Privacy Policy

Last updated: [TO BE COMPLETED: publication date]

This policy explains what happens to your personal data when you visit cpleks.com, buy or use a cpleks licence, and write to us. It is written for everyone, including people protected by the EU General Data Protection Regulation (GDPR) and the UK GDPR. The notice Turkish law requires, covering the same processing, is the Personal Data Notice (KVKK).

In short

• To sell you a licence we need your email address and the transaction details Paddle reports to us; to bind the licence to your server we need your server’s machine code.
• Your card and other payment details never reach us: Paddle, as the seller, takes the payment.
• We use no analytics, advertising or tracking tools, and load no third-party fonts or scripts — except Paddle’s checkout script, which the purchase page and the page for buying another year of updates load as soon as they open.
• We email you only about your licence. We send no marketing.
• The cpleks software on your server sends nothing to anyone on its own except the daily licence check-in and the update check (section 5).

1. Who is responsible

Oyuncaklı Şeyler Turizm Organizasyon Sanayi ve Ticaret Ltd. Şti. (the “Company”, “we”), Etiler Mah. Evliya Çelebi Cad. Remel Plaza No:23/106, Beşiktaş, İstanbul, Türkiye, is the controller. Email: tunc@oyuncakliseyler.com. Our other details are on the Company Information page.

• Our representative in the European Union: [TO BE COMPLETED: name and address of the representative under Article 27 GDPR, or the decision that none is required]
• Our representative in the United Kingdom: [TO BE COMPLETED: name and address of the representative under Article 27 UK GDPR, or the decision that none is required]
• Data protection officer: none appointed. [TO BE COMPLETED: confirmation that none is required]

Paddle is a separate controller for what you give it at checkout and processes it under its own privacy notice.

2. What we process, why, on what basis, and for how long

When you visit the site

On every request the web server logs your IP address, the time, the address of the page requested, the response code and size, the page you came from, the identification your browser sends and the response time. The purpose is running and securing the site and investigating errors and abuse. Legal basis: our legitimate interests (Article 6(1)(f)). Retention: about two weeks at most — the logs are rotated daily, or sooner if one grows large, and the oldest is deleted once 14 older logs exist. The site’s application log records events with licence numbers, customer numbers and machine codes, and no IP address; it records no email address either, except that when a message to you cannot be sent the mail server’s refusal is written to it, and such a refusal usually repeats the recipient’s address. It is deleted after at most 8 daily rotations.

The purchase page, and the page for buying another year of updates for a licence you hold, also have your browser download the script of Paddle’s checkout from cdn.paddle.com as soon as they open, whether or not you open the checkout. That request gives Paddle your IP address, the identification your browser sends and the fact that the request comes from cpleks.com. The purpose is that the buy and renew buttons can open the checkout. Legal basis: our legitimate interests (Article 6(1)(f)).

To prevent abuse

We count, and limit, requests for sign-in links per email address and per IP address, and the activation, release and check-in requests your server makes to the licence service, actions on the account page and submissions of the site’s administration form per IP address. The count is kept under a keyed digest of the address, not the address itself. Legal basis: our legitimate interests. Retention: a count is no longer used once its time window has passed, and is deleted by a clean-up that runs every day.

When you buy or renew

Paddle tells us, in signed notifications, your Paddle customer number, the transaction and price numbers, the amount and currency paid, the time of payment, and whether a payment was refunded or charged back; we keep those and the language of the page you bought from. We also read your email address from Paddle with a key that can only read. We use these to create your licence, set its update period, deliver your key, and apply renewals, refunds and chargebacks. Legal basis: performing the contract (Article 6(1)(b)).

