CREATO AI KVKK Information Notice on Personal Data

Document version: 2.0 — Date of preparation: September 30, 2026.

1 Data controller

Pursuant to the Law on the Protection of Personal Data No. 6698 (“KVKK”), the data controller for the direct personal data processing activities outlined below is EMRE ALAY, providing services under the brand CREATO AI. Address: Şemikler Mah. 6250 Sk. No:5 D:3 Karşıyaka/İzmir, Türkiye. Tax identification number: 0480374439. Email: hello@creato.digital.

This notice is prepared for website visitors, demo and contact requesters, natural person contracting parties, authorized representatives and employees of corporate customers, and platform users. In activities where our business customer processes End User data for its own purposes and instructions, the data controller is the respective business customer; CREATO AI operates as a data processor. This notice does not replace the statutory information notice obligations of the respective merchant.

2 Data categories purposes and legal grounds

Personal data is processed strictly to the extent that the following concrete purposes and conditions genuinely exist. All legal grounds do not apply collectively to every purpose.

Data and Processing Activity	Purpose of Processing	Legal Basis under KVKK
Name, contact, and account details of natural person contracting party	Establishment and performance of account and subscription agreement	Art. 5/2-c, directly necessary for contract formation or performance
Name, work contact, and title of corporate customer representative or employee	Representation, access management, and business relationship administration	Art. 5/2-f legitimate interest without infringing fundamental rights; Art. 5/2-e where required to substantiate authority
Invoices, tax details, payment outcomes, and transaction references	Accounting, payment reconciliation, and financial statutory duties	Art. 5/2-ç for statutory legal obligations; Art. 5/2-e for establishment/protection of rights; Art. 5/2-c for necessary contract execution
Inquiry and customer support communications	Resolving requests, technical assistance, and dispute handling	Art. 5/2-c or Art. 5/2-f depending on inquiry nature; Art. 5/2-e for defense of legal rights
IP addresses, device/session identifiers, and audit logs	Security monitoring, fraud prevention, access controls	Art. 5/2-f subject to balancing test; Art. 5/2-ç for statutory obligations; Art. 5/2-e for legal claims
Contract versions, acceptance logs, consent, and opt-out records	Substantiating transactions and preferences, compliance proof	Art. 5/2-ç for applicable statutory obligations; Art. 5/2-e for defense of legal rights
Optional analytics and advertising tracking identifiers	Performance measurement, tailored user experience	Art. 5/1 explicit consent where required; strictly necessary technologies evaluated separately
Optional CREATO AI marketing preferences and contact details	Delivering requested product updates, webinars, and promotional offers	Art. 5/1 explicit consent where required; commercial electronic messages also subject to Law No. 6563

Where legitimate interest is relied upon as a legal basis, necessity and fundamental rights of data subjects are systematically evaluated. Contract performance cannot be cited as justification for unrestricted processing of an enterprise customer's entire End User database or unrelated employee records. Deliberate processing of special category personal data is never conducted without dedicated safeguards and satisfaction of Article 6 conditions under KVKK.

3 Collection methods

Personal data is collected through electronic registration and checkout forms, contract acceptances, contact and demo forms, technical support tickets, authorized account operations, activated integrations, device and server logs, cookies, and similar technologies by automated or semi-automated methods; or via non-automated means where data forms part of a structured filing system (such as written agreements and submitted verification documents).

Store analytics instructions confirmed on connection screens establish the operational scope requested by the Customer. Privacy notices and legal grounds concerning store clientele must be established by the respective merchant. Where explicit consent is legally required, integration authorization, silence, or general terms acceptance does not substitute for distinct consent.

4 Recipients and transfer purposes

Where strictly necessary, data may be transferred to AWS and cloud infrastructure vendors for secure hosting; to iyzico and financial partners for checkout, refunds, and fraud prevention; to Meta/WhatsApp, Google, and connected store engines for activated integrations; to professional advisors for audit and legal compliance; and to public authorities where mandated by law. Current foreign LLM pipelines utilize only genuinely anonymized inputs. Workflows transmitting personal data to foreign AI providers will not be initiated without establishing requisite legal transfer grounds and explicit notices. Specific providers are documented in the Subprocessors and Service Providers notice.

Transfers are conducted pursuant to Article 8 of KVKK, and Article 9 where cross-border transfers occur. An external service provider may act as an independent data controller for its own statutory operations, such as payment gateways under banking and financial crime laws. Recipients do not receive unrestricted database access. Customer contact lists are never sold, and customer content is never provided for generalized foundation AI training.

5 Cross-border processing

Depending on AWS cloud regions, disaster recovery backups, remote developer support, and operations of Meta, Google, or foreign LLM vendors, international data processing or remote access may occur. Destination country, vendor, data scope, and transfer safeguards are disclosed for each concrete flow. Routine cross-border transfers are not grounded in boilerplate consent clauses or routine account activations.

Workflows involving personal data are not operated abroad without satisfying Article 9 conditions under KVKK, such as applicable adequacy decisions or appropriate transfer safeguards. Where standard contractual clauses approved by the Personal Data Protection Board are utilized, role-appropriate official templates, binding signatures, and statutory filings within five business days of execution are complied with. These rules apply equally to pseudonymized data that remains linkable to an individual. Truly anonymized transfers preserve the data controller's compliance obligations incurred during source data preparation.

6 Retention and destruction

Data is retained strictly for the duration necessary for service delivery, compliance with statutory limitation periods, or substantiating legal claims. End User content is deleted from active systems following a thirty-day handover window post-contract termination, and purged from encrypted backups within ninety days. Accounting, tax, and contract records are maintained separately under statutory retention schedules; these retention schedules cannot be extended to cover customer conversations.

Upon expiry of retention grounds, data is deleted, destroyed, or irreversibly anonymized. Records retained for ongoing litigation or statutory compliance cannot be accessed for marketing or AI applications. Information regarding retention schedules may be requested at any time.

7 Data subject rights

Pursuant to Article 11 of KVKK, you are entitled to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in accordance with its purpose; know third-party recipients domestically or abroad; request rectification of incomplete or inaccurate data; request erasure or destruction under Article 7 conditions; request notification of rectification/erasure to third-party recipients; object to adverse outcomes resulting exclusively from automated systems; and claim compensation for damage incurred due to unlawful processing. Where processing is based on explicit consent, consent may be withdrawn prospectively at any time.

8 Application procedure

You may submit your request in writing to our postal address above; via secure electronic signature or mobile signature; or from your registered email address previously verified in our systems to hello@creato.digital. You may also utilize official electronic application portals if provided. Registered Electronic Mail (KEP) details will be made available if officially registered. If submitting from an unregistered email, appropriate identity verification measures may be required.

Applications must include full name, signature (for written requests), Turkish Republic ID number (or nationality and passport number for non-citizens), residential/work address, email, telephone number, and specific request details. Full identity card copies are not automatically required for routine requests; verification is conducted proportionately.

Inquiries are resolved free of charge without undue delay and within at most thirty calendar days depending on request complexity. Where a statutory fee tariff is established by the Board, authorized fees may apply. Requests concerning End User records where our business customer is the data controller are forwarded to the merchant with collaborative support. The statutory right to file a complaint with the Personal Data Protection Board remains reserved.

Have a Legal Question?

hello@creato.digital