1. Data controller
DocPlant Doküman ve Yazılım Hizmetleri Ltd. Şti.
Süleymanbey Sok. No: 6A/10, 34349 Gayrettepe, Beşiktaş / İstanbul
Email: kvkk@vitrinustasi.com
2. Personal data processed
- Identity: first name, last name (if you provide them).
- Contact: email address.
- Customer transaction: shop profile, instructions, prepared images, descriptions, post and approval history, subscription and usage information, support correspondence.
- Visual records: the product photos you send and your logo.
- Finance: invoice title, address and tax details, payment result (card details are not processed).
- Transaction security: IP address, sign-in and session logs, device and app information, Instagram access token.
- Social media account information: Instagram business account ID and username.
No special category personal data is processed.
3. Purposes of processing
Your personal data is processed for the following purposes: carrying out membership and account transactions; preparing product images, descriptions and tags; publishing the posts you approve on your Instagram account; managing team memberships and permissions; carrying out subscription, payment and invoicing processes; answering requests and complaints; carrying out information security processes and preventing misuse; improving the service; providing information to authorised institutions as required by legislation and following up legal processes. Marketing messages are sent only with your explicit consent and your commercial electronic message approval.
4. Legal bases
- Conclusion or performance of the contract (Art. 5/2-c): account, image preparation, publishing, subscription and support.
- Legal obligation (Art. 5/2-ç): invoicing, tax and commercial legislation, requests from authorised authorities.
- Establishment, exercise or protection of a right (Art. 5/2-e): keeping records as evidence in disputes.
- Legitimate interest (Art. 5/2-f): information security, preventing misuse, improving the service.
- Explicit consent (Art. 5/1): only for optional features (for example, preparing video with an external provider) and for marketing messages.
5. Transfers
Your personal data may be transferred, to the extent necessary for the purposes above, to the following groups of recipients: the data centre and hosting providers we receive services from (Dehost, Verisunucu, hosting.com); the email delivery service (SMTP2GO); the payment provider (iyzico) or app stores (Apple, Google); our accountant; Instagram (Meta Platforms) for the posts you approve; and public institutions and organisations authorised by law. The artificial intelligence models that prepare the images run on DocPlant’s own servers in Türkiye; no transfer is made to a third party for this purpose.
6. Transfers abroad
- Instagram (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.): the image and description you approve are transferred to servers abroad in order to be published on your Instagram account. This transfer is made at your request and as it is mandatory for the performance of the contract between us, on an occasional basis within the scope of Article 9/6-b of the KVKK.
- SMTP2GO (email address and sign-in code), hosting.com (website server logs and support emails, Germany): these transfers are made under a standard contract within the scope of Article 9/4 of the KVKK.
- Apple / Google: if you choose an in-app purchase, the payment is processed by the relevant store under its own terms.
7. Method of collection
Your personal data is collected in electronic form, partly by automated means, through the Vitrin Ustası mobile application, the vitrinustasi.com website, email correspondence and the Instagram connection.
8. Retention periods
Original photos and intermediate files are kept for 30 days; approved images and account information for as long as the account is open; transaction security logs for 2 years; invoice and accounting records for 10 years (Article 82 of the Turkish Commercial Code No. 6102, Article 253 of the Tax Procedure Law No. 213). When an account is deleted, the data is deleted, including backups, or anonymised within 30 days, except for data subject to a statutory retention obligation. Data whose period has expired is deleted, destroyed or anonymised.
9. Your rights under Article 11 of the KVKK
By applying to us, you can exercise the following rights:
- to learn whether your personal data is processed and, if it is, to request information about it,
- to learn the purpose of the processing and whether it is used in accordance with that purpose,
- to know the third parties to whom it is transferred domestically or abroad,
- to request that it be corrected if it is processed incompletely or incorrectly,
- to request that it be deleted or destroyed within the framework of the conditions in Article 7 of the KVKK,
- to request that correction, deletion and destruction operations be notified to the third parties to whom it was transferred,
- to object to a result arising against you as a result of analysis exclusively by automated systems,
- to request compensation for the damage if you suffer damage because it is processed unlawfully.
10. How to apply
You can submit your application in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller: from the email address registered to your account to kvkk@vitrinustasi.com, or by a signed petition showing your identity to our postal address above. In your application you must state your name, your contact information and your request clearly. Applications are concluded within 30 days at the latest and free of charge; if the transaction also requires a cost, the tariff set by the Board may be applied. If your application is rejected, if the reply is found insufficient, or if no reply is given within the time limit, you can lodge a complaint with the Personal Data Protection Board. To delete your account, you can also use the Data Deletion page.