KVKK Privacy Notice

1. Data Controller

In accordance with the Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Baksora Teknoloji Limited Şirketi ("Company" or "Baksora") as the data controller within the scope explained below. The Company is registered with the Kastamonu Tax Office, with tax identification number 1330956531 and MERSIS number 0133095653100001.

2. Personal Data Processed

The following personal data is processed by our company:

• Identity Information: Name, surname, national ID number (for users in Türkiye)
• Contact Information: Email address, billing address, city, country
• Financial Information: Billing details, payment records (card details are not stored by the Company; processed by iyzico payment infrastructure in compliance with PCI DSS standards)
• Transaction Security Information: IP address, browser information, GeoIP location data (automatically detected for country-based pricing)
• Service Usage Information: Project data, AI credit usage, export records

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Providing BaksPro AI project writing services and fulfilling contractual obligations
• Providing AI-powered grant project proposal writing assistance for Erasmus+, Horizon Europe, TÜBİTAK, Interreg and national grant programmes (via advanced language models)
• Providing EU policy research and academic resource scanning services
• Processing payment transactions through iyzico secure payment infrastructure
• GeoIP-based location detection for country-based pricing
• Fulfilling legal obligations and invoicing
• Improving service quality and managing customer relations

4. Transfer of Personal Data

Your personal data is shared in accordance with Articles 8 and 9 of KVKK and only to the extent necessary to provide the service: with the payment institution iyzico Ödeme Hizmetleri A.Ş. (Türkiye) for processing payments - your card details are not stored by the Company but processed by iyzico in compliance with PCI DSS standards. Apart from this, your personal data is NOT transferred to artificial intelligence, infrastructure, analytics, error-monitoring, email, or other third-party service providers, and is not shared with third parties for marketing purposes. The main application and your personal data are hosted in Türkiye (Izmir data center); your personal data is not transferred abroad. Sharing with authorized public institutions may occur only upon request within the scope of legal obligations.

5. Method and Legal Basis of Data Collection

Your personal data is collected through our website (bakspro.com) during registration, purchase, and project creation processes, using automatic or non-automatic methods. Country information is automatically detected via IP address. Legal bases:

• Establishment or performance of a contract (project kit sales and AI service delivery)
• Fulfillment of legal obligations (invoicing, tax legislation)
• Our legitimate interests (service quality improvement, security)
• Your explicit consent (marketing communications)

6. Data Subject Rights

You have the following rights under Article 11 of KVKK:

• Learning whether your personal data is processed
• Requesting information if your personal data has been processed
• Learning the purpose of processing personal data and whether they are used appropriately
• Knowing the third parties to whom personal data is transferred domestically or abroad
• Requesting correction if personal data is incomplete or incorrectly processed
• Requesting deletion or destruction of personal data under the conditions set forth in Article 7 of KVKK
• Objecting to a result that arises against you through the analysis of processed data exclusively by automatic systems
• Claiming compensation for damages if you suffer damage due to unlawful processing of personal data

7. Application Method

To exercise the above rights, you can send an email to bakspro@baksora.com or submit your written application to our company address. Your applications will be finalized within 30 days at the latest.

8. Changes

This privacy notice may be updated in line with legal regulations and changes in company policies. The current text will always be published on our website.