Back to Home

Privacy Policy and Personal Data Notice

Last updated: 7 October 2026

SMM Bridges · Operator: Furkan Görür — sole proprietorship · Tax ID (VKN): 4100313677 · Phone: +90 536 588 35 37 · Registered address: Bağlar Mahallesi, Hakan Kurtulan Sokak No. 200, Unit 8, Reyhanlı/Hatay, Türkiye

1. Controller and scope

SMM Bridges at smmbridges.com is operated by Furkan Görür, a sole proprietorship. Furkan Görür is the controller for the processing described here. Tax ID (VKN): 4100313677. Registered address: Bağlar Mahallesi, Hakan Kurtulan Sokak No. 200, Unit 8, Reyhanlı/Hatay, Türkiye. Phone: +90 536 588 35 37. This notice covers visitors, members, customer-panel users and people contacting support.

  • Applications may be submitted in writing to the registered address, by phone or through the Support Panel for an existing account.
  • This is a transparency notice, not a consent form. Visiting the site, creating an account or reading this page does not constitute explicit consent. Where consent is required, the particular purpose and scope must be explained and a separate, freely given choice obtained.

2. Service and processing scope

This notice covers personal-data processing for membership, optional third-party account sign-in, the customer panel, catalog, orders, payments and support.

  • The data processed depends on the features you use and transactions you perform. Listing a category here does not mean it is collected from every visitor. New categories or purposes require appropriate information.

3. How information is collected

Information is obtained electronically through registration/sign-in forms, third-party authentication, panel actions, support requests and messages, and technical connection records.

  • You provide account and support content directly. The identity provider supplies the basic account information you authorize in its sign-in flow. Authentication and hosting infrastructure generate session and connection records. Payment/order providers may supply transaction status in connection with the relevant transactions.
  • We do not request your social-media password, one-time login code, private key or recovery code. Do not include these, or unnecessary information about other people, in support messages.

4. Categories, purposes and legal grounds

The appropriate legal ground is assessed for each activity. Information is limited to what the purpose requires, rather than using every category for every purpose.

  • Account and identity: account identifier, name/display name, email, and, for external-account sign-in, profile image and identity-provider information. These support account creation, authentication and panel access under contractual necessity in Article 5(2)(c) of Law No. 6698 (KVKK).
  • Support: ticket number, subject, messages, transaction reference and timestamps. These support resolving your request under Article 5(2)(c), and preserving necessary evidence for legal claims under Article 5(2)(e). Unnecessary information in a message does not expand these purposes.
  • Technical/security: IP address, connection time, session identifier, browser/device information and access/error records. These support preventing attacks and unauthorized access under Article 5(2)(f), subject to your fundamental rights, or Articles 5(2)(a)/(ç) where an applicable legal recordkeeping duty exists. IP addresses are not used for precise location tracking.
  • Orders: category, service type, product, target social-media URL, quantity, price/currency, provider reference and delivery status support performance and tracking under Article 5(2)(c), and claims under Article 5(2)(e).
  • Payments: amount, currency, transaction reference/status and required invoice information support performance under Article 5(2)(c), tax/accounting duties under Articles 5(2)(a)/(ç), and claims under Article 5(2)(e). Support does not request card security codes or online-banking passwords.
  • Marketing or nonessential tracking, if introduced, will require separate information and any applicable explicit consent/commercial-message approval. Membership is not conditional on those choices. This notice is not marketing permission.

5. External-account sign-in

External-account sign-in is optional authentication. Basic profile and email information within the scope shown on the sign-in screen are linked to your account.

  • It does not authorize reading email messages, cloud files, contacts or social-media accounts. You can manage permissions in the relevant provider’s account settings. Revoking permission does not automatically delete your SMM Bridges account or records that must legally be retained.
  • The identity provider’s independent processing is governed by its own privacy terms. This does not remove SMM Bridges’ responsibility for its own processing.

6. Recipients and sharing purposes

Access is limited by role and operational need. Selling or renting personal information is not part of this service.

  • Authentication and database providers process account, panel and support records needed to operate membership, sessions and application data. Hosting and technical infrastructure providers serve the application and process connection/security records. External sign-in providers handle the account verification you initiate.
  • Digital-service suppliers: target URL, service, quantity and transaction references needed for fulfillment may be sent. Account passwords, external-account access credentials and support correspondence are not sent as order data unless an independently lawful and necessary basis exists; they are not needed for ordinary order fulfillment.
  • For payment and invoicing transactions, necessary transaction information may go to the relevant bank/payment provider and accounting professionals. Disclosure to authorities and courts is limited to lawful requests and applicable duties.
  • Domestic and international sharing must separately meet Articles 8 and 9 of KVKK. Engaging a provider does not authorize sharing every customer record with every recipient.

7. International processing and transfers

External authentication, database and hosting services can involve processing outside Türkiye or access from abroad. A provider’s name does not establish that information remains in Türkiye.

