Legal
Data Protection Notice (KVKK)
Last updated: 25 October 2026
What is this notice for?
Packageturk Ambalaj San. ve Dış Tic. Ltd. Şti. (the "Company") processes the personal data of PackPrice users as data controllerunder Turkish Law No. 6698 on the Protection of Personal Data (the "Law"). This notice fulfils the duty to inform under Article 10 of the Law: it explains which data we process, why, on which legal basis and to whom we transfer it. It is an information notice; it does not depend on your approval or consent.Where processing relies on explicit consent (rows marked "Explicit consent" below), your consent is requested separately, in a separate text.
1. Identity of the Data Controller
- Legal name: Packageturk Ambalaj San. ve Dış Tic. Ltd. Şti.
- MERSİS: 0719-0575-5080-0001
- Tax office / no.: Beyoğlu Vergi Dairesi / 7190575508
- Address: Teknopark İstanbul Cube Beyoğlu, Şehit Muhtar Mah. Mis Sk. No:24 İç Kapı No:28 Beyoğlu / İstanbul 34435
- Phone: +90 531 836 76 32
- E-mail: packageturk@packageturk.com
- KEP: packageturk@hs01.kep.tr
2. Who does it cover?
- Users: people who open an account or pre-register, and the company employees who use those accounts.
- Visitors: people who browse the website or fill in the contact form.
- Our customers' customers: the buyer-contact details our users write into their quote and work-order documents. For that data our user is the controller and we are the processor under the Data Processing Agreement.
3. Data Processed, Purposes and Legal Bases
Article numbers in the legal-basis column refer to Article 5 of the Law. Your card details never reach us; they are processed only in the payment provider's environment.
| Data | How it is collected | Purpose | Legal basis | Recipients |
|---|---|---|---|---|
| Identity: first and last name | Sign-up form (web or app) | Opening the account, identifying the user, communication | Formation and performance of the contract (Art. 5/2-c) | AWS (hosting), Supabase (web form), Resend (e-mail) |
| Contact: e-mail address, mobile phone | Sign-up form | Delivering login details and the security code, transactional notifications, support | Formation and performance of the contract (Art. 5/2-c); Legal obligation (Art. 5/2-ç) for invoice notifications | Resend (e-mail), Twilio (SMS verification), AWS, Supabase |
| Company details: company name, sector, position, size, city; for quote documents the company address, tax no./office, company phone and e-mail | Sign-up form and profile screen (only what you enter) | Generating quote and work-order documents, invoicing | Formation and performance of the contract (Art. 5/2-c); Legal obligation (Art. 5/2-ç) for invoicing | AWS; the payment provider that issues the invoice (iyzico or Paddle) |
| Finance: the bank/IBAN details you enter for your own collections; subscription plan, purchase history, credit movements; card brand and last four digits | Profile screen; checkout (card data never reaches us) | Document generation; running the subscription; accounting and statutory records | Formation and performance of the contract (Art. 5/2-c); Legal obligation (Art. 5/2-ç) (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253: 10 years) | AWS; iyzico (₺), Paddle (USD), Apple / Google (in-app purchases) |
| Security: IP address, device and browser information, session and access logs | Automatically while you use the site or app | Account security, preventing abuse and bot traffic, troubleshooting | Legitimate interest (Art. 5/2-f); Legal obligation (Art. 5/2-ç) for records required by law | AWS, Vercel, Supabase; Google reCAPTCHA (forms only) |
| User content: chat messages (product description, dimensions, quantity, material), calculation inputs and results, saved pricing preferences, files and images you upload, your company logo | Entered by you | Price estimation and cost calculation, quote document generation (the service itself) | Formation and performance of the contract (Art. 5/2-c) | AWS; Anthropic (USA) for the chat assistant; EVREN — Presidency of Defence Industries of Türkiye (Türkiye; customer names and contact details masked) for content-safety screening, intent classification, knowledge-base search and reading price-list images |
| Chat message text (customer names and contact details masked; price/cost results removed) | App and web dashboard — only messages sent AFTER the company administrator enables the contribution and you additionally give explicit consent | Optional contribution to the development of packaging-specific Turkish AI models on domestic infrastructure | Explicit consent (Art. 5/1) | EVREN (Presidency of Defence Industries — SSYZ), Türkiye |
| 3D mockup: the images and logos you wrap onto the box, the model and dimensions you choose; on our server only a session record (model, dates, credit movement, number of exports) | Uploaded by you; images are processed only in your browser/device and are not sent to our server. Sole exception: the 3D box file (GLB) created when you start the AR view on Android | 3D preview of the packaging, PNG/SVG export and augmented reality (AR) view; deducting and refunding usage credits | Formation and performance of the contract (Art. 5/2-c) | Images are not transferred to anyone. Android AR file: AWS (EU/Frankfurt), 15 minutes |
| Voice recording (if you use voice typing) | Microphone, only when you start it | Instant transcription to text; the recording is not stored, only the text is written to your conversation | Formation and performance of the contract (Art. 5/2-c) | OpenAI (USA) — instant processing |
| Contact form: name, e-mail, subject, message | Website contact form | Answering your request | Legitimate interest (Art. 5/2-f) (pre-contractual request) | Supabase, Resend |
| Campaign attribution: utm parameters in the address bar and, if present, the Meta click identifier (fbclid) | Automatically, only if you arrived via an ad or search link | Understanding which campaign your registration came from | Legitimate interest (Art. 5/2-f) | Our own record only; not sent to third parties |
| Website analytics cookies (Google Analytics): pseudonymous browser ID, IP, page views | Cookies; only if you consent to the "analytics" category in the banner | Usage statistics | Explicit consent (Art. 5/1) | Google — see Cookie Policy |
