Spitfire

Privacy Notice (Personal Data Protection)

Version 2026-09-30.3. This is a translation for information; the Turkish text prevails.

This notice explains, under Article 10 of Personal Data Protection Law No. 6698 (KVKK), how the personal data of those who buy a license on spitfire.tr is processed.

1. Data controller

Taner Akdemir – Algebran Yazılım & Danışmanlık, Atakent Mah. 1472. Sok. Eda Apt. No:5 D:3 Elvankent, Etimesgut, Ankara · [email protected]

2. Data processed

  • Identity: full name; optionally the Turkish ID number on an individual invoice.
  • Contact: e-mail address, phone number, billing address.
  • Invoice: for a company purchase, the company title, tax number and tax office.
  • Customer transaction: order number, plan bought, amount, payment status, date the license key was sent.
  • Transaction security: time of the order and of the agreement consent, the agreement version consented to, and the IP address it came from.

Card details are processed on PayTR's payment page; they do not reach us and are not stored by us. You run the Spitfire software on your own servers; none of the test data it handles comes to us.

3. Purposes and legal grounds

  • Concluding and performing the sales agreement, delivering the license key, order and payment notices: KVKK Art. 5(2)(c), conclusion and performance of a contract.
  • Issuing invoices, keeping accounting and tax records: Art. 5(2)(ç), compliance with a legal obligation.
  • Proving the agreement consent and the consent to the withdrawal exception, possible disputes: Art. 5(2)(e), establishing, exercising or protecting a right.
  • Preventing misuse and fraud, system security: Art. 5(2)(f), legitimate interest.
  • Measuring visits to the site without cookies and only in aggregate (page visited, referring address, browser and device type, country; Cloudflare Web Analytics): Art. 5(2)(f), legitimate interest.
  • Notifying you by e-mail, while your license runs, of new releases and security updates of the software you bought (no promotion or marketing; telling us you do not want them is enough): Art. 5(2)(c).
  • Answering requests and complaints: Art. 5(2)(c).

4. Transfers

Data is transferred only for these purposes and only as far as needed:

  • PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (Türkiye): taking and refunding the payment (name, e-mail, phone, address, amount).
  • Twilio Inc. / SendGrid (USA): sending order, receipt, license and release notice e-mails (name, e-mail, order details). This is a transfer abroad under KVKK Art. 9.
  • Cloudflare, Inc. (USA): serving the site securely and reliably, and visit statistics; the IP address and request details of everyone visiting the site pass through this service. This is a transfer abroad under KVKK Art. 9.
  • Our server hosting provider (netcup GmbH, Almanya): running the server the order data is stored on. The server is abroad, so this too is a transfer abroad under KVKK Art. 9.
  • Authorised public bodies: where the law requires (e.g. tax audits).

5. Retention

  • Orders whose payment was not completed (abandoned, failed, expired) are deleted 30 days after they were created.
  • Paid orders and invoice details are kept for 10 years, as the Tax Procedure Law and the Turkish Commercial Code require.
  • The license key is not stored in full; only a record that it was sent and its last characters are kept.

6. How data is collected

Electronically, from the order form on spitfire.tr/satin-al and the payment result the payment institution reports.

7. Your rights

Under KVKK Art. 11 you may learn whether your data is processed and request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties in Türkiye or abroad it is transferred to, request correction of incomplete or wrong data, request erasure or destruction where the conditions of KVKK Art. 7 are met and that these steps be notified to the third parties it was transferred to, object to a result against you arising from analysis by automated systems only, and claim compensation for damage caused by unlawful processing.

Send your request with details that verify your identity to [email protected]; it is answered within 30 days at the latest. If your request is refused or you find the answer insufficient, you may complain to the Personal Data Protection Board.