KVKK Information Notice

1. Data controller

This notice is issued under Personal Data Protection Law No. 6698 (the “Law”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, by Mobiroller Yazılım A.Ş. (“Growado”), a company registered with MERSİS number [MERSİS numarası] at Antalya Teknokenti Arge 2 Binası No 3A/106 Konyaaltı, Antalya, Türkiye, as data controller.

It explains how the personal data of people who visit growado.com and apply to the early-access list is processed. Visitors in the EU/EEA can also find their GDPR rights in the Privacy Policy.

2. Personal data we process

• Website visits: IP address, browser and device information, date and time of the visit, and pages viewed (transaction security data). This data is created automatically in the server logs of our hosting provider.
• Early-access application: full name (identity), work e-mail (contact), role, company and team size (professional information), and, if you share it, your biggest challenge in organic growth.
• Contact: your name, e-mail address and the content of your message when you write to us.
• Campaign and measurement data: the campaign parameters (UTM) of the ad or link that brought you to the site, the first landing page, the referring address and your cookie choice; if you accept marketing cookies, also ad click IDs (gclid, gbraid, wbraid, fbclid). With your consent, usage and ad-interaction data collected through analytics and marketing cookies.

Growado does not ask for special categories of personal data. Please do not share such data in form fields or messages.

3. Purposes

• Providing, operating and securing the website,
• Receiving and reviewing your early-access application and contacting you about early access,
• Using the information in your application to shape the product around early-access users’ needs,
• Answering your requests and questions,
• Measuring which applications our ad campaigns bring and analysing how the site is used (only with your explicit consent),
• Meeting legal obligations and requests from competent authorities.

4. Legal grounds and collection method

Your personal data is processed on the following grounds in Article 5(2) of the Law:

• It is directly related to establishing or performing a contract, for receiving and handling your early-access application (point c),
• It is necessary for the data controller to comply with a legal obligation (point ç),
• It is necessary for the legitimate interests of the data controller, without harming your fundamental rights and freedoms, for site security, product development and recording which campaign or link your application came from (campaign parameters, landing page, referring address) (point f).

Data processed through analytics and marketing cookies, and transfers to Google and Meta for ad measurement, rely on your explicit consent under Articles 5(1) and 9 of the Law. You can withdraw your consent at any time on the Cookie Preferences page; withdrawal does not affect the lawfulness of earlier processing.

Data is collected automatically through server logs and cookies, partly automatically through the early-access form, and through e-mail correspondence.

Commercial electronic messages about product news, campaigns or promotions are sent only with your separate consent under Law No. 6563 on the Regulation of Electronic Commerce. You can withdraw this consent at any time.

5. Transfers

Your personal data may be transferred, limited to the purposes above and only as needed, to:

• Our hosting provider: Vercel Inc. (United States),
• The provider that stores early-access applications: Supabase Inc. (United States),
• The provider that sends application confirmation e-mails: Resend, Inc. (United States),
• With your explicit consent, for site analytics and ad measurement: Google LLC (Google Analytics, Google Ads; United States) and Meta Platforms Ireland Ltd. (Meta Pixel and Conversions API; Ireland, with Meta Platforms, Inc. in the United States). Your e-mail address is sent to Meta only in irreversibly hashed form,
• Competent public authorities, when legally required.

Transfers to providers abroad are made with one of the appropriate safeguards in Article 9 of the Law: [aktarım dayanağı; örneğin Kişisel Verileri Koruma Kurulu tarafından ilan edilen standart sözleşme].

6. Retention

Early-access application data is kept while the early-access process continues or until you withdraw your application, and is deleted, destroyed or anonymised within [süre] after that. Server logs are kept for [süre]. Where the law requires a longer period, that period applies.

7. Your rights

Under Article 11 of the Law, you may apply to the data controller to:

• learn whether your personal data is processed,
• request information about the processing if it is,
• learn the purpose of the processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom your data is transferred,
• request correction of incomplete or inaccurate data,
• request deletion or destruction of your data under the conditions of Article 7 of the Law,
• request that correction, deletion or destruction be notified to the third parties your data was transferred to,
• object to a result against you that arises from analysis of your data exclusively by automated systems,
• claim compensation for damage caused by unlawful processing of your data.

8. How to apply

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send requests in writing to Antalya Teknokenti Arge 2 Binası No 3A/106 Konyaaltı, Antalya, Türkiye; by registered electronic mail (KEP) to [KEP adresi] with a secure electronic or mobile signature; or to info@mobiroller.com from the e-mail address you previously gave us.

We answer free of charge as soon as possible and within thirty days at the latest, depending on the request. If the process requires an extra cost, the fee set by the Personal Data Protection Board may be charged. If your request is rejected, you find the answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board.