Privacy policy and KVKK notice

This notice is issued by [Company legal name] (“Era”, “we”) as data controller under Article 10 of Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) and, for visitors from the European Union, the GDPR.

1. Data controller

[Company legal name], MERSİS: [MERSİS number], address: [Full address], İstanbul, Türkiye. Contact: [email protected]. VERBİS registration: [number / exemption].

2. Our two roles

As controller we process your data when you visit getera.io, open an account, write to us or pay for a subscription. This notice covers that processing.

As processor: businesses use Era with their own customers’ data (bookings, orders, messages…). That business is the controller; we process on its instructions. See our data processing summary.

3. Data we process

• Identity and contact: name, email, phone, business name.
• Account and usage: sign-in records, IP address, browser data, activity logs.
• Billing: invoice details, tax number, payment status (we do not store card data; the payment provider does).
• Requests and correspondence: support and contact form content.
• Marketing: commercial message preferences, with your consent.
• Cookies: as listed in our cookie policy.

4. Purposes and legal bases

Purpose	Legal basis (KVKK Art. 5 / GDPR Art. 6)
Opening your account and providing the service	Performance of a contract
Invoicing, accounting, tax duties	Legal obligation
Security, abuse prevention, logging	Legitimate interest; legal obligation
Answering support requests	Contract; legitimate interest
Improving the product (aggregate, anonymous statistics)	Legitimate interest
Sending commercial messages	Consent (Law No. 6563 and İYS)

5. Transfers

We share data only as the service requires — with hosting, email, payment, support and (when you choose to use them) AI providers. Current list: Subprocessors. Transfers abroad follow KVKK Article 9 using the Board’s standard contractual clauses and notification to the Board, and the GDPR’s safeguards where it applies. We disclose data to authorities only where the law requires it.

6. Retention

Account data for as long as your account is open and afterwards for the statutory limitation periods; invoices and accounting records for 10 years under the Tax Procedure Law and the Commercial Code; access logs for the period required by law. When a period ends, data is deleted, destroyed or anonymised.

7. Your rights

You may ask whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the recipients, request correction or deletion, ask that recipients be notified, object to an adverse outcome of automated analysis and claim compensation for damage. EU users also have the GDPR rights of access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority.

8. How to apply

Send your request with details that let us verify your identity to [email protected], by registered email (KEP) to [KEP address], or in writing to [Full address], İstanbul, Türkiye. We answer free of charge within 30 days.

9. Changes

When we update this notice we change its date and tell account holders about material changes by email.