KVKK Informationshinweis

1. Summary

This Information Notice is prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) to inform you how Flexton LLC, as Data Controller, processes your personal data when you use the Qoro platform — including the purposes, legal bases and recipients of your data. Granular explicit-consent declarations are provided on a separate page: /legal/kvkk-consent.

2. Data Controller Identity

Legal name: Flexton LLC
Address: 7901 4th St N, Suite 300, St. Petersburg, FL 33702, United States
Country of incorporation: United States (Florida)
Email: hello@qoro.cc

3. Categories of Personal Data Processed

• Identity: Full name (account holder)
• Contact: Email, phone (optional), business address (optional)
• Customer Transaction: Order records, table info, timestamps, applied promotions
• Financial: Subscription plan, billing address, tax ID (card data is held by the Payment Processor — not stored on Flexton servers)
• Transaction Security: IP address, User-Agent, session identifier, hashed password
• Marketing: Marketing-communications preferences (if consent given)

4. Purposes of Processing

• Providing the Service, executing order and payment flows
• Subscription management and billing
• Security, prevention of unauthorised access and fraud
• Improving platform performance and user experience
• Legal obligations (tax law, audit)
• Handling requests, complaints and support
• Marketing communications based on explicit consent (only if opted in)

5. Legal Bases (KVKK Art. 5)

• Art. 5/2-a — Expressly permitted by law: Retention under tax, commerce and consumer law.
• Art. 5/2-c — Conclusion or performance of a contract: Account, plan, order and payment relationship.
• Art. 5/2-ç — Legal obligation: Requests from supervisory authorities, judicial orders.
• Art. 5/2-e — Establishment, exercise or defence of a right: Evidence in the event of a legal dispute.
• Art. 5/2-f — Legitimate interest: Security logs, fraud prevention, system improvement.
• Art. 5/1 — Explicit consent: Marketing communications, analytics cookies, international transfers relying on consent.

6. Transfers of Personal Data (Art. 8-9)

Domestic transfers (Art. 8): Business partners, legal advisors, public authorities (upon request) within contractual and legal obligations.

International transfers (Art. 9): The Qoro platform runs on infrastructure in the United States (Florida — Controller's domicile), EU-West (database, email infrastructure) and geographically closest edge regions. Transfers are carried out under Art. 9 KVKK either (i) via a commitment / cross-border agreement where permitted, or (ii) based on the explicit consent of the data subject.

Full sub-processor list with regions: see Data Processing Agreement Exhibit A.

7. Method of Collection

Personal data is collected from you through electronic channels (web, mobile, API), by automated means (form completion, placing orders, platform use) and via third-party infrastructure (Payment Processor, email, error monitoring).

8. Data Subject Rights (KVKK Art. 11)

You have the right to:

• learn whether your personal data is being processed;
• request information if it is being processed;
• learn the purpose of processing and whether it is used for that purpose;
• learn the third parties to which data is transferred domestically or abroad;
• request correction of incomplete or inaccurate data;
• request erasure or destruction under Art. 7 KVKK;
• request that correction, erasure or destruction be communicated to recipients;
• object to outcomes resulting from automated analysis that are adverse to you;
• claim compensation for damages arising from unlawful processing.

9. How to Apply (KVKK Art. 13 & the Application Communiqué)

To exercise your rights:

• By email: hello@qoro.cc (from the email address on file).
• In writing (signed letter): Flexton LLC, 7901 4th St N, Suite 300, St. Petersburg, FL 33702, United States — registered mail.

Applications must clearly state your full name, ID/passport number, contact details and the subject of the request. Applications are free of charge (a reasonable fee may be charged for manifestly unfounded or repetitive requests) and are answered within 30 days.

If you are not satisfied with our response, you have the right to file a complaint with the Turkish Personal Data Protection Authority (KVKK Art. 14): kvkk.gov.tr.

10. Explicit Consent Declarations

For processing activities that require explicit consent under KVKK Art. 5/1, separate granular declarations are provided: /legal/kvkk-consent. Each consent is given independently and may be withdrawn at any time; withdrawal takes effect prospectively.

11. Changes

When this Information Notice is updated, the version chip at the top of the page changes and, for material changes, we give at least 30 days' prior in-platform notice.

12. Contact

Data Controller: Flexton LLC — hello@qoro.cc
7901 4th St N, Suite 300, St. Petersburg, FL 33702, United States.