1. Data Controller Identity
Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK") and relevant data privacy legislation, the data controller is Serbest Çelebi (Founder & Representative of MüşteriBulucu.online platform).
| Data Controller | Serbest Çelebi (Platform Founder & Manager) |
|---|---|
| Platform & Domain | MüşteriBulucu.online |
| General Inquiries | [email protected] |
| Legal & Data Subject Rights | [email protected] |
| Support Desk | [email protected] |
| Corporate Entity Transition | Upon finalization of the corporate legal entity registration, an updated clarification statement will be published in accordance with Article 10 of KVKK, and registered users will be notified accordingly. |
2. Data Subject Groups and Categories of Processed Data
MüşteriBulucu processes data concerning platform visitors, registered free beta users, and public commercial businesses listed in the directory:
- Account and User Data: Name, corporate company title, professional email address, encrypted password hash, verification timestamps, and complimentary test credit balance.
- Usage and Transaction Logs: Free preview/unlock logs and security query logs. (The platform is currently operating in Free Beta; no credit card, banking, or billing payment information is processed. If paid packages are activated in the future, financial data will be processed via licensed payment gateway with 3D Secure under an updated privacy notice).
- Security & Access Logs: IP address, session identifiers, and technical access timestamps for cybersecurity protection, system integrity, and prevention of fraudulent activities.
- Directory Data: Business title, commercial sector, official website URL, corporate telephone, role-based business email (
info@,contact@, etc.), and registered public business address. The platform targets solely public corporate details published on official company websites; private home addresses, private personal mobile numbers, and sensitive personal data are not collected.
3. Methods of Data Collection and Legal Grounds
Data is collected through web interfaces, security logs, and automated discovery of publicly accessible official corporate websites. The platform does not scrape, store, or resell Google Maps/Places content for directory compilation.
The legal grounds under Article 5 of KVKK include:
- Primary Ground (KVKK Art. 5/2-f): Legitimate interests of the data controller in indexing public corporate business contacts for B2B market research and business networking, provided that it does not harm the fundamental rights and freedoms of data subjects. Data minimization is strictly enforced.
- Establishment and Performance of Contract (KVKK Art. 5/2-c): Provision of user accounts and complimentary beta search credits.
- Legal Obligation and System Security (KVKK Art. 5/2-ç & Art. 5/2-f): Maintaining cybersecurity and transaction logs to comply with legal record-keeping requirements.
- Publicly Available Data (KVKK Art. 5/2-d): Applied exclusively in exceptional instances where corporate contact data has been made public by the data subject and processed in accordance with the intent of disclosure.
4. Data Transfers and Recipient Categories
| Recipient Group | Purpose of Transfer | Legal Ground |
|---|---|---|
| Authorized B2B Users | Viewing and exporting verified public corporate contacts for B2B market research under user agreement terms | KVKK Art. 5/2-f (Legitimate Interest with Data Minimization) |
| Cloud Infrastructure & Hosting Providers | Server hosting, database storage, and high-availability operations | KVKK Art. 5/2-f (Legitimate Interest) |
| Legal Counsel & Auditors | Regulatory compliance, legal review, and handling of statutory requests | KVKK Art. 5/2-e & Art. 5/2-ç |
| Authorized Public Authorities | Fulfilling statutory requests from judicial or administrative bodies | KVKK Art. 5/2-ç (Legal Obligation) |
5. Rights of Data Subjects and Application Procedure (KVKK Article 11)
Under Article 11 of the KVKK, data subjects have the right to learn whether their personal data is processed, request information thereon, request rectification of incomplete or inaccurate data, request deletion or erasure, and object to processing.
Application Methods: Requests can be submitted with identity verification information via:
- Secure Electronic Signature: Send digitally signed applications to [email protected].
- Registered Email Address: Send requests from your confirmed account email to [email protected].
- Fast Takedown Portal: For immediate removal of your business directory listing, submit a request via our Notice-and-Takedown Portal for processing within 24–72 hours.
Properly submitted requests are concluded free of charge within 30 (thirty) days at the latest.