Data Protection Notice (KVKK)

Data controller / service provider

Gülvi Kömür Celep (Tospika)

Sole trader / sole proprietorship without a registered trade name. Business commencement date: 01.10.2026.

Address: Güzeloluk Mah. 1820 Sk. Lara Tatilya Evleri A Blok No: 4 İç Kapı No: 4, Muratpaşa / Antalya

Tax office: Kalekapı V.D.

KVKK applications and contact email: merhaba@tospika.com

1. Data controller

Under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data is processed by Gülvi Kömür Celep (Tospika), as data controller, within the scope described below.

2. Personal data processed

Depending on your use of Tospika, the following data may be processed:

• membership and contact data: full name, email address, phone number and account information;
• maker profile data: profile name, biography, city, social media and contact links and business information;
• product and content data: product titles, descriptions, images, videos, price/production-time information and other details added by the maker;
• transaction security data: IP address, session records, device/browser information and security logs;
• request and support data: contents of contact forms, complaints, requests and applications;
• cookie data: cookies and similar technology records stored on your device according to your preferences.

Please do not unnecessarily enter special categories of personal data (such as health, beliefs or biometric data) in contact fields.

3. Purposes of processing

Your personal data is processed to operate membership and accounts, publish maker profiles and products, improve user experience, respond to support requests, ensure platform security, comply with legal obligations, manage possible disputes and send marketing communications where you have given explicit consent.

4. Legal grounds

Data is processed on the legal grounds in Article 5 of the KVKK: necessity for concluding or performing a contract, compliance with legal obligations, establishment, exercise or protection of a right, necessity for legitimate interests and, where required, explicit consent.

Explicit consent for marketing communications and non-essential analytics/advertising cookies is obtained separately and is not a condition of membership or service provision.

5. Collection and international transfers

Data is collected electronically through membership, profile and product forms, contact fields, cookies, logs and support requests.

Data may be disclosed to authorised public bodies and courts following a duly made request. The services identified in the code, their purposes and verified or unconfirmed processing regions are listed below:

• Lovable Cloud — database, authentication, file storage and first-party analytics records. Connection configuration contains the region indicator eu-central-1; this alone does not establish where data is processed or stored. Processing and storage countries/regions require separate confirmation. Purpose: storing accounts, profile and product content, files, support and usage records and operating the service.
• Lovable hosting / Cloudflare delivery infrastructure — website delivery, request processing and content distribution. The infrastructure supports global delivery; no single request-processing country is fixed in the code and exact processing countries have not been verified. Purpose: delivering pages and images, availability and technical security.
• Lovable managed email service — sending transactional, support and consented commercial emails; processing email addresses, message content and delivery records. Processing country/region and underlying provider could not be verified from the code. Purpose: account and application communications, support replies and notifications consistent with communication preferences.
• OpenAI models through Lovable AI Gateway — administrator-initiated translation and text generation. Product, profile and event text and personal data included in it may be processed. Processing country/region could not be verified from the code; the model name does not establish data residency. Purpose: multilingual content and administrative text assistance.
• Meta (Facebook / Instagram / WhatsApp) — Meta Pixel for advertising measurement only after cookie acceptance; images, captions and maker usernames for administrator-initiated social posts; phone numbers, messages and submitted media in WhatsApp workflows. Exact processing countries/regions could not be verified from the code. Purpose: measuring advertising impact, promoting makers/products and user-initiated WhatsApp communication.
• Google / YouTube — Google sign-in if selected by the user; YouTube player after the user starts playback; video uploads and channel reads through authorised publishing workflows. Depending on the service selected, identity/account details, IP/device information or video and its description may be processed. Processing countries/regions could not be verified from the code. Purpose: authentication, video viewing and authorised video publication. Google Analytics and Google Tag Manager are not used.
• Pinterest — product images, titles, descriptions and links are sent during administrator-initiated or configured automatic Pin publishing. Processing country/region could not be verified from the code. Purpose: product promotion on Pinterest. No Pinterest tracking tag is loaded when the site opens.

A provider's name, API address or a cookie choice does not by itself establish a lawful international-transfer mechanism. The applicable basis under Article 9 of the KVKK, safeguards where required and the provider's contractual terms must be assessed for each transfer; no unverified standard contract, adequacy decision or safeguard is represented as being in place.

The name/profile name, city, biography, product content and social media/contact links you choose to make visible on your maker profile are published publicly.

6. Your rights and applications

To exercise your rights under Article 11 of the KVKK, including information, access, correction, erasure/destruction, learning about transfers and objection, you may apply to merhaba@tospika.com with the information and documents necessary to verify your identity, or submit a written application to the address above. Applications are handled within the periods and procedures prescribed by law.

In the event of a dispute, the Turkish text shall prevail.