§01 Two separate roles: controller and processor
This distinction is the most important part of the document. There are two different data sets, and our role differs in each.
For data about your account we are the controller: name, email, phone, billing details, your team members’ names and roles, audit log records. We process these for our own purpose — running and invoicing the service.
For the data on your servers you are the controller and we are the processor. Your own customers’ account details, emails, files and databases fall here. We reach that data only on your instruction and only at the moment you open the screen; we keep no copy in our systems.
So the duty to inform your own customers and to obtain their consent rests with you. For business customers we also put this in writing in a separate data processing agreement — just ask for one.
§02 Identity of the controller
Controller: CTA Host Bilisim Inc., Istanbul, Türkiye. Tax number 1234567890.
Requests and contact: [email protected]
§03 Categories of personal data and purposes
- Identity and contact data
- Name, work email, optional phone. Purpose: create the account, authenticate you, send service notices.
- Security data
- Password hash, session records, IP address, two-factor state, audit log. Purpose: prevent unauthorised access and keep actions traceable.
- Transaction data
- Your plan, subscription history, invoice details. Purpose: perform the contract, collect payment, keep statutory books.
- Technical profile data
- Host name, IP, panel type and version, encrypted access key, metric series. Purpose: make the service work technically.
- Request and complaint data
- Support correspondence. Purpose: resolve the request and keep a record of it.
§04 Legal bases
We process your personal data on the following bases under Article 6(1) GDPR:
- Article 6(1)(b) — performance of a contract: opening the account, connecting servers, running the screens.
- Article 6(1)(c) — compliance with a legal obligation: issuing invoices, keeping the transaction records the law requires.
- Article 6(1)(f) — legitimate interests: keeping the service secure, preventing abuse, being able to evidence what was done and by whom.
- Article 6(1)(a) — consent: only for non-essential cookies and marketing messages. You can withdraw consent at any time.
§05 Recipients and transfers
Your data is shared only with the suppliers needed to run the service: the hosting and infrastructure provider, the payment provider, the email delivery service, and — if you consent — the analytics and support chat providers.
Servers are inside the European Union. Where a supplier requires a transfer outside the EEA, it is carried out under standard contractual clauses in line with Articles 44 to 49, or on your explicit consent.
We don’t sell, rent or open your data to third parties for marketing.
§06 Retention and erasure
The retention period for each category is listed in the table in the privacy policy. Data whose period has expired is deleted, destroyed or anonymised in a periodic clean-up run every six months.
At your request we carry out erasure without waiting for that clean-up, except for records the law requires us to keep.
§07 Your rights as a data subject
Under Articles 15 to 22 GDPR you have the right to:
- Obtain confirmation of whether we process your personal data, and access it.
- Have inaccurate or incomplete data corrected.
- Have your data erased where the conditions are met.
- Restrict processing while a dispute about accuracy or lawfulness is resolved.
- Object to processing carried out on legitimate interests.
- Receive your data in a structured, commonly used format and have it transmitted to another provider.
- Not be subject to a decision based solely on automated processing that has legal effects on you.
Send your request to [email protected] or in writing to our company address. We answer within one month, and we can extend that by two months for complex requests if we tell you why. You also have the right to lodge a complaint with your local data protection supervisory authority.
§08 Our commitments as a processor
For the data on your servers, as a processor we commit to the following:
- Process data only on your instruction, never for our own purposes.
- Never write to your servers without your permission; support accesses them only on your written request and only as far as needed.
- Ensure staff with access are bound by confidentiality and that every access is logged.
- Apply technical and organisational measures: encryption, role-based permissions, two-factor authentication, traceability.
- Update this page when the sub-processor list changes.
- Assist you with data subject requests and audits.
- Delete the connection profile and keys when the contract ends.
§09 Breach notification
If we become aware of a personal data breach, we notify the competent supervisory authority without undue delay and in any case within 72 hours, and we inform affected data subjects without delay.
Where a breach affects a data set for which you are the controller, we share what you need to meet your own notification duty without losing time.