This English version is provided for information; in case of conflict the Turkish version prevails.

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) by Fink Games Yazılım Teknoloji Sanayi ve Ticaret A.Ş. (the “Company”), as data controller, for personal data processed through eksenix.com, operated under the Eksenix brand, its customer panel and related communication channels.

1. Data controller

Data controller / seller

Fink Games Yazılım Teknoloji Sanayi ve Ticaret A.Ş.

Brand

Eksenix (eksenix.com)

Registered address

Geçit Mah. 1. Vefa Sokak No: 34, 16180 Osmangazi/Bursa, Türkiye

Phone

0850 307 3637

Email

[email protected]

Tax office / number

Setbaşı Vergi Dairesi / 3881993189

2. Categories of personal data

• Identity: first and last name; Turkish ID number where required for invoicing.
• Contact: email address, phone number, billing and delivery address.
• Customer transactions: account data, quotes, cart, orders, payment status, invoices and delivery records, requests, complaints and contact form messages.
• Financial: company name, tax office and tax number, amount paid, instalments, bank approval and reference codes. The Company never receives or stores the full card number; only the first 6–8 digits (BIN) are looked up to determine instalment eligibility.
• Files and technical data: CAD/STEP/STL files, drawings, sample photographs you upload and their dimensional/geometry summaries. These files may contain personal data.
• Transaction security: IP address, session and login records, browser/device information, activity and error logs, consent records (type, version, date and IP address).
• Marketing: your communication preferences, only if you give commercial message consent or explicit consent.

3. Purposes

• Creating the account, authenticating you and keeping the account secure;
• Preparing automated or engineer-reviewed quotes from uploaded files;
• Planning and carrying out made-to-order production (3D printing, CNC machining, laser cutting, press-brake bending and similar);
• Concluding and performing the distance sales contract, payment, invoicing, shipping and delivery;
• Handling withdrawal, return, defective goods and warranty requests, and answering requests and complaints;
• Information security and fraud prevention;
• Complying with legal obligations, in particular Laws No. 6502, 6563, 213 (Tax Procedure) and 6102 (Commercial Code), and responding to authorities;
• Sending campaign and information messages, only with your consent;
• Measuring site use and conversions such as file uploads: with cookies if you allow analytics cookies, otherwise as a cookieless ping under Google Analytics 4 Consent Mode v2.

4. Legal grounds

Personal data is processed under KVKK Article 5(2): (c) necessity for concluding or performing a contract (membership, quote, sale and delivery), (ç) compliance with a legal obligation (invoices, books and record keeping, consumer law), (e) establishing, exercising or protecting a right, and (f) the Company's legitimate interests provided your fundamental rights are not harmed (security, service quality, and measurement that does not write cookies). Cookieless measurement does not build an advertising profile and does not store a persistent analytics identifier in the browser. Analytics and marketing cookies rely only on the choice in your cookie preferences (KVKK Article 5(1)). Commercial electronic messages and the processing described in the Explicit Consent Text rely only on your explicit consent; refusing does not affect membership or purchases.

5. Method of collection

Data is collected automatically or partly automatically through the membership, quote, cart, payment and contact forms, the customer panel, file upload areas, email and phone, strictly necessary cookies and server logs. The Google Analytics 4 tag loads on every page. If you do not allow analytics cookies, no analytics cookie is written; a cookieless ping may be sent to Google for page and event measurement. Details are in the Cookie Policy.

6. Transfers within Turkey

Data may be shared, limited to the purposes above, with T. Garanti Bankası A.Ş. (Garanti BBVA virtual POS) for payments, contracted cargo companies for delivery, accounting, e-invoice, hosting and email service providers, legal advisers, and competent public authorities and courts on request, under KVKK Article 8.

7. Transfers abroad

Uploaded files, sample photographs and market images are stored in a private, non-public Amazon Web Services (AWS) S3 storage area in the European Union – Ireland (eu-west-1) region. This is a cross-border transfer under KVKK Article 9 and relies on the standard contract published by the Personal Data Protection Board as an appropriate safeguard. To show instalment options, only the first 6–8 digits of the card (BIN) are looked up with the binlist.net service located abroad; these digits alone do not identify the cardholder and the rest of the card number is never shared. Google Analytics 4 measurement may be sent to Google LLC / Google Ireland Ltd. whether or not you consent; cookies are written only with your consent as described in the Cookie Policy, and without consent the signal is a cookieless ping. Google Maps and YouTube/Vimeo content described in the Cookie Policy load directly from the provider in your browser only if you consent.

8. Retention

Data is kept for as long as the purpose requires and the law prescribes: sales, invoice and accounting records for 10 years (Tax Procedure Law, Commercial Code); distance contract and consent records for at least 3 years (Law No. 6563 and regulations); account data for the duration of membership; uploaded files until you delete them or close your account, and files of orders together with the order records. Afterwards data is erased, destroyed or anonymised under the applicable regulation.

9. Your rights (KVKK Article 11)

• to learn whether your data is processed and request information about it;
• to learn the purpose of processing and whether it is used accordingly;
• to know the third parties in Turkey or abroad to whom it is transferred;
• to request correction of incomplete or inaccurate data, and erasure or destruction where the conditions of Article 7 are met, and notification of these to third parties;
• to object to an adverse result arising exclusively from automated analysis;
• to claim compensation for damage caused by unlawful processing.

10. How to apply

Send your request as described on the Data Subject Application page: in writing to Geçit Mah. 1. Vefa Sokak No: 34, 16180 Osmangazi/Bursa, Türkiye, or by email from the address registered with us to [email protected]. Requests are answered free of charge within 30 days at the latest; if the action requires an additional cost, the Board's fee schedule may apply.