Data Protection Notice

Data controller: Mustafa Güldüler (sole proprietorship without a trade name) Address: Tunalı Mah. Yenibahçe Sk. Aktaş Dilan Apt. No: 2 İç Kapı No: 1, Tepebaşı / Eskişehir Tax office / no: Eskişehir V.D. — 4160204487 Activity: 479114 — Radyo, TV, posta yoluyla veya internet üzerinden yapılan perakende ticaret E-mail: [email protected]

Identity and contact: full name, e-mail, mobile phone and, for corporate accounts, company name and tax details.

Customer transactions: listing records, enquiries and requests, order, payment and invoice records, quota usage.

Transaction security: password hash, session records, hashed IP address, browser information, audit logs.

Visual data: listing photographs and the machine type plate image. A company name may be visible on a plate image; plate images are therefore protected as personal data.

Marketing: your communication preferences, only if you have given explicit consent.

At payment (card payments only): first and last name, Turkish ID number, mobile phone and billing address. These are processed solely to be forwarded to the payment institution and are not recorded by MakinAI.

Creating the membership record and managing sessions; publishing listings, verifying them against the machine plate and moderating them; enabling buyers and sellers to make contact; collecting and invoicing listing, extra listing, plan and promotion fees; rate limiting and preventing fraud and abuse; handling requests and complaints; fulfilling legal obligations and providing evidence in disputes.

Performance of a contract (Art. 5/2-c): membership, publishing listings, collecting fees.

Legal obligation (Art. 5/2-ç): retention of invoice and accounting records.

Legitimate interest (Art. 5/2-f): transaction security, rate limiting, abuse analysis and improving the service.

Explicit consent (Art. 5/1): display of contact details on a listing, contact over WhatsApp, marketing messages and the AI processing channel. Each of these consents is obtained SEPARATELY; withholding one does not prevent you from using the other services.

Identity and billing details forwarded to the payment institution for card payments (name, ID number, phone, billing address) are processed for the performance of the contract (art. 5/2-c), for the purpose of carrying out the payment.

Data is collected electronically through the registration and listing forms, the operations you perform in the panel, the contact form, e-mail and SMS flows, and technically through server logs.

Content published on a listing page and — if you have given explicit consent — your contact details are public.

Transfers to service providers are limited to what the service requires: e-mail and SMS provider, payment institution and server hosting.

Personal data in text sent to AI providers is masked beforehand; if masking fails, the call is not made. Because this transfer may go abroad it is subject to a separate explicit consent, and training use is configured off on the provider side.

Transfers to competent public authorities are made where and to the extent required by law.

Transfer to the payment institution (card payments): When you pay by card, your first and last name, Turkish ID (T.C. kimlik) number, mobile phone and billing address are sent only to iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico) in order to carry out the payment. They are passed along with the payment request and are NOT stored in the MakinAI database; your card details never reach MakinAI, they are entered on iyzico’s payment page. Legal basis: performance of a contract (art. 5/2-c).

Data is kept for as long as the purpose requires and for the limitation periods set out in legislation. When a period ends, a nightly retention job anonymises or deletes the records.

Payment, invoice and accounting records are kept for 10 years; consent records for 10 years; audit logs for 5 years; server access logs for 12 months; and masked AI request logs for 6 months. Backups are kept for at most 12 months.

Data deleted from the live system at your request may remain in backups until their retention period ends; during that period it is accessible only for disaster recovery, and the deletion is re-applied after any restore.

You have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether the data is used accordingly; to know the third parties to whom it is transferred at home or abroad; to request rectification if it is incomplete or inaccurate; to request erasure or destruction where the conditions are met; to request that rectification, erasure and destruction be notified to third parties to whom the data was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.

You can submit your request from your panel or by e-mail to [email protected]. Written applications can be sent to Tunalı Mah. Yenibahçe Sk. Aktaş Dilan Apt. No: 2 İç Kapı No: 1, Tepebaşı / Eskişehir.

Requests are answered within 30 days at the latest. Additional information may be requested to verify your identity. Any refused part is explained with its legal basis.

Consent is obtained SEPARATELY for each channel that requires it, using boxes that are not pre-ticked. No bundled consent is taken with a single box.

You can withdraw consent with one click from the panel, from the link in the footer of any e-mail, or by replying "STOP" over WhatsApp. Withdrawal takes effect immediately, and queued messages are cancelled.

A consent record is NEVER DELETED: a withdrawal is added as a new record, so it is always possible to see which text you consented to, when, and when you withdrew it.

Every version of this notice is stored with its version number and effective date; earlier versions are never overwritten. When a material change is published, affected users are shown the new text at their next sign-in and their approval is taken again.

The version shown in your consent record points to the text that was in force at the moment you approved it.