This notice provides the information required by Article 10 of Turkey's Personal Data Protection Law No. 6698 (KVKK) and Article 13 of the EU General Data Protection Regulation (GDPR). The detailed list of the data we process, the providers we share it with and retention periods is in our Privacy Policy.
1. Controller
Makkler, LLC - 30 N Gould St, STE R, Sheridan, WY 82801, United States. For any privacy request: [email protected].
2. How we collect data
We collect personal data electronically, wholly or partly by automated means: through forms on the website and in the apps (sign-up, profile, analyst application, contact, support), through records created as you use the Platform, through payment notifications from payment providers and app stores, and through Google if you sign in with Google.
3. Purposes and legal bases
- Performance of a contract (KVKK art. 5(2)(c), GDPR art. 6(1)(b)): your account, Club memberships, payments, notifications, MakklerPRO and support.
- Legal obligation (KVKK art. 5(2)(ç), GDPR art. 6(1)(c)): keeping payment, refund and accounting records; requests from authorities.
- Legitimate interests (KVKK art. 5(2)(f), GDPR art. 6(1)(f)): account and Platform security, preventing fraud and abuse, rate limiting and moderation. You may object to this processing.
- Establishing, exercising or defending legal claims (KVKK art. 5(2)(e), GDPR art. 6(1)(f)): disputes, chargebacks and legal claims.
- Permission (GDPR art. 6(1)(a)): the push notification permission you give on your device, which you can withdraw at any time in your device settings.
4. Recipients
Strictly for the purposes above, your data may be disclosed to the analyst of a Club you are a member of (to run the membership), to payment providers and app stores (payments), to our infrastructure, email, notification and AI service providers (to provide the service) and to competent public authorities (legal obligation). The list of providers is in section 3 of the Privacy Policy.
5. International transfers
The controller is established in the United States; your data is processed on our servers in the United States and by our service providers in the United States, Canada and other countries. These transfers from Turkey and the European Union are necessary to provide the service to you and are subject to Article 9 of the KVKK and Chapter V of the GDPR. For questions about transfers, write to [email protected].
6. Your rights
- To learn whether your personal data is processed and, if so, to request information about it,
- To learn the purpose of processing and whether the data is used in line with it,
- To know the third parties in Turkey or abroad to whom the data is transferred,
- To have incomplete or inaccurate data corrected,
- To have data deleted or destroyed under KVKK art. 7 and GDPR art. 17,
- To have corrections and deletions notified to the third parties the data was transferred to,
- To object to an outcome against you that results solely from automated analysis of your data,
- To claim compensation for damage caused by unlawful processing,
- Under the GDPR also: to restrict processing, to receive your data in a structured, machine-readable format (portability), to object to processing based on legitimate interests and to withdraw a permission you gave.
7. How to make a request
Send your request to [email protected] from the email address registered to your Makkler account. We may ask for additional information to verify your identity. We answer free of charge within 30 days at the latest; if we cannot fully meet a request (for example because the law requires us to keep certain records), we explain why. You do not need to make a request to delete your account: follow the steps on the Delete your account page.
8. Right to complain
If you are not satisfied with our answer, you can complain to the Personal Data Protection Board (KVKK Kurulu) in Turkey or, in the European Union, to the data protection authority of the country where you live or work.
9. How we protect your data
- Passwords are stored as irreversible bcrypt hashes; only hashes of email verification, password reset and session refresh tokens are kept.
- All connections to the Platform are encrypted with HTTPS.
- Card details never reach Makkler's servers.
- Every user can turn on two-step verification; it is mandatory for analysts who sign in with a password.
- Sensitive files such as payout receipts are stored outside public storage, and access to personal data is limited to people who need it for their work.
- Temporary records that are no longer needed (such as rate-limit records and expired session tokens) are deleted automatically.