Privacy Notice
Contents
- Who we are (data controller)
- Categories of personal data we process
- Why we process it
- How we collect it and our legal basis
- Who we share it with
- International data transfers
- How long we keep it
- Security measures
- Your rights
- How to reach us
- Changes to this notice
1. Who We Are
| Legal name | Yula Bilgi Teknolojileri Sanayi ve Ticaret İthalat İhracat Limited Şirketi |
|---|---|
| Address | Akasya Mah. 170. Sk. No: 1 İç Kapı No: 117 Antakya/Hatay, Türkiye |
| Tax office / tax ID | Şükrü Kanatlı Vergi Dairesi / 9840322759 |
| MERSİS No. | 0984032275900010 |
| Trade Registry No. | 13916 (Hatay Trade Registry Directorate) |
| Phone | +90 212 909 06 08 |
| info@babbagedigital.com | |
| Registered electronic notification address (KEP) | 25969-51004-27707 |
| Website | babbagedigital.com |
In this notice, "Babbage Digital", "the Company" or "we" refers to Yula Bilgi Teknolojileri Sanayi ve Ticaret İthalat İhracat Limited Şirketi. "Platform" refers to the feed management, creative/video studio, AI-assisted ad management, automation and Telegram notification services offered at babbagedigital.com.
2. Categories of Personal Data We Process
| Category | Examples | Collected via |
|---|---|---|
| Identity | First and last name, Turkish national ID number (for individual invoicing, where legally required) | Registration / checkout form |
| Contact | Email, phone, billing/store address | Registration form, support requests |
| Customer / account | Store name, domain, e-commerce platform, selected package, usage records | Registration form, panel usage |
| Financial | Invoice amount, exchange rate, VAT, payment status, company name/tax office/tax number (corporate accounts) | Checkout / billing process |
| Security | Irreversibly hashed password, session cookie, IP-based access record, two-factor (email OTP) record, activity/audit log (who did what, when) | Panel usage, security infrastructure |
| Marketing (only with your explicit consent) | Campaign/announcement preferences | Separate opt-in, if given |
| Visual/audio | Product images you upload (not expected to contain personal images; if it does, responsibility lies with the uploading user) | Platform usage |
We never see, process or store your payment card details (card number, expiry, security code). Payment is taken directly through the secure payment screen of PayTR Ödeme Kuruluşu A.Ş., which operates under PCI-DSS standards.
3. Why We Process Your Data
- To form and perform your subscription agreement
- To bill, collect payment for, and keep accounting records of your selected package (as required by Turkish tax law)
- To keep your account and the panel secure (authentication, two-factor verification, detection and prevention of unauthorized access)
- To provide the support you request
- To run AI-assisted features you choose to use (creative generation, campaign suggestions, chat assistant, etc.)
- To comply with our legal obligations and respond to lawful requests from public authorities
- To measure service quality, fix issues, and improve the Platform
- To send you marketing communications, but only where you have given separate, explicit consent
4. How We Collect It and Our Legal Basis
We collect your personal data through forms on our website and panel, the registration/checkout flow, support requests, and your use of the panel, automatically or semi-automatically in electronic form. Under Turkish law (KVKK Art. 5(2) — analogous to GDPR Art. 6(1)), we rely on:
- Performance of a contract — establishing and running your subscription;
- Legal obligation — issuing invoices, complying with tax law, responding to authorities;
- Establishment, exercise or defense of legal claims;
- Our legitimate interests — service security, fraud/abuse prevention, monitoring service quality;
- Your explicit consent — only where the above do not apply (e.g., some international transfer scenarios and marketing communications) — see our Explicit Consent Notice.
5. Who We Share It With
- Payment processor: PayTR Ödeme Kuruluşu A.Ş. — to process your payment, using card details you enter directly.
- Hosting and infrastructure providers: the servers/databases where the Platform and your data are hosted.
- AI and cloud processing providers: depending on the features you use, providers such as Anthropic and Google (Vertex AI/Gemini) — limited to the data needed to run that specific feature (e.g., a product photo or text). These providers may operate outside Türkiye (notably in the US); see Section 6.
- Advertising platforms: Meta and Google ad APIs — only if and when you connect your own ad account and use the relevant feature, acting on your behalf and under your own authorization.
- Notification infrastructure: Telegram — only through a notification bot you choose to connect.
- Email delivery infrastructure: to deliver account verification, password reset and transactional emails.
- Our accountant/bookkeeping provider and public authorities we are legally required to inform (tax office, courts, regulators).
Where the Platform processes data belonging to your own end customers (e.g., orders, stock data, or your storefront's chat assistant), Babbage Digital acts as your data processor, not as controller of that data; the terms of that relationship are set out in a separate data processing arrangement with each merchant.
6. International Data Transfers
Some of the AI and cloud infrastructure providers listed above are based outside Türkiye, mainly in the United States. These transfers are made in reliance on Turkey's KVKK Art. 9 transfer mechanisms (adequacy, appropriate safeguards such as standard contracts/undertakings, or, where required, your explicit consent). Where explicit consent is legally required for a specific transfer, we ask for it separately — see our Explicit Consent Notice.
7. How Long We Keep It
| Data | Retention period |
|---|---|
| Invoices and accounting records | 10 years, as required by Turkish tax and commercial law |
| Account/membership data | Duration of your subscription, plus applicable statutory limitation periods (generally up to 10 years) |
| Activity/audit logs | Up to 3 years, for security purposes |
| Support request records | 2 years from resolution |
| Consent-based marketing data | Until you withdraw consent |
After these periods, your personal data is deleted, destroyed, or anonymized in line with applicable law.
8. Security Measures
- Passwords are stored as irreversible hashes only — never in plain text.
- Sessions run over HTTPS only, using HttpOnly, secure cookies.
- Sensitive actions (registration, password changes, billing details) are recorded in an activity log that deliberately excludes passwords and billing identity numbers.
- Two-factor authentication (email OTP) is available for admin accounts.
- Card data never reaches our systems; it is handled by our PCI-DSS-compliant payment processor.
- Access is restricted by role (admin vs. client).
9. Your Rights
Under Turkish law (KVKK Art. 11 — broadly similar to GDPR data subject rights), you can contact us to:
- Find out whether we process your personal data;
- Request information about that processing;
- Learn its purpose and whether it's used accordingly;
- Know which third parties, in Türkiye or abroad, it has been shared with;
- Ask us to correct incomplete or inaccurate data;
- Ask us to delete or destroy it, once the legal conditions for doing so are met;
- Ask us to notify third parties we shared it with of any correction, deletion or destruction;
- Object to a decision made about you based solely on automated processing;
- Claim compensation if you are harmed by unlawful processing.
10. How to Reach Us
To exercise these rights, contact us with proof of identity at info@babbagedigital.com, or by post at the address in Section 1. We respond free of charge and, in any case, within 30 days as required by Turkish law; a fee may apply only for requests involving an additional cost, per the tariff set by Turkey's Personal Data Protection Board.
11. Changes to This Notice
We may update this notice to reflect changes in law or in our services. The current version is always published at this address; we will notify you separately of any material change.