Privacy Notice (KVKK)
Version: 2026-09-v4
The Turkish version prevails in case of conflict.
Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), Design for Good LLC ("Company"), as data controller, informs you about the personal data it processes on smesatcop31.com ("Platform").
1. Data controller and representative
- Data controller: Design for Good LLC (a company incorporated in the United States)
- Data controller representative in Türkiye: Kırmızı Beyaz Prod. Eğ. Reklam Yap. Dan. Mat. Yay. Org. İth. İhr. A.Ş.
Next Level, Kızılırmak Mah. Dumlupınar Bulvarı No: 3C1-160, 06520 Çankaya, Ankara, Türkiye Çankaya Tax Office · Tax ID 5580698082
- Contact: info@smesatcop31.com
2. Personal data processed
| Category | Data |
|---|---|
| Identity | Name, surname, title |
| Contact | Email address, phone number |
| Customer transaction | Membership details, order and payment status, invoice details (company or full name, tax or Turkish ID number, tax office, invoice address and email), contact form and email correspondence |
| Transaction security | IP address, session and login records, consent records, browser information |
| Marketing | Newsletter subscription and commercial email consent (only if given) |
Card details never reach the Company; payments are processed by iyzico, a licensed payment institution. A Turkish ID number is collected only when an invoice is requested in a person's name, for invoicing. Organisation data (trade name, tax number, etc.) belongs to legal entities and is outside KVKK; for sole proprietorships it counts as personal data and this notice applies.
3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Setting up membership, managing the account, publishing the profile | Formation and performance of a contract (5/2-c) |
| Verifying organisations and reviewing content | Performance of a contract (5/2-c); legitimate interest (5/2-f) |
| Providing paid services, payment and invoicing | Performance of a contract (5/2-c); legal obligation (5/2-ç) |
| Answering questions sent through the contact form or by email | Formation of a contract (5/2-c); legitimate interest (5/2-f) |
| Information security and abuse prevention | Legal obligation (5/2-ç); legitimate interest (5/2-f) |
| Evidence in disputes | Establishing, exercising or protecting a right (5/2-e) |
| Publishing contact persons on an organisation's profile | Explicit consent (5/1) |
| Newsletter and commercial electronic messages | Explicit consent (5/1) and approval under Law No. 6563 |
4. Transfers
Personal data is transferred only for the purposes above, and only to service providers required to run the Platform:
| Provider | Service | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Frankfurt) |
| Vercel | Hosting and content delivery | USA and global servers |
| iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) | Card payments | Türkiye |
| Resend | Sending and receiving email | US company, EU (Ireland) sending region |
Billing partner: For paid service orders, order and invoice details are transferred under KVKK Art. 8, on the grounds of performance of a contract and legal obligation (Art. 5/2-c and 5/2-ç), to BTC Eğitim Danışmanlık Organizasyon Turizm ve Ticaret Limited Şirketi in Türkiye, which collects fees on the Company's behalf, issues invoices and makes refunds where due. BTC is also a data controller for its own invoicing and accounting records, and iyzico for its obligations under payment services law.
The Company itself is established abroad. Cross-border transfers are made under KVKK Art. 9 by concluding the standard contracts published by the Personal Data Protection Board with the parties concerned and notifying the Personal Data Protection Authority within five business days of signature.
Personal data may also be disclosed to competent public authorities and courts where legally required.
5. How data is collected
Electronically and by automated means, through the Platform's registration, profile, order, contact and newsletter forms, emails sent to info@smesatcop31.com and essential cookies.
6. Retention
| Data | Period |
|---|---|
| Membership and profile data | During membership and 2 years after it ends |
| Invoices, orders and payment records | As required by the Tax Procedure Law and Turkish Commercial Code (10 years) |
| Contact form and email correspondence | 2 years from the last message |
| Consent and security records | 2 years |
| Newsletter and commercial message consents | 3 years after withdrawal (consent record); the address is removed from the mailing list on withdrawal |
Data is then deleted, destroyed or anonymised.
7. Your rights (KVKK Art. 11)
You may learn whether your personal data is processed and request information about it; learn the purpose of processing and whether data is used accordingly; know the third parties to whom it is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under the conditions of Art. 7; request that these actions be notified to third parties to whom data was transferred; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
8. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may apply:
- in writing, with a wet-signed letter or through a notary, to our representative's address in Türkiye above, or
- by email to info@smesatcop31.com from the email address registered in our system,
stating your name, surname, Turkish ID number (for foreigners: nationality and passport number), a postal or email address for notifications, and your request. Applications are concluded free of charge as soon as possible and within 30 days at the latest. Where the action requires an additional cost, a fee may be charged according to the tariff set by the Board.