Data Protection Notice (KVKK / GDPR)

Last updated: 12 June 2026

Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") grants data subjects whose personal data is processed the right to be informed about by whom, for which purposes and on which legal grounds their data may be processed, and to whom and for which purposes it may be transferred; it addresses these matters within the data controller's duty to inform.

Accordingly, under Article 10 of the Law, the data controller — directly or through an authorised person — must provide the data subject with the following information when personal data is obtained:

• The identity of the data controller and, if any, its representative,
• The purposes for which personal data will be processed,
• To whom and for which purposes personal data may be transferred,
• The method and legal grounds of collecting personal data,
• The other rights listed in Article 11 of the Law.

The duty to inform also continues where the processing is based on the data subject's explicit consent or carried out under another condition in the Law. In other words, the data subject must be informed in every case where their personal data is processed.

This notice is the information provided to LeaderMix users within the framework of the above obligation.

1. Identity of the Data Controller

Pursuant to Article 16 of the KVKK and the relevant resolutions of the Turkish Personal Data Protection Board, our company remains below the employee-count and annual-balance-sheet thresholds and is therefore not subject to mandatory VERBİS (Data Controllers' Registry) registration. This does not affect our obligations under the KVKK.

2. Personal Data Processed

While you use the platform, the following personal data may be processed:

• Identity data: full name, username; for invoicing purposes (if an individual invoice is preferred, providing it is optional) the Turkish ID Number.
• Contact data: e-mail address, phone number, billing address (including city / country).
• Company / professional data: company name (optional).
• Financial / billing data: invoice type (individual / corporate), company title, tax identification number (VKN) and tax office (for corporate invoices, optional) — for issuing official / e-archive invoices and fulfilling statutory retention obligations.
• Transaction security: IP address, session information, login–logout records.
• Usage data: page-visit logs, error reports, heatmap / session recordings (only with your explicit consent — see the Cookie Policy).
• Payment data: payment amount, invoice ID. Card details are not stored on LeaderMix servers; they are processed directly by the licensed payment institution (Tami).

3. Purposes of Processing

• Providing, managing, maintaining and improving the platform.
• Account creation, authentication and session management.
• Handling customer support requests.
• Invoicing, payment and subscription tracking.
• Fulfilling obligations arising from tax, commercial and e-commerce legislation.
• Ensuring system security, preventing fraud and abuse.
• Sending commercial electronic messages (weekly digest, product news) where you have given explicit consent.

4. Legal Grounds (KVKK Art. 5)

Your personal data is processed on the following legal grounds:

• Art. 5/2(c): processing directly related to the conclusion or performance of a contract (account opening, subscription tracking, invoicing).
• Art. 5/2(ç): fulfilment of our legal obligations (tax, invoice retention, log retention under Turkish Law No. 5651).
• Art. 5/2(f): our legitimate interests, provided your fundamental rights and freedoms are not harmed (system security, fraud prevention).
• Art. 5/1 — explicit consent: commercial electronic messages, optional analytics cookies and session recording.

5. Method of Collection

Your personal data is collected directly from you via the registration form, profile updates or the contact form; through the payment provider during payment transactions; and automatically while you use the platform (session cookies, server logs, the third-party tools listed in the cookie policy).

6. Transfer of Personal Data

Your personal data is not sold or shared with third parties for commercial purposes. Data limited to the relevant function is shared only with the following providers so that the service can be delivered:

• Server / hosting: Hetzner Online GmbH (European Union — Germany).
• Content delivery + security: Cloudflare, Inc. (USA; the KVKK Art. 9 standard contract is applied).
• E-mail delivery: Google Workspace ([email protected] infrastructure).
• Payments: Tami (licensed payment institution — virtual POS / 3D Secure), Türkiye.
• Analytics (only with your consent): Google Analytics 4 (Google Ireland Ltd.), Microsoft Clarity (Microsoft Corp.) — see the Cookie Policy for details.
• Legal authorities: with the competent authorities upon a court order or lawful request, limited strictly to the data requested.

7. Retention Period

Your personal data is retained for 3 years from the end of the service relationship; at the end of this period it is deleted or anonymised. Statutory retention obligations remain: invoice and payment records are kept for 10 years under tax legislation; traffic/access records for 2 years under Turkish Law No. 5651. Application-layer logs are retained for shorter periods (IP address 90 days, usage logs 60 days). Upon an account-deletion request, your data in live systems is immediately deleted/anonymised; a limited identity record is kept for 5 years in a separate, access-restricted archive for the right of defence in potential legal disputes and automatically destroyed at the end of that period. For the detailed table see the Privacy Policy.

8. Your Rights (KVKK Art. 11)

As a data subject you have the right to:

• Learn whether your personal data is processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether the data is used in line with that purpose,
• Know the third parties to whom it is transferred, domestically or abroad,
• Request correction of incomplete or inaccurate data,
• Request deletion / destruction under the conditions set out in the KVKK,
• Request that corrections, deletions or destructions be notified to the third parties to whom the data was transferred,
• Object to a result arising against you through analysis exclusively by automated systems,
• Claim compensation for damages caused by unlawful processing.

9. GDPR Information for EEA/UK Users

If you are located in the European Economic Area or the United Kingdom, the GDPR / UK GDPR applies to our processing of your personal data in addition to the KVKK. The controller is the company identified in Section 1. The legal bases correspond to GDPR Art. 6(1)(b) (contract), Art. 6(1)(c) (legal obligation), Art. 6(1)(f) (legitimate interests) and Art. 6(1)(a) (consent). In addition to the rights above, you may exercise your GDPR rights of access, rectification, erasure, restriction, data portability and objection at any time, and you may lodge a complaint with your local supervisory authority. Transfers outside the EEA rely on appropriate safeguards (standard contractual clauses) as described in the Data Processing Agreement.

10. Cookies

For detailed information about the cookies and tracking technologies used on the platform, see the Cookie Policy page.