Personal Data Processing Notice (KVKK)

Version 1.0 · Effective date: 17 October 2026

This English text is a translation of the Turkish original. If the two differ, the Turkish text prevails, without limiting any rights you have under laws that cannot be set aside by agreement.

Scope: This notice explains the personal data processed when you visit the zolpix.com website, create an account, place an order with or without an account, make a payment, open a support ticket, or use live support or the contact form. It has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. A short notice for live support is in Annex 1, and a short notice for the contact form is in Annex 2. This notice does not cover the data of Zolpix staff. If you use the site from the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) may also apply; the additional information for you is in section 11 of the Privacy Policy.

In brief

We process your data only to take and deliver your order, verify your payment, answer your questions, keep your account and the site secure and meet our legal obligations.
We never ask for your social media password or verification code. Your card details are entered on the payment institution's page; we do not see or store your card number or security code (CVV).
The service providers that deliver the order receive only the target link, the quantity and the order reference; your name, email address and IP address are not passed on.
The site has no advertising or tracking cookies and no third-party analytics tool. We do not sell your data.
While the AI assistant is active in live support, the most recent messages of the conversation are sent to NVIDIA Corporation in the USA so that a reply can be generated, after information in them such as email addresses, phone numbers, card numbers and IBANs has been automatically removed (Annex 1).
You can exercise your rights under Article 11 of the KVKK through the channels in section 9; we answer your request free of charge within 30 days at the latest.

1. Data controller

Your personal data are processed, as data controller, by the following business, which operates the zolpix.com website. In this notice, this business is referred to as "Zolpix" or "we".

Trade name: zolpix L.T.D.Ş
Address: Şile, İstanbul, Türkiye
Email: info@zolpix.com

2. Whose personal data we process

Visitors: anyone who browses the site without signing in.
Guest buyers: those who place an order with an email address, without creating an account.
Account holders: customers who create an account.
Users of live support and the contact form.
Target account holders: the owner of the social media account or content whose link is given in an order. This person may be someone other than the person placing the order.
Bank transfer senders: the person whose name is written in the bank transfer notification or on the transfer receipt. This person may be someone other than the person placing the order.

We do not ask for special categories of personal data (such as health, religion, ethnic origin or biometric data). Please do not share such data in your messages, transfer receipts or attachments. If such data are shared, we ensure that the parts not needed to answer your request are deleted.

3. What data we process, for what purposes and on what legal grounds

3.1 Account registration and management

Data: your name, your email address, an irreversible digest (hash) of your password, email verification status, your language and display currency preference, account status, the time of your last sign-in and last password change, your marketing email preference and its date, the IP address and browser information of your active sessions; the security digests of single-use links for email change and password reset.
Purposes: creating and managing your account, letting you sign in, showing your orders, balance and support tickets in one place, verifying your email address, carrying out password reset and email change securely, and protecting your account against unauthorised access.
Legal grounds: the establishment and performance of the membership contract (KVKK Art. 5(2)(c)); our legitimate interest in account security (Art. 5(2)(f)) and our obligation to ensure data security (Art. 5(2)(ç), Art. 12).

3.2 Orders (account holders and guests)

Data: for guest orders, your email address; the order number; the platform, service, package and quantity you chose; amounts, the currency charged and the exchange rate applied; coupon; payment method; payment and delivery statuses; the order timeline; the version of the contract texts you accepted at the time of the order and the time of acceptance; your separate consent to the immediate start of performance, the time of that consent and the version of the consent text; the security digest of the guest order tracking link.
Purposes: the establishment and performance of the distance sales contract; sending order confirmations and status notifications; enabling the order to be tracked; cancellations, refunds and refills; applying coupon usage limits; record-keeping obligations under accounting, tax and consumer legislation; resolving possible disputes.
Legal grounds: the establishment and performance of a contract (Art. 5(2)(c)); our legal obligations (Art. 5(2)(ç); Consumer Protection Law No. 6502, the Distance Contracts Regulation, Tax Procedure Law No. 213, Turkish Commercial Code No. 6102); the establishment, exercise or protection of a right (Art. 5(2)(e)); our legitimate interest regarding coupon limits (Art. 5(2)(f)).

