Data Protection Notice (GDPR / KVKK)
This notice explains how Nex E-Commerce (“we”) processes personal data of account holders and users of Nex Bazaar AI, in line with Regulation (EU) 2016/679 (GDPR) Articles 12–14 and Turkish Law No. 6698 (KVKK) Art. 10.
1. Controller
| Company | Nex E-Commerce |
|---|---|
| Address | Koza Mah. Kozapark Sitesi Burgaz Blok No:499 Esenyurt / İstanbul |
| Registration | MERSIS — · Tax — — |
| Contact / data protection | 0850 510 34 41 · [email protected] |
For the business data you enter about your own customers, suppliers and employees, you are the controller and we act as processor under your instructions and our subscription terms (including data processing terms available on request).
2. Data we process and why
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Provide the service, manage accounts and subscriptions | Name, email, phone, company and tax details, usage data | Contract (6(1)(b)) |
| Billing, accounting and tax compliance | Invoice, payment and company data | Legal obligation (6(1)(c)) |
| Security, fraud prevention, audit logs | IP address, device/browser data, login events | Legitimate interests (6(1)(f)); legal obligation |
| Support | Messages, account context | Contract; legitimate interests |
| Marketing emails/SMS | Email, preferences | Consent (6(1)(a)) — withdraw at any time |
3. Recipients
Hosting, backup, email/SMS and AI service providers; payment institutions; e-invoice integrators, marketplaces, banks and carriers only when you connect them; public authorities where required by law. Providers act under data processing agreements.
4. International transfers
We are established in Türkiye. Where personal data of individuals in the EEA/UK is transferred to us or onward to providers outside the EEA, we rely on Standard Contractual Clauses (Art. 46 GDPR) or another valid transfer mechanism, together with supplementary measures. Transfers under KVKK Art. 9 follow the Turkish Data Protection Board’s rules.
5. Retention
We keep data only as long as needed for the purposes above and for statutory periods (e.g. accounting and tax records up to 10 years under Turkish law; security logs for the period set by the applicable jurisdiction policy). Afterwards data is deleted or anonymised.
6. Your rights
You may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interests; you may withdraw consent at any time without affecting prior processing. Contact [email protected]; we respond within one month (30 days under KVKK). You may lodge a complaint with your supervisory authority (in Türkiye: the Personal Data Protection Authority – KVKK).
7. Automated decisions
We do not take decisions with legal or similarly significant effects solely by automated means. AI features generate suggestions that you review.