Privacy Notice (KVKK)

Last updated: [date]

This notice explains which personal data BDK Panel processes, why, and what rights you have under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies, other data protection laws.

Data controller

[Company name / owner name], [address], [contact email]. [Registration details, e.g. VERBIS, to be confirmed by the owner.]

What we store

Account: your name, email address, your password as a one-way hash (we cannot read it), your balance currency and account settings.
Orders: the service, quantity, price, the public username or post link you ordered for, and the order's status history.
Balance history (ledger): every change to your balance (orders, refunds, top-ups, manual corrections) with date and amount.
Sessions: a session cookie, plus the IP address and browser type (user agent) of the session.
Security and rate limiting: IP addresses, used to limit repeated requests (for example sign-in attempts and profile lookups) and to prevent abuse.

We do not ask for or store the passwords of your social media accounts.

Profile previews

When you type a username in the order form, we fetch that account's public profile (name, photo, follower count) from the platform to show you a preview. The result is kept in server memory for at most one hour and is not stored in the database. The preview photo may be loaded through a third-party image service (unavatar.io).

Why we process it (legal basis)

To create and run your account and deliver your orders (performance of a contract, KVKK art. 5/2-c).
To keep accurate balance and payment records (legal obligation, art. 5/2-ç).
To protect the site against fraud and abuse (legitimate interest, art. 5/2-f).

Who receives it

Suppliers that deliver orders receive only the username or post link and the quantity — never your name or email.
Hosting and network providers: the site runs on a server at [hosting provider, location] and is served through Cloudflare, which may process connection data (such as IP addresses) outside Türkiye. [Cross-border transfer basis under KVKK art. 9 to be confirmed by the owner.]
Payment providers, once payment methods are available, receive the data needed to process a payment. Card details are entered on the payment provider's page and never reach us.
Authorities, when the law requires it.

Cookies and browser storage

We use only what the site needs to work: a session cookie to keep you signed in, a locale cookie that remembers your language, and browser session storage that keeps an unfinished order while you sign in. We do not use advertising or analytics cookies.

How long we keep it

Account and order data are kept while your account is open. Balance and payment records are kept for the period required by tax and commercial law. [Exact retention periods to be set by the owner.]

Your rights (KVKK art. 11)

You can ask us whether we process your data, get a copy of it, ask for it to be corrected or deleted, learn who it was shared with, object to automated decisions that affect you, and claim compensation for damage caused by unlawful processing. Send your request to [contact email]. We answer within 30 days.