KVKK Privacy Notice

1. Data controller, contact details, and party roles

For direct processing activities relating to MorfUno accounts, payments, support, security, and platform use, the data controller under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) is Grafikit Bilişim ve Lojistik San. Tic. Ltd. Şti. MERSIS No.: 0411100216100001; Sarıgazi Tax Office, Tax No.: 4111002161. Address: Şerifali Mah. İbrahim Hakkı Sok. No: 29, 34775 Ümraniye / İstanbul, Türkiye. Email: [email protected]. Telephone: 0 850 303 27 58.

Alpaslan Naipli is the authorized contact for KVKK requests. The authorized contact is not the data controller; the company as a legal entity is the data controller. The company currently has no KEP address and is not registered with VERBIS.

When a print business determines why its customer’s name, contact, order, artwork, or personalization data is processed, that print business is the data controller for that processing. Grafikit Bilişim ve Lojistik San. Tic. Ltd. Şti. acts as a processor to the extent that it follows the print business’s documented instructions, while remaining a controller for its own account, payment, support, security, and platform obligations.

2. Data subjects and data categories

• Business users and administrators: identity, contact, business, role, access, activity, and audit records.
• Customers using an order link: order verification, uploaded file and metadata or personalized-product text/date values, preview, confirmation, and processing status.
• Website visitors and support requesters: language preference, essential cookie, security record, and submitted contact details.
• Other people represented in a file: content that may appear in artwork, an image, or a document uploaded by a user.

3. Processing purposes

• Operate business accounts, roles, payment-gated operational access, and identity verification.
• Create product-linked orders and provide the order-code, upload, preview, and customer-confirmation flow.
• Send a private production-preparation job to an authorized integration and provide the secure customer-safe result.
• Maintain information security, transaction integrity, error investigation, abuse prevention, and auditability.
• Resolve support, request, complaint, and data-subject applications.
• Meet contractual and statutory duties and establish, exercise, or protect legal rights.

4. Collection methods and legal grounds

• Data is collected automatically, partly automatically, or physically through website and panel forms, the Google identity response, order links, file uploads, customer approval actions, system and security records, private integrations, and communication channels.
• Accounts, orders, file uploads, previews, and service delivery rely on processing directly related to entering into or performing a contract.
• Billing, accounting, competent-authority requests, and responding to data-subject applications rely on meeting the data controller’s legal obligations.
• Order and artwork confirmations, activity records, complaints, and dispute records rely on establishing, exercising, or protecting a right.
• Session security, access logs, abuse prevention, error investigation, and service reliability rely on the controller’s legitimate interests without harming the data subject’s fundamental rights and freedoms.
• Users are not asked to upload sensitive personal data. If a separate activity requires explicit consent, consent is requested separately from this notice and in advance for a specific purpose, and can be withdrawn.

5. Transfer purposes and recipient groups

Data may be disclosed, only for the stated purpose, to the print business managing the order, hosting and technical infrastructure suppliers, Google identity services when selected by the user, an authorized private production integration, legal and financial advisers, and competent public authorities. Each recipient receives only the minimum data required for its role.

MorfUno USA - Grafikit LLC currently has no operational role in running the MorfUno platform and does not, in that capacity, access or process MorfUno customer or order data. The US address on the contact page is corporate contact information only.

Where an international transfer is necessary, no transfer will take place unless an applicable adequacy decision, appropriate safeguard, or incidental-transfer condition under the current Article 9 of the KVKK is in place.

6. Retention

Uploaded print files remain accessible for the 15-, 30-, or 60-day file-retention period stated in the business’s active plan. This period is the file-availability commitment included in that plan.

Order, account, customer-confirmation, support, and security records are retained while their processing purpose, contractual necessity, statutory retention duty, limitation period, or potential dispute period continues. Category-specific periods for print-business integration orders will be determined when the operating model is finalized and this notice will then be updated. Data whose processing ground has ended is deleted, destroyed, or anonymized under Article 7 of the KVKK; verified requests are assessed separately under Article 11.

7. Your rights under Article 11 of the KVKK

• Learn whether your personal data is processed and request information if it is.
• Learn the purpose of processing and whether the data is used for that purpose.
• Know the third parties in Türkiye or abroad to whom data is transferred.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction under the conditions in Article 7 of the KVKK.
• Request notice of correction, deletion, or destruction to third parties who received the data.
• Object to a result against you produced exclusively through automated analysis.
• Claim compensation if you suffer damage due to unlawful processing.

8. How to submit a request

Include your full name, signature for a written request, Turkish identity number or passport/identity number for non-citizens, service address, available email and telephone details, the subject of your request, and information that verifies the request. You may deliver or post a signed written application to the address below. An email application may be sent to [email protected] only from an address you previously notified to the company and that is registered in our systems. The company currently has no KEP address.

Applications are answered free of charge as soon as possible and no later than 30 days, depending on the request. If the process creates an additional cost, the fee in the Personal Data Protection Board tariff may be requested. Statutory complaint and court remedies remain available.