  • Transfers require an applicable processing ground and the relevant Article 9 mechanism: an adequacy decision, appropriate safeguards or a narrowly applicable incidental-transfer exception. Ongoing cloud use must not be assumed lawful simply because a user visits the site or gives general consent.
  • This notice does not certify that a standard contract has been signed/notified, that an adequacy decision exists for a particular country, or that a provider automatically meets all legal requirements. Actual locations, subprocessors and the applicable transfer mechanism require separate documented verification by the business.

8. Cookies and browser storage

Browser storage supports session continuity and language preferences. Cookies and localStorage are distinct technologies, both of which may store information on your device.

  • smmb-lang is a first-party preference cookie storing TR/EN for one year. Initial language follows browser preferences and can be changed using the language control. An existing valid localStorage language preference is migrated to the cookie and the old entry removed.
  • The authentication service uses browser localStorage for session persistence and renewal. Ending a session/signing out is different from deleting the server-side account and historical records. Sign out on shared devices.
  • The current application code does not include an advertising or analytics tracking tool. If one is added, necessary information and preference controls must be provided before nonessential tracking starts.
  • You can delete cookies and site storage through browser settings. This may require signing in again or reselecting your language. Cookies on third-party sign-in pages are subject to that provider’s terms.

9. Retention and deletion

Data is not collected for indefinite retention. Retention depends on account/service needs, record type, applicable tax/commercial rules, legal claims and limitation periods.

  • Account information is kept as needed for membership. Support/security records are kept as needed to resolve requests, investigate security incidents and protect rights. Future invoice/transaction records are subject to their own statutory requirements. There is no single unlimited period for all information.
  • When all processing grounds cease, data must be deleted, destroyed or anonymized under Article 7. Closing an account does not require immediate destruction of legally necessary records; the grounds and scope of continued retention should be explained when responding to a request.
  • Backups remain subject to access limits and disposal procedures. Hiding or archiving a panel record is not equivalent to deleting personal data.

10. Security and incidents

Authentication, user-specific access and separate administrator authorization are implemented. Users access their own order/support records; authorized administrators can access records necessary for their duties.

  • Technical and organizational measures are assessed against risk. No internet system can guarantee absolute security. Report suspicious access through support and do not share your credentials.
  • If an incident is identified, its scope and affected information are assessed and applicable notifications/remedial steps must follow Article 12 and relevant Board decisions. This clause is not a certification or a representation that an external audit has been completed.

11. Your KVKK rights

Subject to statutory conditions and exceptions, Article 11 allows you to apply to the controller to exercise the following rights:

  • Learn whether your data is processed, request information, understand purposes and whether use matches them, and learn the third parties receiving data in Türkiye or abroad.
  • Request correction of inaccurate/incomplete information, request deletion/destruction when legal conditions are met, and request notification of corrections/deletions to recipients.
  • Object to a result against you arising solely from automated analysis and seek compensation for damage caused by unlawful processing.

12. Applications and complaints

You can submit a ticket titled “Personal data request / KVKK” through your existing account or send a written application to Bağlar Mahallesi, Hakan Kurtulan Sokak No. 200, Unit 8, Reyhanlı/Hatay, Türkiye. Phone: +90 536 588 35 37. These channels do not replace other legally recognized application methods.

  • Specify the information or activity concerned and the right you wish to exercise. Identity, contact and representation details required by the applicable application communiqué must be verified securely and proportionately. Do not send unnecessary identity documents or sensitive information.
  • Requests must be resolved as soon as possible and within 30 days. They are normally free; only fees allowed by the Board’s tariff may apply if additional cost arises. A rejection must be explained.
  • Under Article 14, rejection, an inadequate response or failure to respond allows a complaint to the Board within 30 days of learning the response and in any event within 60 days of the initial application. Judicial remedies remain available.

13. Children, sensitive information and other people

Paid services are intended for people aged 18 or above with capacity to contract. Collecting children’s data or sensitive categories is not the purpose of the service.

  • Do not send health, biometric, political, religious or similar sensitive information in support messages. Public availability of a social-media URL does not authorize unrestricted processing of all information it contains.
  • If you use another person’s target URL, you must have the necessary authority and lawful basis. This does not remove the controller’s own assessment and data-minimization duties.

14. Marketing and automated decisions

Operational notifications are distinct from advertising. Registration is not marketing consent. If commercial messaging is introduced, Law No. 6563 and applicable approval, refusal and Message Management System rules must also be followed.

  • The current panel has no solely automated decision system producing legal or similarly significant effects on individuals. If one is introduced, its scope and your rights must be explained separately.

15. Other laws and updates

The principal framework is Turkish KVKK and related rules. GDPR or another regime applies only where its territorial and material conditions are met; this page is not an unconditional GDPR compliance certification.

  • New features, recipients or purposes may require updates and, where necessary, fresh notice and consent. Updating the page does not retroactively legalize processing or automatically broaden earlier consent.