Privacy Policy & Data Processing Agreement

Last Updated: 19.06.2026

This Privacy Policy determines the principles regarding the collection, processing, storage, transfer, and protection of personal data of users visiting the platform and website operated by Turna Capital Danışmanlık A.Ş. ("Company", "Turna Capital"). Your privacy is crucial to us, and we are committed to safeguarding your personal data in accordance with the Law on Protection of Personal Data No. 6698 ("KVKK"), General Data Protection Regulation ("GDPR"), and other relevant local and international data protection laws.

1. Collection of Personal Data and Methods

When you register on Turna Capital, visit our platform, apply for our premium subscription packages (Pro/Elite), create advertisements, or fill out communication forms, we collect and process specific categories of personal data. This includes: (a) Identity Data: Name, surname, username, national ID number (for KYC validation), passport details (for foreign members), and official corporate establishment records; (b) Contact Data: Email address, phone number, physical address, and billing address; (c) Professional Data: Job title, company name, industry sector, corporate website URL, and LinkedIn profile URL; (d) Financial Data: Payment transactions metadata (facilitated via our secure Merchant of Record gateway, Creem), billing details, tax office, and tax identification number; (e) Technical Log Data: IP addresses, browser types, referral paths, page views, cookie identifiers, action history, and timestamps. This data is collected through electronic forms, system integrations, database logs, and automated cookies.

2. Purposes and Legal Grounds of Data Processing

Your personal data is processed for the following purposes in accordance with Article 5 and 6 of the KVKK: (a) Matchmaking Services: To operate, maintain, and optimize our directory listings connecting melek (angel) investors, entrepreneurs, and franchise brand owners; (b) Authentication and Security: To verify identities (KYC verification), prevent fraudulent accounts, protect platform integrity, and secure access; (c) Financial Operations: To process secure subscription payments via Creem, manage billing, and maintain global tax compliance; (d) Platform Communication: To enable direct messaging channels between verified users, manage digital Data Room access requests, and log NDA signatures; (e) Support and Service: To reply to user inquiries, contact you regarding updates, and send periodic newsletters (subject to explicit consent); (f) Statutory Compliance: To satisfy legal, commercial, and administrative duties under the Turkish Commercial Code, Tax Procedure Law, and electronic commerce regulations.

3. Data Storage, Security, and Retention

To ensure the absolute confidentiality and security of your personal data, we implement robust technical and administrative security controls (including SSL/TLS 256-bit encryption for all data transmissions, databases access restrictions, and secure API handshakes). Your personal data is stored securely in distributed cloud hosting environments provided by our technology infrastructure partners, including Convex (database service), Clerk (identity management and authentication), Bunny CDN (secure file storage for KYC and Data Room documents), and Resend (email services). Personal data is retained only for the duration necessary to fulfill the purposes of processing or to comply with statutory retention limits under the Turkish Commercial Code (10 years) and other relevant tax and civil laws.

4. Third-Party Disclosures and International Data Transfers

Your personal data will not be sold, rented, or shared with third parties for commercial marketing purposes. For the operation of the platform services, data is disclosed to trusted third-party service providers, including billing and payment processors (Creem), identity verification services, database services, and cloud storage providers (Bunny CDN). Since the servers of our infrastructure providers (Clerk, Convex, Bunny CDN, Resend) are located in secure data center hubs abroad (outside of Turkey), registering on the platform and using our services constitutes your explicit consent for international data transfers in accordance with Article 9 of the KVKK.

5. Rights of the Data Subject and Contact Information

Under data protection regulations, you have the right to: (a) Learn whether your personal data is processed; (b) Request information if it has been processed; (c) Learn the purpose of processing and check if it is used accordingly; (d) Know the third parties to whom data is transferred, domestically or abroad; (e) Request correction of incomplete or incorrect data; (f) Request deletion or destruction of your personal data under legal terms; (g) Object to any outcome against you caused by automated analysis. To exercise these rights, you may submit your written requests containing proof of identity to our official address or via email to: info@turnacapital.com