The Turkish text is binding
This English version is a translation provided for convenience only. If there is any difference between the two, the Turkish text prevails.
Privacy Notice on the Protection and Processing of Personal Data (KVKK)
Under Personal Data Protection Law No. 6698
Version: 2.1 · Last updated: September 19, 2026
1. Data Controller
Under Personal Data Protection Law No. 6698 (the "KVKK"), your personal data may be processed by PUU FU CLOUDS GIDA VE TATLICILIK A.Ş., as the data controller, for the purposes explained below. Company Address: Çengelköy Mh. Şehit Kader Sivri Sk. NO:4 ÜSKÜDAR İSTANBUL Email: info@puufu.com.tr Telephone: 0 551 664 74 49 Website: www.puufu.com.tr
2. Personal Data Processed
If you use our website, create a membership, purchase digital materials or contact us, the following categories of personal data may be processed, depending on the nature of the transaction: - Identity information: first name, last name - Contact information: email address, telephone number - Username: unique user name - Visual data: the photo you upload for image generation and the image created as a result of the generation - Transaction information: order, purchase, product and service information - Customer transaction information: order history, request and complaint information - Billing information: invoice details and, where necessary, tax information - Transaction security information: IP address, session information, log records, device and browser information - Marketing information: campaign and communication preferences - Legal transaction information: information on requests, applications, disputes and legal proceedings The Company may not store all of the credit/debit card details used during payment. If payment transactions are carried out through a payment institution or bank infrastructure, data relating to the payment transactions may be processed under the relevant payment service provider's own legislation and privacy policies.
3. Purposes of Processing Personal Data
Your personal data may be processed for the following purposes: creating and managing your membership account, receiving and processing your order, assigning the digital material you purchased to your account or delivering it electronically, carrying out payment and invoicing, providing customer support, answering your requests/questions/complaints and applications, carrying out sales and after-sales processes, ensuring information security and system security, preventing fraud and abuse, creating and storing transaction records, fulfilling the Company's legal and financial obligations, meeting the requests of authorized public institutions and organizations, exercising and protecting rights in possible disputes, ensuring that the website works securely and properly, improving the user experience and fulfilling obligations arising from the legislation. Your personal data is processed limited to the purposes stated here and in accordance with the basic principles of the KVKK.
4. Legal Grounds for Processing Personal Data
Depending on the nature of the specific processing activity, your personal data may be processed under one or more of the following legal grounds set out in Article 5 of the KVKK: - It is expressly provided for in laws - It is directly related to the establishment or performance of a contract, and processing the personal data of the parties to the contract is necessary - It is mandatory for the data controller to fulfil its legal obligation - Data processing is mandatory for the establishment, exercise or protection of a right - Data processing is mandatory for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject - Other legal grounds provided for in the law - Your explicit consent, where necessary Data processing activities that require explicit consent are carried out separately from mandatory data processing activities.
5. Methods of Collecting Personal Data
Your personal data may be collected electronically through the membership and account creation forms on our website, order and payment processes, digital product delivery processes, contact and support forms, email and other communication channels, cookies and similar technologies, system and server logs, and authorized third-party service providers.
6. Parties to Whom Personal Data May Be Transferred
Your personal data may be transferred, limited to the relevant processing purpose and to the extent necessary, to payment service providers and banks, e-invoice/e-archive and accounting service providers, information technology, server, hosting and cloud service providers, artificial intelligence-based image processing service providers so that the image generation service can be offered, email and communication service providers, technical support and software service providers, persons and organizations from whom legal, financial advisory and consultancy services are received, authorized public institutions and organizations, and private law persons authorized by law. The necessary legal and technical conditions provided for in the KVKK are applied depending on the nature of the transfer.
7. Transfer of Data Abroad
The server, database and file storage infrastructure on which our website runs is provided by cloud service providers established abroad. For this reason, your personal data, including your membership and transaction information and the images created as a result of generation, is hosted and processed on servers located abroad. In addition, if the software, email, analytics or similar services we use are provided by service providers located abroad, your personal data may also be transferred abroad. If such a transfer takes place, the provisions of the KVKK on the transfer of data abroad in force on the date of the transfer and the related secondary legislation are taken into account. Where data must be transferred abroad, the legal conditions of the transfer are assessed separately and the necessary security measures are applied. When you use the "Create from a photo" mode, the photo you upload is transferred to an artificial intelligence-based image processing service provider established abroad for the purposes of content review and image generation. This transfer is based, under Article 9(6)(a) of the KVKK, on your explicit consent, obtained separately for each generation, provided that you are informed about the possible risks. The country of transfer may not have a level of personal data protection equivalent to that in Turkey; your photo becomes subject to that country's legislation and it may become harder for you to exercise your rights there. Not giving explicit consent does not prevent you from using the service: you can use the "Design It Yourself" mode without uploading a photo; no photo is transferred in this mode.