Your licence and your account

We keep your email address and language; a random customer number that contains nothing about you; your Paddle customer number; your licence numbers and keys (the key emailed after a purchase is stored encrypted on the site); the date your update period ends; and, for every server your licence has been bound to, its machine code, the binding and sequence numbers, the activation request (which contains a digest of a secret your server keeps), the keys issued for it, the release code when it was released, and the one-time values and times of its daily check-ins. We also record refunds, chargebacks, and actions we take on a licence (for example freeing the seat of a server that was lost), with the reason. The purpose is binding, moving, renewing or withdrawing your licence, deciding which releases your server may receive, showing your licences in your account, and detecting one licence used on more than one server. Legal basis: performing the contract; our legitimate interests in detecting use on more than one server and in being able to establish or defend legal claims. Retention: your account is kept while you hold a licence. You can close it yourself on your account page, or ask us to: that deletes your email address from your account and ends every sign-in, after which nobody can sign in to it; your licences, their records and your Paddle customer number stay, and the licences keep working. The record of the emails sent to you keeps the address for the period stated for it below. [TO BE COMPLETED: whether a closed account’s Paddle customer number is to be deleted once the limitation period for claims under the contract has run, and whether the address in the record of emails sent is to go at closure rather than after its 12 months] The licence records are kept in a ledger that can only be added to, so its entries cannot be deleted one by one; it holds no name, email, postal or IP address. Because a licence is perpetual, these records are kept as long as the licence exists. [TO BE COMPLETED: whether ledger entries of a closed account are anonymised after a set period]

When you sign in

We use no passwords: we email you a one-time sign-in link that is valid for 15 minutes and works once. Its code comes after a # sign in the link’s address, a part that browsers send to no server, so it does not reach the web server log. We store the link and your session number only as SHA-256 digests, and once a link has expired a clean-up that runs every day deletes its record. Your browser deletes the session cookie when you close it; a session also ends when you sign out, which deletes its record at once, and 30 days after sign-in at the latest, after which the daily clean-up deletes its record. How the session cookie works is in the Cookie Policy. Legal basis: performing the contract.

The emails we send you

We send your licence key after a purchase, sign-in links when you ask for them, and notices when your licence is bound to a server or released from one. For each message we record the recipient, its kind, its language, the time and whether it left our server, but not its content. We send no newsletters, campaigns or promotional messages. Legal basis: performing the contract. Retention: 12 months from when the message was sent, after which a clean-up that runs every day deletes the record. [TO BE COMPLETED: confirm the period]

When you write to us

We use your email address, your message and whatever you include in it to answer you and to handle your request. Legal basis: performing the contract; our legal obligations (requests about your personal data); our legitimate interests (other correspondence). Retention: [TO BE COMPLETED: period — our proposal: 2 years after the matter is closed, or until a dispute that needs it is resolved]

Records of Paddle notifications

For every notification from Paddle we record its number, type, arrival time and what became of it; its content is not written to this record. Legal basis: our legitimate interests (checking that payments reach the right licences). Retention: 24 months from when the notification arrived, after which a clean-up that runs every day deletes the record. [TO BE COMPLETED: confirm the period]

3. The legitimate interests we rely on

Keeping the site and the licensing system secure; preventing and investigating abuse; detecting a licence used on more than the one server it was bought for; making Paddle’s checkout available on the purchase page and the renewal page; checking that payments reach the right licences; and being able to establish, exercise or defend legal claims. You may object to processing based on these interests (section 8).

4. Do you have to give us data?

You need give us nothing to read the site or to download and install the software. To buy a licence you must give Paddle your payment details, and to receive your key and sign in you must give an email address; without them the licence cannot be delivered. A licence key is optional: the software installs and runs without one, but cannot then receive updates through the panel.

5. What the cpleks software sends from your server

The cpleks software you install on your server (its programs and files are named cplex) sends nothing to anyone on its own except two things: the daily licence check-in and the update check.

• The daily licence check-in: only if a licence is installed on the server, once a day with the update check and whenever the panel’s update check button is pressed, the software sends cpleks.com the licence number, the binding number, the sequence number, the machine code and the one-time value it was given at the previous check-in. By the nature of a connection, your server’s IP address reaches us too.
• The update check: your server downloads the signed list of releases (and, when you apply an update, the release itself) from the update server. The request carries nothing about your server beyond what every web request carries — its IP address and the time. [TO BE COMPLETED: whether the server that serves updates and installers keeps access logs, and for how long]

When you activate or release a licence over the internet — only then, and only because you asked — the software sends the licence key and the activation request (the machine code and a digest of a secret the server keeps), or the licence number, the binding number and the release code. The machine code is derived from your server’s operating system identity (/etc/machine-id) by a one-way function; that identity itself never leaves the server.

