Personal Data Disclosure Notice (KVKK Art. 10)

1. Data controller

The data controller (veri sorumlusu) under Law No. 6698 on the Protection of Personal Data is: SULTANA EXPRESS ("SultanaExpress") · İstanbul, Türkiye · Email: info@sultana.express [Registered trade name and registry details (MERSİS, tax, KEP) will be added upon completion of incorporation — counsel to confirm.]

2. What we process — today

We process the data you enter into our forms (supplier early access, buyer waitlist, talent pool, investor contact, build updates) and the records needed to prove your consent: - Identity: first name, last name. - Contact: email address; phone number if you choose to give it. - Company / professional: company name, city, country, product category, website; for the talent pool, the roles you are interested in and a LinkedIn or CV link. - Consent evidence: the timestamp of your submission and of your confirmation, a salted hash of your IP address, the exact consent text shown to you, the policy version, your language choice, and the page the form was on. - Technical: server logs and error reports (no session recording); aggregate, cookieless visit statistics that do not identify you. We process no special categories of personal data, and we ask for none.

3. Why we process it

• To record your request and respond to it (early access, waitlist, talent pool, investor contact).
• To send launch and product updates by email — only if you ticked the optional consent box and confirmed via the verification email (double opt-in).
• To evaluate talent-pool submissions when roles open.
• To prove that consent was given, when, and in exactly which wording (KVKK Art. 12; commercial electronic message rules).
• To keep the site secure, limit abuse, and diagnose errors.
• To measure site traffic in aggregate, without cookies and without identifying anyone.

4. Legal bases (KVKK Art. 5)

• Your explicit consent (Art. 5/1): commercial electronic messages — launch and product updates.
• Processing directly related to the establishment or performance of a contract (Art. 5/2-c): handling the request you submit through a form.
• Compliance with a legal obligation (Art. 5/2-ç): consent records; obligations under Law No. 6563.
• Establishment, exercise or protection of a right (Art. 5/2-e): retention of consent evidence.
• Legitimate interest (Art. 5/2-f): site security, bot defense, error diagnostics, aggregate cookieless measurement.

5. Who receives it

We share personal data only with the processors that run this site — each named below — and with competent public authorities where the law requires it. We sell data to no one. - Vercel Inc. — website hosting and CDN; form handling runs in Frankfurt, Germany (region fra1). US-based company. - Neon Inc. — the database holding lead records and consent evidence; Frankfurt, Germany (AWS eu-central-1). US-based company. - MailerLite — email delivery and double opt-in confirmation; data hosted in the EU (Germany / Netherlands). - Plausible — cookieless, aggregate visit statistics; hosted in Falkenstein, Germany. It receives no name and no email address. - Cloudflare — Turnstile bot protection on our forms; processes connection data (IP address, browser signals) strictly to distinguish humans from bots. Cloudflare also uses this data to improve its own bot detection, acting as a separate controller for that purpose. - Sentry — error diagnostics; EU region (Germany). Session recording is disabled.

6. Transfers abroad (KVKK Art. 9)

All processors listed above are established outside Türkiye. Transfers are made under Art. 9 of the KVKK on the basis of the standard contracts published by the Personal Data Protection Board, adopted without modification, together with the data-processing agreement concluded with each vendor. [COUNSEL TO CONFIRM BEFORE PUBLISH: standard-contract signatures and the notification of each contract to the Authority via the Data Transfer Module within five business days of signature.]

7. How we collect it

By automated and partly automated electronic means: the forms on this website, the double opt-in confirmation link, and the server logs generated while you use the site.

8. How long we keep it

• Unconfirmed sign-ups (double opt-in never completed): deleted after 30 days.
• Marketing consents: until you withdraw. Sending stops the moment you withdraw; the consent evidence itself is retained for the statutory limitation period as proof.
• Talent-pool records: 12 months, then deleted unless you renew your consent.
• Investor correspondence: 24 months.
• Server logs and error reports: short technical retention windows, then deleted.

9. Your rights (KVKK Art. 11)

Under KVKK Art. 11 you may at any time request: to learn whether your personal data is processed; information about it if so; the purpose of processing and whether it is used accordingly; the third parties to whom it is transferred, in Türkiye or abroad; correction if it is incomplete or inaccurate; deletion or destruction under the conditions of Art. 7; notification of corrections and deletions to the recipients; to object to a result that is produced exclusively by automated analysis and is to your detriment; and compensation if you suffer damage from unlawful processing. Apply by email to info@sultana.express, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer within 30 days at the latest (KVKK Art. 13). Unsubscribing from emails needs no formal application: every message carries a one-click unsubscribe link.

10. Commercial electronic messages (Law No. 6563 / İYS)

Launch and product updates are commercial electronic messages under Law No. 6563 on the Regulation of Electronic Commerce. We send them only with your explicit consent (for merchant and tradesperson recipients, within the scope the law permits), we keep the consent records in a format ready for transfer to İYS (İleti Yönetim Sistemi), and we do not send commercial messages to recipients in Türkiye before our İYS registration is complete. You can stop them at any time via the unsubscribe link in every message.