This English text is a translation provided for convenience; in case of any discrepancy, the Turkish version (KVKK Aydınlatma Metni) prevails.
1. Data controller
Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), the data controller is the company operating the GOSpock brand and service:
- Trade name: Neden Olmasın Reklam ve İlet. Hiz. Dan. Tic. Ltd. Şti.
- Address: İstiklal Mah. Piyalepaşa Bulv. No:22/1 B-C Blok, Beyoğlu / İstanbul, Türkiye
- Tax office and number: Kasımpaşa Vergi Dairesi – 6300431044
- E-mail: info@gospock.com
(the “Company”, “we”, “us”).
2. Scope of this notice
This notice covers the following groups of data subjects for whom the Company is the data controller:
- GOSpock panel users and our customers’ representatives (section 3),
- business contacts and prospects (section 4),
- visitors of the gospock.com website (section 5).
About our customers’ end users: GOSpock processes the data of people who use our customers’ websites or apps and receive their notifications as a data processor on behalf of the customer. The data controller for this data is the respective customer. End users are informed not by this notice but by the customer’s own information notice as data controller, and should address their applications to that customer. For details, see the Privacy Policy.
The legal grounds stated in the tables below are based on the following sub-paragraphs of Art. 5(2) KVKK:
- (a) it is expressly provided for by law,
- (c) processing of the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract,
- (ç) it is necessary for the data controller to comply with its legal obligation,
- (e) it is necessary for the establishment, exercise or protection of a right,
- (f) it is necessary for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject.
Your explicit consent is not relied on for the processing activities listed in this notice. No special categories of personal data are processed.
3. Panel users and customer representatives
| Data category | Personal data | Purposes of processing | Legal ground |
|---|---|---|---|
| Identity | First and last name; for customer representatives also title | Creating and managing the panel account, concluding and performing the service contract | Art. 5(2)(c), (f) |
| Contact | E-mail address; for customer representatives also company and contact details | Sending invitation, password reset and limit warning e-mails, answering support requests, communication about the contract | Art. 5(2)(c), (f) |
| Transaction security | Password hash (the password itself is not stored), two-factor authentication and passkey data, session data, IP address and browser information in security logs | Secure sign-in to the panel, information security, preventing unauthorised access and misuse | Art. 5(2)(ç), (f) |
| Audit records | Records of administrative actions in the panel (who did what, when) | Traceability of actions, account security, evidence in disputes | Art. 5(2)(e), (f) |
| Preferences | Panel language and theme preferences | Presenting the panel in the language and appearance you choose | Art. 5(2)(c), (f) |
| Legal transaction and finance (customer representatives) | Contract, order form and invoice details | Concluding and performing the contract, invoicing, complying with obligations under commercial and financial legislation | Art. 5(2)(a), (c), (ç) |
Method of collection: The panel cannot be joined through public sign-up, only by invitation. Your name and e-mail address are provided by the customer representative who invites you; your account and preference data by you through the panel; and security and audit records are collected automatically by our systems, electronically, while you use the panel. Customer representatives’ data is obtained through the contract, the order form and e-mail correspondence.
4. Business contacts and prospects
| Data category | Personal data | Purposes of processing | Legal ground |
|---|---|---|---|
| Identity | First and last name | Answering your requests and questions, preparing offers | Art. 5(2)(c), (f) |
| Contact | Company, e-mail address, phone number | Communicating with you, managing the business relationship | Art. 5(2)(c), (f) |
| Request information | Content of the messages you send us | Assessing and answering the request, keeping correspondence as evidence | Art. 5(2)(c), (e), (f) |
Method of collection: This data is obtained directly from you, electronically, through the e-mails you send us. Sub-paragraph (c) applies to steps taken at your request before a contract is concluded.
5. Website visitors
| Data category | Personal data | Purposes of processing | Legal ground |
|---|---|---|---|
| Transaction security | Server access logs: IP address, time of visit, requested page, browser information (user agent) | Security and operation of the website, complying with traffic data obligations under Law No. 5651 where applicable | Art. 5(2)(ç), (f) |
Method of collection: Access logs are generated automatically and electronically by the hosting server when you visit the site. gospock.com is a static website; it uses no analytics, no advertising or tracking cookies and no third-party trackers; all files, including fonts, are loaded from our own server and no data reaches third parties when a page loads. The site language you choose is stored only in your browser (localStorage, gs_site_lang) and is not sent to us. For details, see the Cookie Policy.
