal: 2 years after the matter is closed, or until a dispute that needs it is resolved]

2.8 Records of Paddle notifications

For every notification from Paddle we record its number, its type, when it arrived and what became of it; the content of the notification is not written to this record. These records are kept to check that payments reach the right licences, on the basis of our legitimate interests (Article 5(2)(f)). They are kept for 24 months from when the notification arrived, after which a clean-up that runs every day deletes them. [TO BE COMPLETED: confirm the period]

3. Who we transfer your personal data to, and why

• Paddle (the seller and payment service; a separate data controller): when you open the purchase page, or the page for buying another year of updates for a licence you hold, your IP address and the identification your browser sends, as your browser downloads Paddle’s script (2.1); when you renew a licence, the Paddle customer number it was bought under (so that the payment is made in your name at Paddle; your email address is not passed), the number of the licence being renewed and the language of the page, so that Paddle can take the payment and tell us which licence it is for; when you buy, the language of the page; when a refund or a dispute has to be handled, the details of the transaction concerned.
• The provider of the server the site runs on (data processor): all of the data above, because the site, its database and the licence-signing service run on that server. [TO BE COMPLETED: the provider’s name and the country the server is in]
• The email delivery service (data processor): your email address and the content of the messages sent to you. [TO BE COMPLETED: the provider’s name and country, or that mail is sent from our own server]
• Public authorities and courts: only on a request they are legally entitled to make, or where it is needed to establish, exercise or defend a right.
• Our legal and financial advisers: only as far as a dispute or a legal obligation requires.

We do not sell or rent your personal data and do not share it with anyone for advertising.

4. Transfers abroad

The Paddle company that contracts with you is Paddle.com Market Limited, established in the United Kingdom, for buyers everywhere except the United States (Paddle.com Inc.) and Canada (Paddle.com (Canada) Ltd.). As soon as you open the purchase page or the page for buying another year of updates — whether or not you open the checkout — your browser downloads Paddle’s script from Paddle’s servers, and your IP address and browser details reach Paddle as it does (2.1); when the checkout opens, your browser connects directly to Paddle’s servers, and what you enter there goes to Paddle. Paddle’s script is loaded only on those two pages.

Transfers to the recipients in section 3 that are outside Turkey are made under Article 9 of the Law. [TO BE COMPLETED: the basis for each recipient abroad — for Paddle, including the IP address and browser details that reach it through the script request every time the purchase page or the renewal page is opened, and the Paddle customer number and licence number passed to it on a renewal; for example a standard contract notified to the Personal Data Protection Authority within five business days of signature, or one of the occasional-transfer cases; if the hosting and email providers are in Turkey, this paragraph concerns Paddle only]

5. What the cpleks software sends from your server

The cpleks software you install on your server (its programs and files are named cplex) sends nothing to anyone on its own except two things: the daily licence check-in and the update check.

• The daily licence check-in: only if a licence is installed on the server, once a day with the update check and whenever the panel’s update check button is pressed, the software sends cpleks.com the licence number, the binding number, the sequence number, the machine code and the one-time value it was given at the previous check-in. By the nature of a connection, your server’s IP address reaches us too.
• The update check: your server downloads the signed list of releases (and, when you apply an update, the release itself) from the update server. The request carries nothing about your server beyond what every web request carries — its IP address and the time. [TO BE COMPLETED: whether the server that serves updates and installers keeps access logs, and for how long]

When you activate or release a licence over the internet — only then, and only because you asked — the software sends the licence key and the activation request (the machine code and a digest of a secret the server keeps), or the licence number, the binding number and the release code. The machine code is derived from your server’s operating system identity (/etc/machine-id) by a one-way function; that identity itself never leaves the server.

The software sends no usage statistics, crash reports or telemetry, and passes us nothing about your sites, domains, mailboxes, databases, files, users or customers. The data you manage with the panel stays on your server; we have no access to it, and you are its data controller. When something you ask the software to do involves another party — for example obtaining a certificate from Let’s Encrypt, installing software from your operating system’s package archives, sending alerts to addresses you chose, or copying a backup to a destination you chose — the software contacts that party on your behalf; none of it reaches us.

6. Outcomes produced automatically

Some outcomes in the licensing system are produced automatically, as the application of the licence agreement: a licence bound to another server is not bound to a new one until it is released; a licence can be released only a limited number of times in a period; a licence whose payment was refunded or charged back loses its update period. You can write to us to object to any of these outcomes or to have a person review it.

7. Your rights

Under Article 11 of the Law you may apply to us to:

1. learn whether your personal data is processed,
2. request information about it if it has been processed,
3. learn the purpose of the processing and whether the data is used in line with that purpose,
4. know the third parties in Turkey or abroad to whom it has been transferred,
5. ask for it to be corrected if it is incomplete or inaccurate,
6. ask for it to be erased or destroyed under the conditions in Article 7 of the Law,
7. ask for a correction, erasure or destruction to be notified to the third parties the data was transferred to,
8. object to an outcome against you that arises from the data being analysed exclusively by automated systems,
9. claim compensation if you suffer damage because your personal data was processed unlawfully.

8. How to apply

You can send your application, in Turkish:

• as a signed letter to our address above,
• from your registered electronic mail (KEP) address to our KEP address,
• to our email address, signed with a secure electronic signature or a mobile signature, or
• to our email address from the email address registered to your account with us.

Your application must include your name and surname, your signature if it is written, your Turkish identity number if you are a Turkish citizen or, if you are not, your nationality and your passport number or identity number if you have one, your residential or business address for notices, your email address, telephone and fax number for notifications if you have them, and the subject of your request; documents relevant to it are attached. Requests written in English are answered too, under the Privacy Policy.

We conclude your application free of charge as soon as possible according to its nature and within thirty days at the latest. If the answer is given in writing and runs to more than ten pages, a fee of 1 Turkish lira may be charged for each page beyond the tenth; if it is given on a recording medium, the fee cannot exceed the cost of the medium. If your application is refused, you find our answer insufficient, or we do not answer in time, you may complain to the Personal Data Protection Board within thirty days of learning our answer and in any case within sixty days of your application.

9. Security

Pages are served over an encrypted connection (HTTPS), and browsers are told to use nothing else for this site. We store sign-in links and session numbers only as digests and keep no passwords. The service that signs licences runs under a separate account from the site, with no network access, and does not read the site’s database.

10. Changes to this notice

We update this notice when our processing changes, and before we start processing data for a new purpose. The current version is always on this page.