Personal Data Protection Law
1. Purposes of Processing Personal Data
Your personal data is processed for the following purposes:
• Execution and provision of portfolio management, spot and futures trading, arbitrage, and portfolio protection services
• Realization of order transmission and automation processes (signal generation, order processing, dynamic stop-loss applications)
• Establishment and performance of the contract with the customer, and management of customer relationships
• Monitoring open positions, evaluating risk and volatility exposure, and verifying position accuracy
• Ensuring system security, as well as detecting and preventing unauthorized access and fraud attempts
• Establishing and maintaining trading connections through exchanges, data providers, and relevant API integrations
• Personalized fund reporting and application of customer-preferred risk criteria
• Fulfillment of legal obligations (including tax, accounting, capital markets legislation, and obligations under relevant regulatory bodies)
• Responding to requests from authorized public institutions and organizations, and conducting legal processes
• Operation, improvement, and enhancement of user experience on the Site
2. Method and Legal Basis for Personal Data Collection
Your personal data is collected via electronic and/or physical channels through methods such as contact/application forms on the Site, customer contracts and annexes, Know Your Customer (KYC) processes, API integrations established with exchanges and data providers, call center/email correspondence, and log records automatically generated during your use of the Site.
This data is processed based on the following legal bases specified in Articles 5 and 6 of the KVKK:
• Direct necessity for the establishment or performance of a contract (establishment and execution of the portfolio management agreement)
• Obligatory requirement for the Company to fulfill its legal obligations (tax, accounting, capital markets legislation, etc.)
• Data processing being mandatory for the establishment, exercise, or protection of a right
• Data processing being mandatory for the legitimate interests of the Company, provided it does not harm the fundamental rights and freedoms of the data subject (system security, fraud prevention)
• Express provision in laws
• Your explicit consent for processing activities outside these scope requirements that require explicit consent (e.g., marketing communications)
3. Transfer of Personal Data
Your personal data may be shared with the following parties in accordance with the conditions set out in Articles 8 and 9 of the KVKK and limited to the purposes specified in this Text:
• Exchanges, brokerage firms, and data providers with which API integrations are established for order transmission and transaction execution
• Cloud and IT system infrastructure providers utilized for hosting infrastructure
• Courts, regulatory and supervisory authorities, and other public institutions and organizations requesting information/documents within their legal authority
• Independent audit, legal, and financial advisory firms providing services to the Company
If personal data needs to be transferred abroad due to exchange and data provider integrations, this transfer will be carried out within the framework of Article 9 of the KVKK and the methods determined by the Personal Data Protection Board (explicit consent, list of countries with adequate protection, or commitment to appropriate safeguards).
4. Data Security
The Company takes necessary technical and administrative measures to ensure an appropriate level of security in order to prevent unlawful processing of personal data, prevent unauthorized access to these data, and preserve personal data. Specifically, in this scope:
• Encrypted storage of sensitive data (including API keys and account details)
• Use of enterprise-grade cloud infrastructure configured under the "Zero-Trust" principle with strict authorization and access controls
• Implementation of regular data backups
• Execution of 7/24 real-time system monitoring and internal warning mechanisms for early detection of market anomalies, transaction delays, or potential security threats
• Informing personnel regarding data security and subjecting them to confidentiality obligations
• Conducting regular audits and tests to detect security vulnerabilities. Despite all these measures, it is explicitly acknowledged that absolute security cannot be guaranteed over the internet; in the event of a potential data breach, notification obligations stipulated by legislation will be fulfilled.
5. Personal Data Retention Period
Personal data is retained in accordance with the duration specified in relevant legislation if one exists, or for the period required by the processing purpose if no specific duration is defined. Subject to mandatory retention periods required by capital markets legislation, the Tax Procedural Law, and the Turkish Commercial Code, customer transaction and financial records are generally maintained throughout the statutory limitation periods following the termination of the contractual relationship.
Upon expiry of the designated retention period or the resolution of processing purposes, personal data is deleted, destroyed, or anonymized ex officio or upon request in accordance with Article 7 of the KVKK and the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.
6. Your Rights Under KVKK
Pursuant to Article 11 of the KVKK, you may exercise the following rights by applying to the Company:
• Learn whether your personal data is being processed
• Request information if your personal data has been processed
• Learn the purpose of processing your personal data and whether it is used in accordance with its purpose
• Know the third parties to whom your personal data is transferred domestically or abroad
• Request the correction of your personal data if it is incomplete or incorrectly processed
• Request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the KVKK
• Request notification of operations regarding correction, deletion, and destruction to third parties to whom your personal data has been transferred
• Object to the occurrence of a result against you by analyzing processed data exclusively through automated systems
• Request compensation for damages in the event that you suffer damage due to unlawful processing of your personal data