KVKK Disclosure Notice

This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) by Kardo Labs Yazılım Anonim Şirketi (“Company”, “Data Controller”) to inform you about the personal data we process in our capacity as a data controller.

1. Identity of the Data Controller

• Legal name: Kardo Labs Yazılım Anonim Şirketi
• Address: EVKA 3 Mah. 119/2 Sk. Standartkent Sitesi No: 4-4 İç Kapı No: 15 Bornova / İZMİR
• MERSIS no: 0524165119400001
• Tax office / no: Bornova V.D. / 5241651194
• Email: hello@kardolabs.com
• Phone: +90 507 598 59 59

2. Personal Data Processed and Purposes of Processing

The Company processes the following personal data of users of the HIT! platform:

• Identity data: first name, last name
• Contact data: email address
• Customer transaction data: subscription details, invoicing details, transaction history
• Transaction security: IP address, session information, log records
• Visual and audio records: videos uploaded by the user for analysis

This data is processed for the following purposes:

• Providing the service and performing content analysis
• Verifying user identity and managing accounts
• Performing contractual obligations (subscriptions, invoicing)
• Conducting communications
• Improving service quality and ensuring security
• Meeting legal obligations (Tax Procedure Code, Commercial Code, and related laws)

3. Legal Basis for Processing

Your personal data is processed under KVKK Article 5(2) on the following legal bases:

• Necessity for the establishment and performance of a contract
• Express provision under law
• Necessity for the data controller to fulfil its legal obligations
• Necessity for the data controller's legitimate interests, provided that fundamental rights and freedoms are not harmed
• Your explicit consent in cases such as video uploads (Article 5/1)

4. Recipients of Personal Data and Purpose of Transfer

Your personal data is transferred only to the following parties under KVKK Articles 8 and 9:

• iyzico Ödeme Hizmetleri A.Ş.: processing of payments
• Google LLC: AI analysis (Gemini API), authentication (Firebase Authentication), and infrastructure services (Google Cloud Platform)
• Authorised public authorities: within the scope of legal obligations

Because some service providers (such as Google and iyzico) are established outside Türkiye, your data may be transferred abroad with the necessary technical and administrative measures under KVKK Article 9.

5. Methods of Collection

Your personal data is collected electronically through your registration on the Platform, your account usage, your video uploads, and your communications with us.

6. Your Rights under KVKK Article 11

Under Article 11 of KVKK, you may apply to our Company to exercise the following rights:

• Learn whether your personal data is being processed
• Request information about processing if it is being processed
• Learn the purpose of processing and whether the data is used in accordance with that purpose
• Know the third parties to whom data is transferred domestically or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction of data under KVKK Article 7
• Object to results that emerge against you solely from automated analysis
• Claim damages caused by unlawful processing

7. Application Method

You can submit requests for the rights listed above in accordance with the Communiqué on Application Procedures and Principles to the Data Controller, by emailing hello@kardolabs.com or by writing to the Company's registered address. Your requests will be answered within the maximum periods set by the Turkish Personal Data Protection Authority.