Controller and contact
The controller is Core Dijital. Contact: Istanbul, Türkiye; info@coredijital.com.tr; +90 850 308 20 18. For a KVKK request, email us with “KVKK request” in the subject line.
Data, purposes and legal grounds
For an agency application, we use your name, TikTok username, phone number, date of birth/age eligibility, country and any referral code to assess the request, contact you and take steps toward the service relationship. Where directly related to pre-contract steps or the service relationship, the ground is KVKK Article 5(2)(c); where necessary to establish, exercise or protect a right, Article 5(2)(e). We record your notice acknowledgment, the notice version and the time to demonstrate that the information was provided; this record is kept to meet the notice obligation under Article 5(2)(ç).
For a CoreHUB account, we process username, name, email, phone, profile details and a one-way password hash to create the account, authenticate you and provide the dashboard and support. An optional address is used only when needed to arrange delivery of physical equipment support or gifts; where that delivery is directly part of the agency/service relationship, the ground may be contract performance (Article 5(2)(c)). If that ground does not apply, Article 5(2)(f) is considered only where the specific purpose and balancing against your rights support it. Necessary name, address and phone details may be shared with the carrier for that shipment. Session, failed-login, IP, browser/device and security records are restricted to account security, abuse prevention and incident review. Depending on the activity, grounds may include contract steps/performance (Article 5(2)(c)), legal obligation (5(2)(ç)), legal claims (5(2)(e)) or legitimate interests that do not override your rights (5(2)(f)). We record your notice acknowledgment, the notice version and the time to demonstrate that the information was provided; this record is kept to meet the notice obligation under Article 5(2)(ç). Depending on the modules you use, we may also process support/chat content, uploaded files and media, task responses, notification subscription details and transaction/payment/accounting records related to the service.
Analytics is optional. If you allow analytics cookies, Google Analytics 4 and Core Dijital’s first-party measurement process usage information such as page paths, views and interactions. You can withdraw this choice at any time using the privacy icon at the bottom left. This measurement is not used for advertising profiling.
Collection method and data categories
We collect data electronically from information you enter in website/CoreHUB forms, your account use, session/security logs, your privacy-notice acknowledgment and notice version, an optional push-notification subscription and, if you opt in, analytics tools. Registration asks for date of birth to assess age eligibility. Address is optional and is collected for delivery when a physical equipment-support item or gift needs to be sent.
Recipients
Data may be shared, as needed, with authorised Core Dijital staff/representatives, hosting, email, maintenance and security providers, a carrier when a shipment is arranged, and legally authorised public bodies or courts. Google reCAPTCHA is called when an application form is submitted to prevent abuse. If you opt in to analytics, usage data is sent to Google Analytics 4. If you enable browser notifications, the subscription endpoint, keys and browser information are stored and the browser push service/Google Firebase Cloud Messaging may be used to deliver them. Content submitted to CoreHUB AI features may be sent to the active provider configured for that feature, including OpenAI, Google Gemini, Anthropic, NVIDIA, DeepSeek or Moonshot. When the WhatsApp communication module is used, related message data may be sent to Meta/WhatsApp. Some pages load Google Fonts and static code, fonts or icons from third-party CDNs (such as Cloudflare/cdnjs and jsDelivr); providers may receive your IP address and technical browser request data.
International transfers
Some providers, including Google/Firebase, CDN, browser push, AI and messaging providers, may have infrastructure or entities abroad. Connections may transfer IP address, technical request data and content you submit to the relevant module abroad. Any international transfer must rely on an applicable mechanism and safeguards under KVKK Article 9. The controller should record each provider’s destination country, contract and safeguard/notification status. You may request provider updates at info@coredijital.com.tr.
Retention and deletion
We keep data for as long as needed for its purpose and applicable statutory limitation/retention periods. When the purpose and period end, data is erased, destroyed or anonymised unless another legal duty requires retention. At sign-in, a remember token is created by default and remains valid for up to 90 days. Exact retention periods for application and security logs must be set in the controller’s inventory and deletion plan.
Your KVKK rights
Under KVKK Article 11, you may ask whether data is processed and obtain information, learn purposes and recipients, correct inaccurate data, request erasure/destruction where applicable and notice to recipients, object to a solely automated analysis result, and claim compensation for unlawful processing. You may apply to the controller using one of the methods set out in KVKK Article 13 and the related Communiqué. Contact info@coredijital.com.tr for the official correspondence address and any registered or secure electronic application channel. Requests are answered as soon as possible and no later than 30 days, depending on their nature.
The controller updates this notice when personal-data processing activities or service providers change. Use the contact details above for KVKK requests and communications with the controller.