3.3 Target account or content link

Data: the profile, channel, page, group or post link you enter in the order and the link type. The link may contain a person's username.
Purposes: delivering the service to the correct account or content, tracking delivery, and reviewing support and refill requests.
Legal grounds: for the person placing the order, the performance of the contract (Art. 5(2)(c)). If the linked account belongs to another person: our legitimate interest in performing the order (Art. 5(2)(f)), relying on the declaration by the person placing the order that they have obtained the owner's permission for this account.
Objection by the account holder: The account holder may object to this processing or request erasure of the data through the channels in section 9. If they object, the link in completed orders is shortened so that only the platform's domain name remains, unless it is needed as evidence in a dispute.
We never ask for or process the target account's password, verification code or authority to sign in to the account.

3.4 Card payments

Data: the payment amount and currency, the payment institution's transaction reference, the payment status and times, the transaction notifications sent by the payment institution (with card and account details masked).
Card details: The card number, expiry date and security code (CVV) are entered on the payment page of the contracted payment institution; these details do not reach our systems and are not stored by us.
Purposes: taking and verifying the payment, refunds, responding to payment disputes, fraud prevention, reconciliation.
Legal grounds: the performance of a contract (Art. 5(2)(c)); our legal obligations (Art. 5(2)(ç)); our legitimate interest in preventing fraud (Art. 5(2)(f)).

3.5 Bank transfer (havale/EFT) payments

Data: the sender name you write in the bank transfer notification, the sender IBAN (stored only in masked form), the amount, the transfer date and the description; the transfer receipt file you upload; the outcome of the review of the notification.
Purposes: matching the bank transaction to your order or balance top-up and verifying it, and, where necessary, making a refund to the correct account.
Legal grounds: the performance of a contract (Art. 5(2)(c)); our legal obligations (Art. 5(2)(ç)); the establishment, exercise or protection of a right (Art. 5(2)(e)). If you are not the sender, our legitimate interest in verifying the payment (Art. 5(2)(f)).
Before uploading, you can cover information on the transfer receipt that is not needed for the transaction (e.g. account balance). Embedded information in image receipts (e.g. location data) is removed automatically during upload.

3.6 Account balance

Data: your balance account; top-up, spending, refund and adjustment transactions and the payments and orders they relate to.
Purposes: recording balance top-ups and spending, crediting refunds to the balance, reconciliation.
Legal grounds: the performance of a contract (Art. 5(2)(c)); our legal obligations (Art. 5(2)(ç)).

3.7 Support tickets

Data: the subject of the ticket, your messages, the files you attach, the related order, the status of the ticket and our team's internal notes on the ticket.
Purposes: reviewing and answering your request, resolving order, payment and refill issues.
Legal grounds: the performance of a contract (Art. 5(2)(c)); our legitimate interest in answering your request (Art. 5(2)(f)).

3.8 Live support

Details are in Annex 1.

3.9 Contact form

Details are in Annex 2.

3.10 Security and technical records

Data: IP address, browser information, session records, failed sign-in attempts (with the email address masked), records of actions taken in your account and in the system, error logs, rate-limiting records; web server access logs kept on the hosting provider's systems.
Purposes: ensuring information security, preventing unauthorised use of accounts, fraud and misuse of the site, fixing errors, and proof in legal claims.
Legal grounds: our legitimate interest (Art. 5(2)(f)); our obligation to ensure data security (Art. 5(2)(ç), Art. 12); the establishment, exercise or protection of a right (Art. 5(2)(e)).

3.11 Marketing emails

Data: your email address, your name, the status and date of your marketing email permission.
Purpose: sending marketing and announcement emails, only if you have given permission.
Legal ground: your explicit consent (Art. 5(1)) and the approval you give under Law No. 6563 on the Regulation of Electronic Commerce. The permission box is never pre-ticked; you can withdraw your permission at any time in your account settings or through the link in every email. Not giving permission does not affect your ability to place orders.

3.12 Legal requests and disputes

Purposes: responding to lawful requests from competent public authorities and courts, and conducting consumer arbitration committee and court proceedings.
Legal grounds: our legal obligations (Art. 5(2)(ç)); the establishment, exercise or protection of a right (Art. 5(2)(e)).