6. Transfer of personal data
We do not sell your personal data or use it for advertising. Your data is transferred only to the recipients below, for the stated purposes and to the extent necessary.
Transfers within Türkiye (Art. 8 KVKK)
| Recipient | Data subject group | Purpose | Legal ground |
|---|---|---|---|
| Hosting providers operating data centers in Türkiye | All groups | Hosting servers and databases, storing data securely | Art. 8(2)(a) with Art. 5(2)(c), (f) |
| The customer you belong to | Panel users | Enabling the customer to manage its own account and team members | Art. 8(2)(a) with Art. 5(2)(c), (f) |
| Competent public authorities and courts | All groups | Responding to lawful requests, complying with legal obligations, protecting rights | Art. 8(2)(a) with Art. 5(2)(a), (ç), (e) |
Transfers abroad (Art. 9 KVKK)
- E-mail service providers: Invitation, password reset and limit warning e-mails and correspondence are handled through e-mail service providers. Where these providers are located abroad, the transfer is made under Art. 9 KVKK, as amended by Law No. 7499, on the basis of one of the conditions in Art. 5 and appropriate safeguards (in particular standard contracts notified to the Personal Data Protection Authority within five business days of signature) or, where these are not available, the occasional-transfer exceptions in Art. 9(6).
- Website visitors: Website visitors’ data is not transferred abroad; server access logs are kept only by the hosting provider in Türkiye.
- Push services: Transfers to Google Firebase Cloud Messaging, Apple Push Notification service and the push services of browser vendors concern only the data of our customers’ end users (push token and notification content). For these transfers, GOSpock is the data processor and the customer is the data controller; the data of the data subject groups covered by this notice is not transferred to push services.
GOSpock’s servers and databases are hosted in data centers in Türkiye.
7. Retention periods
Your personal data is kept for as long as the purpose of processing requires and for the periods provided by law: panel user accounts for the term of the contract and thereafter for the statutory periods (e.g. 10 years for commercial records under the Turkish Commercial Code, where applicable); security and access logs for up to 2 years (at least 1 year where the obligations under Law No. 5651 apply); correspondence with business contacts for up to 3 years after the last contact, unless a contract follows. Data whose retention period has expired is deleted, destroyed or anonymised.
8. Your rights under Art. 11 KVKK
Under Article 11 KVKK, by applying to the data controller you have the right to:
- learn whether your personal data is processed,
- request information if your personal data has been processed,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom your personal data is transferred,
- request correction if your personal data is incomplete or inaccurately processed,
- request erasure or destruction of your personal data under the conditions in Article 7 KVKK,
- request that the actions taken under items (5) and (6) be notified to third parties to whom your personal data has been transferred,
- object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems,
- claim compensation for damage you suffer as a result of unlawful processing of your personal data.
9. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit requests concerning your rights in Turkish by one of the following means:
- by delivering your written application bearing your wet signature by hand to İstiklal Mah. Piyalepaşa Bulv. No:22/1 B-C Blok, Beyoğlu / İstanbul, Türkiye, or sending it by post or through a notary,
- by sending your application signed with a secure electronic signature or mobile signature to info@gospock.com,
- by sending an e-mail to info@gospock.com from an e-mail address you have previously provided to us and that is registered in our systems (e.g. the e-mail address of your panel account).
Your application must include your first and last name and, if the application is in writing, your signature; for citizens of the Republic of Türkiye, your Turkish ID number; for foreign nationals, your nationality, passport number or, if any, ID number; your residential or business address for notifications; if any, your e-mail address, phone and fax number for notifications; and the subject of your request. Relevant information and documents should be attached. We may ask for additional information to verify your identity.
Your application will be concluded free of charge as soon as possible depending on the nature of the request and within 30 days at the latest. If the action requires an additional cost, a fee according to the tariff set by the Personal Data Protection Board may be charged. Our answer will be given in writing or electronically.
If your application is rejected, you find our answer insufficient or we do not answer in time, you may lodge a complaint with the Personal Data Protection Board under Art. 14 KVKK within 30 days of learning of our answer and in any case within 60 days of the application date.
We forward applications we receive concerning our customers’ end-user data to the customer concerned, as data controller, without delay.
10. Updates
This notice may be updated to reflect changes in our processing activities or in the law. The current text is published on this page. For more detailed information on the processing of personal data, see the Privacy Policy.