The software sends no usage statistics, crash reports or telemetry, and passes us nothing about your sites, domains, mailboxes, databases, files, users or customers. The data you manage with the panel stays on your server; we have no access to it, and you are its controller. When something you ask the software to do involves another party — for example obtaining a certificate from Let’s Encrypt, installing software from your operating system’s package archives, sending alerts to addresses you chose, or copying a backup to a destination you chose — the software contacts that party on your behalf; none of it reaches us.

6. Who we share data with

• Paddle (seller and payment service; a separate controller): when you open the purchase page, or the page for buying another year of updates for a licence you hold, your IP address and the identification your browser sends, as your browser downloads Paddle’s script; when you renew a licence, the Paddle customer number it was bought under (your email address is not passed), the number of the licence being renewed and the page language; when you buy, the page language; when a refund or a dispute is handled, the details of that transaction.
• The provider of the server the site runs on (processor): [TO BE COMPLETED: the provider’s name and the country the server is in]
• The email delivery service (processor): [TO BE COMPLETED: the provider’s name and country, or that mail is sent from our own server]
• Public authorities and courts: only on a request they are legally entitled to make, or where it is needed to establish or defend a legal claim.
• Our legal and financial advisers: only as far as a dispute or a legal obligation requires.

We do not sell or rent your personal data and do not share it for advertising.

7. Where your data is processed

We are established in Turkey, and your data is processed in Turkey and in the country where the server the site runs on is located. [TO BE COMPLETED: that country] Neither the European Commission nor the United Kingdom has found that Turkey provides an adequate level of data protection. The Paddle company that contracts with buyers outside the United States and Canada is Paddle.com Market Limited in the United Kingdom; as soon as the purchase page or the renewal page opens, your browser downloads Paddle’s script from Paddle, and when the checkout opens it connects to Paddle directly. The safeguards for data we send to service providers outside the country where we hold it: [TO BE COMPLETED: the safeguard for each provider, and how to obtain a copy]

8. Your rights

Depending on the law that protects you, you have the right to access your data, to have it corrected, to have it erased, to have its processing restricted, to object to processing based on our legitimate interests, and to receive the data you gave us in a structured, machine-readable form. None of our processing is based on your consent, so there is no consent to withdraw. Your rights under Turkish law, and how to exercise them, are in the Personal Data Notice (KVKK).

Write to tunc@oyuncakliseyler.com, in English or in Turkish, preferably from the email address registered to your account; if you write from another address we may ask for something that confirms who you are. We answer within one month; if a request is complex we may extend that by up to two further months and tell you why within the first month.

You have the right to complain — to us, and to a supervisory authority: in Turkey the Personal Data Protection Board; in the European Union the data protection authority of the country where you live or work or where the matter arose; in the United Kingdom the Information Commissioner’s Office.

9. Automated decisions

We do no profiling. Some outcomes in the licensing system happen automatically, as the application of the licence agreement: a licence bound to another server is not bound to a new one until it is released; a licence can be released only a limited number of times in a period; a licence whose payment was refunded or charged back loses its update period. Each follows from the contract you entered into and affects only which updates your server receives. You can write to us to contest any of them or to have a person review it.

10. Cookies

We use one cookie, only once you sign in — a session cookie, which your browser deletes when it closes — and store your light or dark theme in your browser if you choose one; we use no analytics or advertising cookies. On the purchase page and the renewal page, Paddle’s checkout may use cookies of its own. The details are in the Cookie Policy.

11. Children

The site and the licences are meant for adults who run a server; we do not knowingly collect data from children.

12. Security

Pages are served over an encrypted connection (HTTPS), and browsers are told to use nothing else for this site. We store sign-in links and session numbers only as digests and keep no passwords. The service that signs licences runs under a separate account from the site, with no network access, and does not read the site’s database.

13. Changes

We update this policy when our processing changes, and publish the update here before we start processing data for a new purpose. We email licence holders about a significant change.