KVKK Privacy Notice

Data Controller

This notice is provided under the Turkish Personal Data Protection Law No. 6698 ("KVKK"). The data controller is FİMAJOR YAZILIM VE BİLİŞİM TEKNOLOJİLERİ SANAYİ TİCARET LİMİTED ŞİRKETİ, registered at Evliya Çelebi Mah. Sadi Konuralp Cad. Nejat Eczacıbaşı No: 5, 34433 Beyoğlu/İstanbul, Türkiye (İstanbul Trade Registry No. 36676-5; MERSIS No. 0388079100100018; Beyoğlu Tax Office, Tax No. 3880791001), operating the PhiWebs platform at phiwebs.com. Telephone: +90 212 909 96 33. PhiMajor Solutions is the trading name of this company; the two names refer to the same legal entity.

Personal Data We Process

In the course of account creation, subscription, payment and service delivery, we process the following categories of personal data:

· Identity data (name, surname) · Contact data (email address, telephone where provided) · Customer transaction data (subscription plan, order and invoice records) · Payment data (transaction records processed through the payment institution; card details are NOT stored by PhiWebs) · Transaction security data (IP address, session and log records, device and browser information).

Purposes of Processing

Your personal data is processed for the establishment and performance of the contract between us, management of your membership and account, billing and collection, fulfilment of our legal obligations, and the provision, maintenance, and improvement of the PhiWebs service.

We also process data in order to provide AI-assisted content and application generation features, and — where you have given explicit consent — to send you newsletters, announcements and campaign content.

Legal Basis and Method of Collection

Your personal data is collected by electronic means through the PhiWebs platform, based on the legal grounds set out in Article 5 of the KVKK — in particular, that processing is necessary for the establishment or performance of a contract, for compliance with a legal obligation, for the establishment or exercise of a right, or for our legitimate interests, provided that your fundamental rights and freedoms are not harmed. We do not process special categories of personal data within the meaning of Article 6 of the KVKK.

Where none of those grounds applies — analytics cookies, for example — we rely on your explicit consent.

Your data is collected electronically by wholly or partly automated means, through registration forms, the account and subscription screens, the payment flow, and your use of the platform.

Transfer of Personal Data

Your personal data may be transferred to payment institutions and infrastructure and hosting providers, within Türkiye and abroad, to the extent necessary to provide the service and on the legal grounds set out in the KVKK.

Where an infrastructure provider’s servers are located abroad, the transfer is carried out in accordance with the conditions set out in Article 9 of the KVKK. Your data is not sold to third parties.

You can request deletion of your account from your account settings. Once you confirm through the link sent to your e-mail address, valid for 15 minutes, your account is anonymised immediately: your e-mail address and name are removed, your open sessions are ended and your sign-in identities are deleted; your remaining personal data is permanently deleted 30 days later. If you delete your workspace, a 30-day restore window starts; during it, the applications you published are taken offline within 15 minutes at the latest, and at the end of it the workspace's content is deleted. Invoice, payment and credit records are kept for the periods set out below, without prejudice to statutory retention obligations.

If you use AI features, the input you send and the related content are transferred, solely in order to fulfil your request, to the relevant model provider through the service that brokers access to model providers, which may be established outside Türkiye. Transfers to analytics and measurement providers are made solely on the basis of your explicit consent.

For every access to an application published through the hosting infrastructure we provide in our capacity as a hosting provider, a traffic record is kept as required by Law No. 5651 and its regulation: the date and time of access, the domain and path accessed, the response status, the visitor's IP address, browser information and the request identifier. These records are processed to fulfil a legal obligation (KVKK Article 5/2-ç) and to keep the service secure (KVKK Article 5/2-f); they are stored for 2 years in a private storage area of our hosting infrastructure provider Cloudflare located abroad, and deleted at the end of that period. They are used only for requests from competent authorities, infringement notices and security investigations.

Your Rights (KVKK Article 11)

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information about such processing, to learn the purpose of processing and whether the data is used in line with that purpose, to know the third parties to whom your data is transferred, to request correction of incomplete or inaccurate data, to request deletion or destruction of your data, to request that these actions be notified to third parties, to object to results arising from analysis exclusively by automated systems, and to claim compensation for damage caused by unlawful processing.

You may exercise these rights by contacting us through the channel below. Requests are handled in accordance with the procedures and time limits set out in the KVKK and its secondary legislation.

You may make your application in writing to the address above with a wet-signed petition, by secure electronic signature or mobile signature, or by sending an email to kvkk@phiwebs.com from the address you previously notified to us and which is registered in our systems. Your application should state your name, your Turkish identity number if you are a Turkish citizen, an address for notification, and the subject of your request.

Your request is concluded free of charge within thirty days at the latest; where the process requires a separate cost, the fee in the tariff set by the Board may be charged. If your application is refused, if you find the response inadequate, or if no response is given in time, you may complain to the Personal Data Protection Board within thirty days of learning the response and in any event within sixty days of your application.

Contact

Application channel: kvkk@phiwebs.com. Address: FİMAJOR YAZILIM VE BİLİŞİM TEKNOLOJİLERİ SANAYİ TİCARET LİMİTED ŞİRKETİ, Evliya Çelebi Mah. Sadi Konuralp Cad. Nejat Eczacıbaşı No: 5, 34433 Beyoğlu/İstanbul, Türkiye.