PERSONAL DATA PROTECTION AND GENERAL PRIVACY AGREEMENT

1. Parties, Definitions and Scope

This Agreement is concluded pursuant to Personal Data Protection Law No. 6698 (KVKK) between Light Hosting, located at Küçükçekmece Tevfik Bey Mah. 4. Yayla Sokak No:3 (hereinafter the “Data Controller” or “Service Provider”), and the natural or legal persons using Light Hosting services (hereinafter the “Data Subject”, “Customer” or “User”).

1.1. Personal data: any information relating to an identified or identifiable natural person.
1.2. Data controller: the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system (Light Hosting).
1.3. Data processor: the natural or legal person who processes personal data on behalf of the data controller, under the authority granted by them.
1.4. Data subject: the natural person whose personal data is processed (the Customer).

2. Purposes and Legal Grounds for Processing Personal Data

The Data Controller processes the Customer’s personal data on the following legal grounds set out in Articles 5 and 6 of the KVKK:

a) Conclusion and performance of the contract (KVKK art. 5/2-c): receiving orders, activating the service, issuing invoices, providing technical support and delivering uninterrupted service.
b) Expressly provided for by law and legal obligation (KVKK art. 5/2-ç): issuing invoices under Tax Procedure Law No. 213, keeping traffic logs under Law No. 5651, and fulfilling obligations arising from BTK (Information and Communication Technologies Authority) legislation.
c) Legitimate interest (KVKK art. 5/2-f): securing the infrastructure, preventing fraud, improving service quality and exercising the right of defence against claims.
d) Explicit consent (KVKK art. 5/1): optional marketing, advertising and newsletter communications, and transfers of data abroad.

3. Personal Data Collected and How It Is Collected

The following data declared by users through the website, the customer panel or the support system is collected by automated or non-automated means:

Identity Data: Name, surname, Turkish ID number (required for legal invoicing and identity verification) or passport number for foreign nationals.
Contact Data: Email address, phone number, physical billing address.
Transaction and Infrastructure Security Data: IP address, system login and logout logs, traffic data kept under Law No. 5651, customer panel transaction history.
Payment Data: Payments are processed encrypted through a secure payment gateway (PayTR). Card and bank details are never stored on the Data Controller's servers.

4. Retention and Destruction of Data

Personal data is retained for the duration of the service relationship and, in line with statutory limitation periods, for 10 years under the Turkish Commercial Code and 2 years under Law No. 5651. Once the retention periods expire or the reasons requiring processing cease to exist, the data is deleted, destroyed or anonymised in accordance with the guidelines of the KVKK Authority.

5. Sharing and Transfer of Data to Third Parties

Personal data may be shared with legally authorised public bodies such as judicial authorities, the BTK and tax offices within the scope of legal obligations. It is also shared with business partners required to deliver the service (domain registrars, SSL providers, licence providers and the payment institution), only to the extent necessary.

5.1. Transfer of data abroad (Turkey location): Because part of the technical infrastructure of the service purchased by the Customer (in particular server hosting, backups and the licence servers of control panels such as cPanel/Plesk) is located in data centres within the Federal Republic of Germany, IP addresses, transaction logs and account records are transferred to secure servers abroad. The Data Subject acknowledges and declares that this follows from the technical nature of the service and gives explicit consent to their data being hosted in data centres abroad.

6. Rights of the Data Subject and How to Apply

Under Article 11 of the KVKK, the Customer has the right to learn whether their data is processed, to know whether it is used in line with its purpose, to request the correction of incomplete or inaccurate data and to request its deletion.

How to apply: In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, requests must be sent from the e-mail address registered in our system to [email protected] in writing, or by post to our company address as a petition bearing a wet signature. Applications where identity cannot be verified will not be processed for security reasons.

7. Cookies

The website uses strictly necessary and functional cookies to improve the user experience, manage sessions and analyse site traffic. The Customer can block or delete cookies at any time from their browser settings.

8. Data Security and the Measures Taken

To prevent the unlawful processing of and access to personal data, the Data Controller takes the necessary administrative and technical measures, such as firewalls at the server layer, SSL encryption protocols and access restrictions.

9. Legal Basis and Dispute Resolution

The laws of the Republic of Turkey and the decisions of the KVKK Authority apply to the interpretation and performance of this agreement. The Istanbul Courts and Enforcement Offices have jurisdiction over any dispute that may arise.

10. Changes to the Agreement

The Data Controller reserves the right to amend this agreement in line with legal regulations or service updates. The current agreement takes effect the moment it is published at www.lighthosting.com.tr.

11. Communication Preferences and Marketing Consent

11.1. Mandatory and transactional notifications: the Customer’s contact details (e-mail, SMS, phone calls, WhatsApp) may be used directly as part of performing the contract for service continuity, invoicing, balance alerts, technical support requests, password resets, infrastructure maintenance announcements and payment reminders. These notifications are transactional and are not commercial advertising.
11.2. Marketing and campaign messages: campaigns, discounts, promotions and general announcements may only be sent to the Customer by SMS, e-mail or WhatsApp where the Customer has given optional consent (explicit consent) during sign-up or ordering. The Customer may withdraw permission for marketing notifications at any time from the customer panel or [email protected] by contacting this address.

12. Contact Details
Company Phone: 0850 304 76 83
Email: [email protected]
Address: Küçükçekmece Tevfik Bey Mah. 4. Yayla Sokak No:3