Legal Document

Privacy Notice

Last updated: 23.09.2026

Contents

  1. 1. Data Controller
  2. 2. Personal Data We Process
  3. 3. Purposes of Processing
  4. 4. Legal Bases
  5. 5. Recipients and International Transfers
  6. 6. Retention and Account Deletion
  7. 7. If You Are a Store's Customer
  8. 8. Your Rights

1. Data Controller

This Privacy Notice is issued under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies to you, the EU/UK General Data Protection Regulation ("GDPR"), by the operator of the musterim.net platform (the "Platform"), ANADOLUDAN YÖRESEL ÜRÜNLER SANAYİ ve TİCARET LTD. ŞTİ. (the "Controller", "we" or "us"). Contact: destek@musterim.net — Telephone: 0850 309 4530 — Address: Hasanbey Mah., Hasanbey Cad., 61/B, Gümüşhane, Türkiye — Central Registry (MERSİS) No. 0069119000200001.

We are established in Türkiye and have not appointed a representative in the European Union or the United Kingdom. Requests under this notice can be sent to the e-mail address above.

2. Personal Data We Process

a) Data relating to our Members

  • Identity and contact details: name, e-mail address
  • Account security: irreversible hash of the password, session records, IP address; where two-step verification is enabled, the mobile telephone number, irreversible hashes of verification codes and records relating to the trusted-device flag
  • Subscription and payment records (card details are not stored on the Platform; payments are processed by PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş.), including the billing currency selected at checkout
  • Store connection details (API keys — stored encrypted)
  • Preferred interface language

b) Data relating to our Members' customers

  • Records synchronised from the store: name, telephone number, e-mail address, order details (amount, date, products, coupon codes used)
  • Customer records the Member adds manually to the Platform (for example walk-in or social media customers): name, telephone number, e-mail address and the source note entered by the Member
  • Calculated segments and scores (RFM), generated coupon records
  • Delivery logs: through which channel (WhatsApp / SMS / e-mail), when and with what result a message was sent; records of which customer was told about a campaign through which channel, and bulk SMS queue records. E-mail bodies are not stored; only the recipient, subject and result are kept.
  • E-mail opt-out (unsubscribe) requests and flags marking an e-mail address as invalid under rules defined by the Member

With respect to data relating to our Members' customers — whether synchronised from the store or added manually by the Member — the relevant Member is the controller; the Platform processes that data as processor, on the Member's instructions and solely to provide the service.

3. Purposes of Processing

  • Managing membership and subscriptions and providing the service
  • Securing accounts (including sending two-step verification codes, verifying trusted devices and confirming account deletion requests with a one-time code)
  • Analysing order data to segment customers and generate coupons
  • On the Member's instruction, delivering coupon messages, campaign announcements or e-mails through the Member's own channels, and recording and applying opt-out requests
  • Measuring coupon redemptions to provide the Member with an earnings report
  • Invoicing, payment and accounting
  • Information security, detecting and fixing errors
  • Complying with legal obligations

4. Legal Bases

Under KVKK Article 5/2 we process personal data because it is necessary to conclude and perform a contract, to comply with a legal obligation, or for our legitimate interests. Where the GDPR applies, the corresponding legal bases are Article 6(1)(b) (contract), Article 6(1)(c) (legal obligation) and Article 6(1)(f) (legitimate interests — keeping the Platform secure, preventing abuse and improving the service). We do not rely on consent for the processing described in this notice, except where a Member chooses to enable an optional feature such as two-step verification.

5. Recipients and International Transfers

Personal data is disclosed only to the following recipients, and only to the extent necessary:

  • The hosting provider whose servers we use (Türkiye)
  • PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. for payment processing (Member and subscription data only; no store customer data)
  • The Platform's contracted SMS provider, for delivering two-step verification codes (OTP) (the Member's telephone number and the code text only; no store customer data)
  • Competent public authorities, where legally required

SMS and e-mail messages to customers are sent through the Member's own provider account (its own SMS operator or its own e-mail/SMTP account); the relationship with those providers is directly between the Member and the provider.

Data location. The Platform stores and processes all data on servers located in Türkiye and does not transfer it to any other country. If you are located outside Türkiye — for example in the European Economic Area, the United Kingdom or North America — using the Platform, or being a customer of a store that uses it, means that your data is processed in Türkiye. Türkiye is not currently covered by an EU or UK adequacy decision; Members established in those jurisdictions are responsible, as controllers of their customers' data, for putting in place any transfer safeguards their law requires before connecting a store.

6. Retention and Account Deletion

Member data is processed for the duration of the membership. Data relating to a Member's customers (including manually added records) is processed for as long as the membership or store connection continues. When a store connection ends, the related customer data is deleted or anonymised within a reasonable period.

Members who delete their account. A Member may close its account at any time using the "Permanently delete account" option in the Subscription section of the panel; the request is confirmed with a one-time code sent to the Member's telephone or e-mail address. Upon confirmation, the Member's account and all data held on the Platform — connected store records, customer records, order copies, coupons, campaigns, workflows and delivery logs, verification tokens and e-mail delivery logs — are deleted immediately and irreversibly. Only a single audit record, consisting of the e-mail address and IP address and showing that the account was deleted, is kept for the statutory limitation period as evidence in the event of a dispute. Merely cancelling the subscription (stopping renewal) does not delete data; it is retained until the end of the paid period.

Account deletion covers only data on the Platform; orders, customers, products and previously created coupons in the Member's e-commerce store (WooCommerce) remain unchanged in the store.

7. If You Are a Store's Customer

If you are here because you received a coupon or campaign message or e-mail from a store: the controller of your data is the store you purchased from (or that registered you); the Platform acts only as a processor on that store's instructions. Please direct your requests to the store in the first instance; requests that reach us are forwarded to the relevant store.

If you no longer wish to receive commercial e-mails, use the "unsubscribe" link at the bottom of any e-mail you receive; your request is applied immediately and no further e-mail is sent to you from that store. If you do not wish to receive SMS messages, you can exercise your opt-out right through the Turkish Message Management System (iys.org.tr) where applicable, or by contacting the store directly.

8. Your Rights

Under KVKK Article 11 you have the right to:

  • Learn whether your personal data is processed and request information about it
  • Learn the purpose of processing and whether the data is used in line with that purpose
  • Request rectification of incomplete or inaccurate data
  • Request erasure or destruction of your data
  • Object to a result that is to your detriment and arises from analysis by automated means only
  • Claim compensation for damage suffered as a result of unlawful processing

If the GDPR applies to you, you additionally have the right of access (Article 15), the right to rectification (Article 16), the right to erasure (Article 17), the right to restriction of processing (Article 18), the right to data portability (Article 20), the right to object (Article 21) and the right not to be subject to a decision based solely on automated processing (Article 22). You also have the right to lodge a complaint with the supervisory authority of your place of residence or work, or with the Turkish Personal Data Protection Authority (KVKK Kurumu).

You can send requests to destek@musterim.net; we respond free of charge within 30 days at the latest (within one month under the GDPR, extendable where the law allows). Members can exercise their right to erasure directly, without submitting a request, using the "Permanently delete account" option in the Subscription section of the panel (see Section 6).