Personal Data Protection Notice (KVKK)
Last updated: 27 October 2026
This is an English translation provided for convenience. In case of any discrepancy, the Turkish version prevails.
As data controller under Turkish Personal Data Protection Law No. 6698 (“KVKK”), PNET Bilişim LTD ŞTİ (“Buluto”) explains how and why it processes your personal data and what your rights are.
1. Data controller
| Legal name | PNET Bilişim LTD ŞTİ |
|---|---|
| Brand | Buluto |
| Address | Çınarlı mah. Önder cad. No:76 D:8 Derince/KOCAELİ |
| Tax office / number | Derince / 7300393094 |
| Phone | 08508851453 |
| [email protected] | |
| Website | https://buluto.com |
2. Data we process
Identity (name, Turkish ID number for individual invoices and .tr domains), contact (email, phone, address), customer transactions (orders, invoices, services, domains, support tickets, contact form messages), finance (invoice and payment records, tax details, IBAN for refunds — card numbers are not stored), transaction security (IP address, session and login records, browser data, logs) and marketing preferences (only with your consent).
3. Purposes and legal bases
Performance of the contract (account, orders, provisioning, domain and SSL registration, invoicing, payments, support); legal obligations (tax and commercial records, retention of hosting traffic data under Law No. 5651, requests of authorities); legitimate interest (information security, fraud and abuse prevention, service quality, replying to contact messages); establishing or defending legal claims; and explicit consent for marketing messages, which you can withdraw at any time.
4. Transfers
Data may be shared, limited to these purposes, with our domain registrar partner and registries (TRABİS for .tr), payment institutions and banks, our e-invoice provider and accountants, SMS and email delivery providers, SSL certificate authorities, and competent public authorities. Registering generic domains (.com, .net etc.) and issuing SSL certificates requires transferring data to registries and certificate authorities abroad; these transfers rely on Article 9 KVKK (occasional transfers necessary for performance of the contract, or appropriate safeguards such as standard contracts).
5. Retention
Invoices and accounting records: 10 years; hosting traffic data: as required by Law No. 5651; account and service records: during the contract and the limitation period afterwards; contact form messages: up to 2 years after reply. Expired data is deleted, destroyed or anonymised.
6. Your rights and how to apply
Under Article 11 KVKK you may ask whether your data is processed, request information, learn the purpose and recipients, request correction or deletion, object to automated decisions against you and claim compensation for unlawful processing. Apply in writing to Çınarlı mah. Önder cad. No:76 D:8 Derince/KOCAELİ or from your registered email to [email protected]. Requests are answered free of charge within 30 days.