Privacy Notice

1. Data controller

The data controller for personal data processed in connection with membership, payments and support is the business that provides the BirSitem service. The business and contact details are given at the end of this page.

2. Data controller and data processor roles

For messages sent through the contact form of a site built with BirSitem, and for the visit counts of that site, the data controller is the Member who owns the site. BirSitem acts as a data processor that processes this data only on the Member’s behalf and for the purpose of providing the service.

For any request concerning a message you sent to a customer site, you should first contact the owner of that site.

3. Personal data we process

We process the following data when providing the service:

• Identity and contact: full name, email address, phone number (optional)
• Account security: an irreversible hash of your password, sign-in times, number of sign-ins and the IP address of your last sign-in
• Site content: the text you write on your site, the images you upload, your domain name and site settings
• Payments: the selected plan, the amount and the sender name given in the bank transfer (Havale / EFT) notification (card details are not processed)
• Support: the name, email address and message you enter in the support form
• Contact form messages (on behalf of customer sites): the sender’s name, phone number or email address, and message
• Visit statistics (on behalf of customer sites): page view counts; a daily, irreversible hash of IP address and browser information used to count unique visitors
• Preferences and consents: your notification preferences and the records of your agreement and cookie consents

4. Purposes of processing and legal grounds

Your data is processed on the following legal grounds set out in Article 5 of the KVKK:

• Establishment and performance of a contract (Art. 5(2)(c)): opening your account, publishing your site, activating plans and responding to support requests
• Legal obligation (Art. 5(2)(ç)): legal retention obligations and obligations to provide information to competent authorities
• Legitimate interest (Art. 5(2)(f)): account security, prevention of abuse and fake registrations, and improvement of the service
• Explicit consent (Art. 5(1)): analytics cookies, which run only if you give your consent

5. Transfer of data

Your data is shared with the following service providers only to the extent necessary to provide the service. Since some of these providers have servers located outside Türkiye, data may be transferred abroad within the framework of Article 9 of the KVKK.

• Database, authentication and file storage: Supabase (European Union, Frankfurt)
• Hosting and content delivery network: Vercel
• Email delivery: Zoho (European Union)
• Bot protection: Cloudflare Turnstile
• Analytics (only if you consent and it is enabled): Google Analytics
• Competent public authorities and institutions, where required by law

6. Retention periods

Your account and site data are kept for as long as your membership continues. A site or account you delete is kept for 7 days so that it can be restored; at the end of this period, your data is permanently deleted, except for records covered by our legal retention obligations.

Unique visitor hashes are deleted after 40 days, dashboard notifications after 90 days and sent email queue records after 30 days.

7. Data security

Your data is transmitted over an encrypted connection (TLS). Row-level access rules are enforced in the database: each member can access only their own data. Passwords are stored in irreversible form, and two-step verification with an email code is offered at sign-in.

8. Cookies

Our website uses necessary cookies that keep you signed in. Analytics cookies run only if you give your consent. Details are provided in the Cookie Policy.

9. Your rights

Under Article 11 of the KVKK, you have the right to:

• learn whether your personal data is processed and, if so, request information about it
• learn the purpose of the processing and whether the data is used in line with that purpose
• know the third parties in Türkiye or abroad to whom your data is transferred
• request the correction of incomplete or inaccurately processed data
• request the deletion or destruction of your data under the conditions set out in the KVKK
• object to an outcome to your detriment arising from analysis by automated systems
• claim compensation for damages you suffer as a result of unlawful processing

10. How to submit a request

You can submit your requests through the support form or by writing to iletisim@birsitem.com. Your request will be resolved free of charge within 30 days at the latest. If you find our response insufficient, you may file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

11. Updates

We may update this notice in line with changes to the service or to the legislation. The current version is always published on this page.