4. How we collect your data

We collect your data electronically, by automated and partly automated means: from the information you enter in the registration, payment, bank transfer notification, support, live support and contact forms on the site; from the session, cookie and server records created while the site runs; from the transaction and status notifications sent to our systems by the payment institution and the service providers that carry out delivery; and from your email correspondence with us.

5. To whom and for what purposes we transfer your data

We transfer your data only to the following groups of recipients, only to the extent needed for the stated purpose, and in accordance with Articles 8 and 9 of the KVKK. We do not sell your data or share it for advertising purposes.

Hosting provider: provides the servers on which the site and the database run; stores the data on the site on our behalf and on our instructions.
Contracted payment institution: to take, verify and refund card payments, the payment amount, the order reference and the information the payment institution requires for the transaction. You enter your card details directly on the payment institution's page.
SMM service providers: to deliver the order, only the target link, quantity, service code and order item reference. Your name, email address and IP address are not passed on.
Email delivery service provider: your email address and the content of the email, so that emails such as order confirmations, order tracking, account verification, password operations and live support replies reach you.
AI service provider (NVIDIA Corporation, USA): only while the AI assistant is active in live support, the limited conversation content described in Annex 1.
Banks: the transaction information needed to verify bank transfer payments and to make refunds.
Accountants and legal advisers: to the extent necessary to meet accounting, tax and legal obligations and to protect our rights.
Competent public authorities and courts: only where required by law or in the event of a dispute.

If you choose to contact us through a messaging application such as WhatsApp, that application also processes your data under its own terms and privacy policy.

6. International transfers

While the AI assistant is active in live support, conversation content is transferred to NVIDIA Corporation (United States of America) within the limits in Annex 1. This transfer is made by signing the standard contract published by the Personal Data Protection Board, which is one of the appropriate safeguards provided for in Article 9 of the KVKK, and notifying the Board. The assistant is not activated before this contract is signed.
If any of the other service providers in section 5, or their servers, are located abroad, the transfer will be made only with one of the appropriate safeguards in Article 9 of the KVKK, and this notice will be updated with the relevant recipient group and country information.

7. How long we keep your data

We keep your data for the period required by the purpose of processing and for the statutory retention periods. When the period ends, the data are deleted or anonymised in a periodic destruction run that we carry out at least every 6 months under the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. The main periods are:

Order, payment, refund, balance and bank transfer records, transfer receipts and contract acceptance records: 10 years from the end of the year to which the record relates (Turkish Commercial Code Art. 82; this period also covers the 5-year period in Tax Procedure Law Art. 253).
The target link in an order: 3 years from the date of the order; after that, it is shortened so that only the platform's domain name remains.
Account details: for as long as your account exists. When you ask for your account to be closed, it is closed no later than 30 days later; records linked to your orders are kept for the period above. Accounts that have not been used for 3 years since their last sign-in and have no balance are closed 30 days after notice by email.
Support tickets and attachments: 3 years from the closure of the ticket.
Live support conversations: 180 days from the last message.
Contact form messages: 1 year from submission.
Marketing email permission records: for as long as the permission lasts and, after it ends, for the period provided for proof in the relevant legislation.
Application error and security logs: 14 days. Activity (audit) records: 3 years. Session records: deleted automatically when the session ends. Web server access logs: kept on the hosting provider's systems within the framework of the provider's obligations under Law No. 5651 and its settings.

Deleted data are removed from backup copies when the backup cycle is completed.

8. Your rights

Under Article 11 of the KVKK, by applying to us you have the right to:

learn whether your personal data are processed,
request information about it if they have been processed,
learn the purpose of processing and whether the data are used in line with that purpose,
know the third parties to whom the data are transferred in Türkiye or abroad,
request rectification if the data have been processed incompletely or inaccurately,
request erasure or destruction of the data under the conditions in Article 7 of the KVKK,
request that the rectification, erasure or destruction be notified to third parties to whom the data have been transferred,
object to a result to your detriment arising from the analysis of the data exclusively by automated systems,
claim compensation if you suffer damage because of unlawful processing.

Zolpix does not make decisions that produce legal effects concerning you or significantly affect you solely by automated systems; the AI assistant also does not make decisions about orders, payments, refunds or your account.

