KVKK (Personal Data Protection) Disclosure

1. Data Controller

Under the Personal Data Protection Law No. 6698 (KVKK), the data controller is Sigortada Bugün. Contact: [email protected]

2. Personal Data Processed

Depending on the services you use, the following personal data may be processed:

• Identity: Name, surname, national ID number
• Contact: Email address, phone number, address (city/district)
• Financial: Tax number, tax office, billing information (for corporate members)
• Payment data: Order ID, payment amount (card details are processed by iyzico/Shopier and not stored on our servers)
• Membership: Username, hashed password, premium subscription status, login history
• Content interactions: Comments, likes, view data
• Agency information: Company name, logo, contact details, partner insurers (for Agency Directory members)
• Transaction security: IP address, browser information, log records
• Marketing: Newsletter subscription status, unsubscription date
• Cookie and analytics data: Session information, visit statistics

3. Processing Purposes

• Management of membership and authentication services (including Google sign-in)
• Providing news, content and comment services
• Managing premium subscription service (ad-free experience)
• Newsletter delivery (with explicit consent, weekly insurance sector summary)
• Advertisement space sales and management; approval process, publication tracking
• Agency Directory membership and listing services
• Processing payments and issuing invoices
• Responding to customer service inquiries and contact forms
• Fulfilling legal obligations
• Site security and fraud prevention (including Cloudflare Turnstile)
• Performing statistical analyses and service improvement

4. Legal Basis

Your personal data is processed based on performance of contract (membership, payment, subscription), legitimate interest (security, analytics), explicit consent (newsletter, marketing) and legal obligation under KVKK Article 5/2.

5. Data Transfer

Your personal data may be shared with the following parties:

• iyzi Payment and Electronic Money Services Inc. (iyzico) and Shopier: For processing payments (card data is processed solely within the relevant payment service provider's systems)
• Google LLC: Google sign-in (OAuth), site statistics via Google Analytics (international transfer — KVKK Art. 9)
• Cloudflare Inc.: CDN, security and Turnstile spam protection (international transfer)
• SMTP infrastructure (Gmail): For email communications
• Authorized public institutions: When legally required

6. Retention Period

Your personal data is deleted, destroyed or anonymised when the processing purpose ceases or upon expiry of the period specified in relevant legislation. Payment and invoice records are retained for 10 years as required by tax law. Membership data is anonymised upon account deletion.

7. Your Rights (KVKK Article 11)

• Learning whether your personal data is processed
• Requesting information if processed
• Learning the purpose of processing and whether it is used accordingly
• Knowing third parties to whom data is transferred domestically/internationally
• Requesting correction if processed incompletely or incorrectly
• Requesting deletion or destruction (also available via account settings page)
• Objecting to the processing of your personal data
• Requesting compensation for damages

8. Application

To exercise your rights under KVKK, you can send a written application to [email protected] with the subject line "KVKK Application" along with identity verification information. Your application will be concluded within 30 days at the latest.