GDPR Privacy Notice

1. Data Controller

The data controller responsible for processing your personal data is: ITEMARA COREVIDER LTD (Company No: 16774546). To contact us, please use our contact form.

2. Personal Data Processed

We process the following categories of personal data:

3. Legal Bases for Processing

Your personal data is processed on the following GDPR legal bases:

• Performance of a contract (Art. 6(1)(b)): Account creation and platform service delivery.
• Legitimate interests (Art. 6(1)(f)): Platform security, fraud prevention, and service improvement.
• Consent (Art. 6(1)(a)): Marketing communications and other consent-based processing.
• Legal obligation (Art. 6(1)(c)): Tax, accounting, and statutory retention obligations.

4. Data Transfers

Your personal data may be shared with the following categories of recipients:

• Infrastructure providers (Hetzner — EU data centre, Falkenstein, Germany): Server hosting.
• Payment processor (Stripe): Secure payment infrastructure — transaction data only.
• Storage services: Cloudflare R2 (object storage) for user-uploaded images.
• No transfers outside the EU/EEA; all data is processed within EU/EEA boundaries.

5. Retention Periods

• Account data: For as long as your account is active and for 30 days following a deletion request.
• Security and IP logs: Retained independently of account deletion for fraud/legal purposes.
• Payment records: Minimum 7 years as required by tax and accounting regulations.

After retention periods expire, data is deleted or anonymised.

6. Your GDPR Rights

Under GDPR you have the following rights:

• Right of access (Art. 15): Request a copy of your personal data.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure / 'Right to be forgotten' (Art. 17): Request deletion of your personal data.
• Right to restriction of processing (Art. 18): Request restriction of processing under certain conditions.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Rights related to automated decision-making and profiling (Art. 22).

7. Turkish Users — KVKK

For users accessing from Türkiye, Law No. 6698 on Personal Data Protection (KVKK) also applies. For your rights under KVKK and the relevant notice, please visit our KVKK Privacy Notice page.

8. Cookies

For detailed information on our use of cookies, please review our Cookie Policy.

9. Contact & Complaints

To exercise your GDPR rights or for any questions, please use our contact form. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or the competent supervisory authority in your EU member state.