KVKK Privacy Notice

In line with Article 10 of the Personal Data Protection Law No. 6698 (KVKK), this explains how your personal data is processed as part of Orbit Account. You can find more detail in the Privacy Policy.

1. Data controller

Orbit Helm (a company being incorporated in England and Wales; its registration details will be added to this text once it is incorporated). As a data controller not established in Türkiye, the details of our data controller representative in Türkiye will be added to this text together with the company's incorporation and its registration in the Data Controllers' Registry (VERBİS).

2. Personal data processed

• Identity: display name (optional).
• Contact: email address.
• Transaction security: passkey public keys, the link to your authenticator app, recovery code hashes, IP address, browser and device information, sign-in and security records.
• Location: approximate location derived from the IP address (city level).
• Customer transactions: language and country preference, the Orbit Helm apps used, support actions.
• Legal transactions: records of the consents given to texts and of their withdrawal.

No special categories of personal data (including biometric data) are processed. Face and fingerprint verification happens on your device and never reaches us.

3. Purposes of processing and legal grounds

• Creating your account, signing you in and connecting it to Orbit Helm apps: being directly related to the establishment and performance of a contract (KVKK Art. 5/2-c).
• Keeping your account secure, new device and suspicious sign-in alerts, and preventing misuse: the data controller's legitimate interest (Art. 5/2-f).
• Keeping consent and support records, and responding to requests from competent authorities: legal obligation (Art. 5/2-ç) and the establishment, exercise or protection of a right (Art. 5/2-e).
• Sending commercial electronic messages: explicit consent (Art. 5/1), only if you give your permission.

4. Method of collection

Data is collected electronically through accounts.orbithelm.com and the Orbit Helm apps, from the information you enter and by automated means while you use the service (sign-in and security records).

5. Transfers

Your personal data is transferred to the Orbit Helm apps you use (account ID, email and display name), to the processors that provide the service on our behalf and, on request, to competent public institutions and bodies, limited to the purposes above.

The service's infrastructure is abroad: data is stored in the United Kingdom (Supabase, London); Cloudflare (site and security), Resend (sending emails, Ireland) and IPinfo (IP location lookup) are also used as processors. Transfers abroad are made under KVKK Art. 9, relying on appropriate safeguards such as the standard contracts published by the Personal Data Protection Board (the Board).

6. Retention period

Account data is kept for as long as the account is open; security records for up to 1 year; IP location information and email sending records for 90 days. When the account is closed, after a 30-day period in which you can change your mind, the data is deleted or anonymised; consent records are kept in anonymous form as proof.

7. Your rights under Article 11 of the KVKK

• To find out whether your personal data is being processed and, if it has been, to request information about it,
• To find out the purpose of the processing and whether the data is being used in line with that purpose,
• To know the third parties in Türkiye or abroad to whom it has been transferred,
• To ask for it to be corrected if it has been processed incompletely or incorrectly,
• To ask for it to be erased or destroyed under the conditions in KVKK Art. 7,
• To ask for the correction, erasure and destruction to be notified to the third parties it has been transferred to,
• To object to an outcome against you that results from the data being analysed solely by automated systems,
• To claim compensation if you suffer harm because of unlawful processing.

8. Applications

You can download a copy of your data straight away from the Privacy and data page, and close your account from the same page. For other requests, you can write to privacy@orbithelm.com from the email address registered to your account. Your application will be concluded free of charge within 30 days at the latest. If you do not find the reply satisfactory, you can complain to the Personal Data Protection Board.

Translated from the Turkish text.