8. Cookies and Similar Technologies
Cookies and similar technologies may be used to ensure our website works securely, to perform basic functions, to improve the user experience and, where necessary, to carry out analytics/marketing activities. Our site currently uses only essential cookies and records that remember settings you chose (e.g. language); no cookie that depends on your explicit consent is used. Visit and performance statistics of the site are measured with Vercel Web Analytics and Speed Insights (Vercel Inc.), which do not use cookies or local storage; visitors are counted with a hash value that is reset every day and are not tracked individually. If you turn on browser notifications (this is possible without signing up), the notification subscription created by your browser (endpoint address and encryption keys), browser information and your language preference are stored so that notifications can be sent. This record is deleted when you turn notifications off. Notifications turned on without signing up are only for campaigns and announcements. Detailed information on cookies is available in our Cookie Policy (www.puufu.com.tr/en/legal/cookies).
9. Marketing and Commercial Electronic Messages
Sending commercial electronic messages for marketing purposes, such as campaigns, discounts, new products or similar, by our Company depends on having the necessary permissions under the relevant legislation. Where required for marketing communication, your explicit consent or the appropriate permission mechanism provided in the legislation is obtained separately. Being given this notice alone does not mean that you have allowed marketing messages to be sent. Turning on browser notifications with the notification (bell) button on the home page without signing up means that you agree to receive campaign and announcement notifications; you can withdraw this permission at any time by removing the notification permission in your browser settings.
10. Retention Period of Personal Data
Your personal data is stored for the retention periods prescribed by the relevant legislation or for as long as the purpose of processing requires. The photo you upload for image generation is not stored permanently: it is kept temporarily in a private storage area closed to the outside only for the duration of the relevant generation and is deleted as soon as the generation is completed — even if the generation fails. Copies that cannot be deleted because of a technical problem are automatically cleaned up within 24 hours at the latest. The image created as a result of the generation is kept in your gallery until you delete it or close your account. When the retention period ends or the legal reason requiring the processing of personal data no longer exists, personal data is deleted, destroyed or anonymized in accordance with the relevant legislation and our Company's retention and destruction policies.
11. Security of Personal Data
Our Company endeavors to take technical and administrative measures appropriate to the nature of the data processed in order to prevent unlawful processing of and access to personal data and to ensure its safekeeping. In this context, access authorizations, secure connection methods, system security, access logs and other necessary security practices may be used.
12. Rights of the Data Subject
Under Article 11 of the KVKK, data subjects have the following rights: - To learn whether their personal data is processed - To request information if their personal data has been processed - To learn the purpose of processing their personal data and whether it is used in accordance with that purpose - To know the third parties to whom personal data is transferred, in Turkey or abroad - To request correction of their personal data if it is incomplete or inaccurate - To request deletion or destruction of their personal data within the framework of the conditions provided in the KVKK - To request that correction, deletion or destruction be notified to third parties to whom personal data has been transferred - To object to the occurrence of a result against them by analysis of the processed data exclusively through automated systems - To request compensation for damage if they suffer damage due to unlawful processing These are the rights that data subjects hold.
13. How to Apply
You can send your requests under the KVKK to our Company at: Email: info@puufu.com.tr Postal Address: Çengelköy Mh. Şehit Kader Sivri Sk. NO:4 ÜSKÜDAR İSTANBUL or through the other application methods provided in the KVKK legislation. Your applications are assessed in accordance with the periods and procedures prescribed in the KVKK and the related legislation.
14. Entry into Force
This Privacy Notice has been prepared under Personal Data Protection Law No. 6698 and the related legislation. This text may be updated in line with changes in the legislation or in our Company's data processing activities. PUU FU CLOUDS GIDA VE TATLICILIK A.Ş.