This is a translation provided for convenience. In case of any discrepancy, the Turkish version prevails.
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to inform visitors, members and customers using the IBAN validation and financial institution information services offered at https://test.ibansource.com (the "Service") about the processing of their personal data.
1. Data Controller
Your personal data is processed by ibansource (the "Company") as data controller.
- Address: Çamtepe Mahallesi Camii Sokak No: 1 Daire: 12, 35330 Narlıdere, İZMİR, Türkiye
- E-mail: info@ibansource.com
- Phone: +90 555 555 55 55
- Registered e-mail (KEP): —
- MERSIS / Tax no: — / —
2. Categories of Personal Data
| Category | Data | From |
|---|---|---|
| Identity | First and last name; Turkish ID number for individual invoices | Members, customers |
| Contact | E-mail address, billing phone, billing address (province, district, postal code) | Members, customers, contact form users |
| Customer transactions | Membership, subscription and plan details, orders and payments, invoices, daily lookup counts, API usage statistics, support requests, comments | Members, customers |
| Financial | Company name, tax office and tax number for corporate invoices; payment and refund amounts. Your card details are never seen or stored by the Company; they are processed directly by the payment institution. | Customers |
| Transaction security | IP address, browser/device information (user agent), login attempts, session and security logs, a one-way hash of your password, API key hash | Visitors, members |
| Legal transactions | Records of agreements and legal texts you accepted (version, date, IP address) | Members, customers |
| Marketing | Only analytics and advertising cookie data you allowed in your cookie preferences | Visitors |
The IBANs you look up are not stored. Only the daily number of lookups is kept for quota purposes. No special categories of personal data (health, biometrics, etc.) are processed.
3. Purposes and Legal Grounds
| Purpose | Legal ground (KVKK Art. 5/2) |
|---|---|
| Creating your account, verifying your e-mail, login and account management | (c) Formation and performance of a contract |
| Selling plans, collecting payments, starting, renewing, upgrading and cancelling subscriptions, refunds | (c) Formation and performance of a contract |
| Issuing invoices, keeping accounting records, reporting to authorities | (ç) Compliance with a legal obligation (Tax Procedure Law No. 213, Turkish Commercial Code No. 6102) |
| Proving distance contract, pre-contractual information and legal text acceptances | (ç) Legal obligation (Consumer Protection Law No. 6502); (e) establishment, exercise or defence of a right |
| Enforcing lookup quotas and API limits, preventing abuse and unauthorised access, information security | (f) Legitimate interest; (c) performance of a contract |
| Answering contact form and support requests | (f) Legitimate interest; (c) where the request relates to the contract |
| Mandatory service e-mails (verification, password reset, payment, cancellation, refund) | (c) Performance of a contract |
| Use as evidence in disputes | (e) Establishment, exercise or defence of a right |
| Site analytics and advertising (analytics/marketing cookies) | Explicit consent (Art. 5/1) — given in your cookie preferences and revocable at any time |
We do not send commercial electronic messages (campaigns, newsletters); your separate consent would be requested if this ever changes.
4. Method of Collection
Your data is collected electronically: directly from you through the registration, login, billing, payment and contact forms and the Account page; automatically through server logs and cookies while you use the Service; and from the payment institution when it reports a payment result.
5. Transfers
Your personal data may be transferred, limited to the purposes above, to:
- The payment institution (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) to process payments and refunds — name, e-mail, billing address, ID/tax number, amount, IP address.
- Hosting and e-mail infrastructure providers to run the Service and deliver transactional e-mails.
- Accountants and auditors for accounting and tax obligations.
- Competent public authorities and courts upon a lawful request.
- Google LLC (Google Analytics, Google AdSense) only if you allow it in your cookie preferences; this is a transfer abroad based on your explicit consent under KVKK Art. 9.
Where a transfer to a service provider abroad is required, the appropriate safeguards set out in KVKK Art. 9 (such as standard contracts) are put in place.
6. Retention
- Membership and contract records: for the duration of the membership and 10 years thereafter (general limitation period).
- Invoices and accounting records: 10 years (Turkish Commercial Code Art. 82; Tax Procedure Law Art. 253).
- Transaction security logs: up to 2 years.
- Contact form messages: up to 1 year after the request is closed, then anonymised.
- Cookie data: as stated in the Cookie Policy.
When your account is deleted, your name, e-mail, ID and billing details and IP records are anonymised; only the invoice and contract records that must be kept by law are retained for the periods above. Expired data is deleted, destroyed or anonymised in periodic disposal runs.
7. Your Rights (KVKK Art. 11)
You have the right to: learn whether your data is processed and request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred in Turkey or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under Art. 7; request that such correction or deletion be notified to recipients; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
8. How to Apply
You may send your request, with information identifying you, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- in writing to Çamtepe Mahallesi Camii Sokak No: 1 Daire: 12, 35330 Narlıdere, İZMİR, Türkiye,
- by registered e-mail (KEP) to —,
- from the e-mail address registered in our system to info@ibansource.com.
Requests are answered free of charge within 30 days at the latest; if the action requires an additional cost, the fee set by the Personal Data Protection Board may apply. You can also update your name, e-mail and billing details yourself on the Account page.