9. How to apply

Under the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can make your application in one of the following ways:

by sending a petition bearing your wet-ink signature to our address in section 1 by post, or by delivering it by hand,
if our KEP address is given in section 1, by sending it to that address from your registered electronic mail (KEP) address,
by sending your application signed with a secure electronic signature or mobile signature to info@zolpix.com,
by writing to info@zolpix.com from the email address you have previously given us and that is registered in our system.

Your application must include your first name and surname, your signature for written applications, your Turkish identity number if you are a citizen of the Republic of Türkiye (your nationality and passport or identity number if you are a foreign national), your residential or business address for service of notices, your email address and telephone number for notifications (if any), and the subject of your request. You may attach information and documents relating to your request. For guest orders, giving your order number and the email address used in the order makes it easier for us to match your application to the right records.

We may ask for additional information to verify your identity. We never ask for your password at any stage.

We conclude your application free of charge as soon as possible according to its nature, and within 30 days at the latest (KVKK Art. 13). If the action involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, if you find our answer insufficient or if we do not answer in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of our answer and, in any case, within 60 days of the date of application (KVKK Art. 14).

10. Updates

We update this notice when our data processing activities or the legislation change. The current version is published on this page with its version number and effective date.

Annex 1: Live support notice

Data controller: Zolpix, whose identity details are given in section 1.
Data processed: the messages you write; the name and email address you choose to leave; your account, if you are signed in; the language of the conversation; the address of the page on which you started the conversation and the page you last viewed (without query information); browser information; a keyed, irreversible digest of your IP address (the IP address itself is not stored in the conversation record); message times and read information; whether the reply came from the assistant or a team member.
Purposes: answering your questions; if you have left the chat and have given your email address, sending our team's reply to you by email; preventing misuse of live support.
Legal grounds: our legitimate interest in answering your request (KVKK Art. 5(2)(f)); the performance of a contract if your question relates to an order or account (Art. 5(2)(c)).
AI assistant: While the assistant is active, the AI assistant gives the first reply in new conversations and states this clearly in its first message. To generate a reply, only the following are sent to NVIDIA Corporation (USA): the assistant's fixed operating instructions; the package, price, terms and help information Zolpix has published on the site; and at most the last 12 messages of the conversation (including the messages of the assistant and, if any, of our team). Before sending, email addresses, phone numbers, card numbers, IBANs, values written as passwords and links to other sites in these messages are automatically removed. Your name, email address, IP address and account details in the conversation record are not added to the messages and sent; only the message texts are sent. The removal is rule-based and may not catch every piece of personal information written in a message (e.g. a name or address); please do not share passwords, card details or unnecessary personal information in the chat. The assistant does not access your orders, payments or account and does not make decisions about them. You can switch to our team at any time with the "Talk to a person" option. When our team takes over the conversation, the assistant stops replying, and the messages you write during that time are not sent to NVIDIA. If our team hands the conversation back to the assistant, the last 12 messages of the conversation (including our team's messages and the messages you wrote while talking to our team) are sent to NVIDIA for the assistant's subsequent replies, after passing through the removal described above. If the conversation starts while the assistant is active, your first message is passed to the assistant; if you would like to write without the AI assistant being used, you can use the contact form or our email address.
International transfer: The transfer to NVIDIA is made by signing the standard contract published by the Personal Data Protection Board under Article 9 of the KVKK and notifying the Board; the assistant is not activated before this contract is signed. The purposes for which and the period for which NVIDIA will process these data will be added to this section, in line with the signed contract, before the assistant is activated.
Recipients: our authorised support team; the email delivery service provider, if you have left your email address; NVIDIA Corporation, if the assistant is active; the hosting provider.
Retention: The conversation and its messages are deleted 180 days after the last message. The chat cookie (zolpix_chat) is set only when you send your first message and is valid for 30 days.
Your rights: sections 8 and 9.

Annex 2: Contact form notice

Data controller: Zolpix, whose identity details are given in section 1.
Data processed: your name, your email address, your message and the language in which you sent the form. Your IP address is not recorded with your message.
Purpose: answering your message.
Legal grounds: our legitimate interest in answering your request (KVKK Art. 5(2)(f)); the performance of a contract if your message relates to an order or account (Art. 5(2)(c)).
Recipients: our authorised team; the hosting provider; the email delivery service provider, when we send our reply by email.
Retention: 1 year from submission.
Your rights: sections 8 and 9.