| Ad measurement: Meta Pixel cookies (_fbp/_fbc) and, when you pre-register, a server-side registration report to Meta — SHA-256 hash of e-mail and phone, IP, browser information, Meta click ID | Cookies + server report; only if you consent to the "ad measurement" category in the banner | Measuring whether Facebook/Instagram ads result in registrations; showing ads to relevant people | Explicit consent (Art. 5/1) — can be withdrawn at any time via Cookie Preferences | Meta Platforms Ireland Limited (Ireland/USA) — name, company and in-app data are NOT sent |
4. Transfer of Personal Data
Your data is transferred only for the purposes in the table above, to the extent necessary for that purpose, and to these recipient groups: infrastructure and hosting providers (Amazon Web Services — EU/Frankfurt; Supabase and Vercel for the website), AI providers (Anthropic — chat assistant; OpenAI — voice typing; EVREN — domestic content-safety screening, intent classification, knowledge-base search and price-list reading), communication providers (Resend — e-mail; Twilio — SMS verification), payment providers (iyzico, Paddle, Apple, Google), measurement and security providers (Google reCAPTCHA; with your consent Google Analytics/Ads and Meta Pixel) and, on request, competent public authorities. The current list and the data each provider processes are on the Sub-processors page. Your data is never transferred to anyone for the purpose of selling data. Data is transferred to EVREN for model-development purposes only for accounts where the company administrator has enabled the contribution and the user has additionally given explicit consent, and only for messages sent after consent.
Transfers abroad (Art. 9 of the Law): Anthropic, OpenAI, Resend and Twilio are established in the United States; Paddle in the United Kingdom; Supabase, Vercel, Google and Apple in the EU and/or the USA. These transfers are carried out pursuant to subparagraph (c) of the fourth paragraph of Article 9 ("existence of a standard contract"), within the framework of standard contractual clauses and data processing agreements, solely for the purpose of providing the service. Meta Platforms Ireland Limited, to which data is transferred for ad measurement, is established in Ireland and may process the data at its group companies in the USA; that transfer is not necessary to provide the service, relies solely on your explicit consent and stops when consent is withdrawn. Our application server and database are located in the European Union (Frankfurt) region. EVREN (Presidency of Defence Industries of Türkiye) is established in Türkiye and processes data domestically; that processing is not a transfer abroad. Data within the model-development contribution is likewise processed only in Türkiye.
5. Method of Collection
Your data is collected electronically: entered by you in the sign-up, profile and contact forms and the chat screen on the website and mobile app, and automatically while you use the site/app (IP, device, session logs, and cookies with your consent). No data is purchased from third parties.
6. Retention Periods
- Account and user content: for as long as your account is open. When you delete your account, personal data is deleted or anonymised (Data Deletion).
- Invoice and payment records: 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253).
- Access and security logs: for the limited period the security purpose requires; records that the law requires us to keep, for the statutory period.
- Voice recording: not stored; deleted as soon as it is transcribed.
- 3D mockup images: not stored on our servers. Your draft is kept only in your own browser/device for 24 hours and then deleted automatically. The Android AR file stays on our server for at most 15 minutes and is then deleted automatically. The mockup session record is kept with your account data as a credit movement.
- Campaign attribution: 30 days in your browser; with your registration as account data.
7. Anonymisation and AI Model Development
To improve our price-estimation model we use calculation inputs and outputs only in anonymised or aggregated form. Anonymisation irreversibly removes the elements that identify you; under Article 28 of the Law, anonymous data is not personal data. Names, e-mail addresses, company identity and contact details are never used in model training in identifiable form. Under the enterprise terms of the providers we use for chat and voice typing (Anthropic, OpenAI), your data is not used to train their models.
Optional contribution to domestic AI development (explicit consent): if your company administrator enables the contribution in Settings and you additionally give explicit consent, the text of your chat messages sent after your consent — with customer names and contact details masked and price/cost results removed — may be used on the EVREN domestic infrastructure (Presidency of Defence Industries — SSYZ) to develop packaging-specific Turkish models. Masking is not anonymisation; the legal basis is explicit consent under Article 5/1 of the Law. Without your consent none of your chat data is used for this purpose; you may withdraw consent at any time.
8. Your Rights and How to Apply
You may exercise your rights under Article 11 of the Law (to learn whether your data is processed, to request information, rectification and erasure, to know the third parties it is transferred to, to object to a result produced exclusively by automated analysis, and to claim compensation for damage) in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, through:
- Written application: Teknopark İstanbul Cube Beyoğlu, Şehit Muhtar Mah. Mis Sk. No:24 İç Kapı No:28 Beyoğlu / İstanbul 34435
- E-mail: packageturk@packageturk.com (from the e-mail address registered in our system)
- KEP: packageturk@hs01.kep.tr
- Account and data deletion: Data Deletion Form
Your application is concluded free of charge within 30 days at the latest from the date it reaches us.
You may withdraw the explicit consent given for the model-development contribution in Settings; withdrawal applies going forward and a right-to-be-forgotten request is forwarded to EVREN.
See also the Cookie Policy for cookies and the Privacy Policy for a detailed description of the data the product collects.
This English text is a translation provided for convenience. The Turkish version of this document is the legally binding text; in the event of any discrepancy, the Turkish version prevails.