Privacy Policy

1 Information We Collect

When you access or use VERBİ Sistem, we process the following categories of data:

Account and Contact Details

• Full name of authorized representatives and staff users
• Institutional email addresses
• Official phone numbers
• Organization / charity legal name and registration details
• User roles, access tiers, and permissions

Technical and Telemetry Data

• IP address and approximate geographic location
• Browser type and version
• Operating system and device metadata
• Session timestamps, audit logs, and security telemetry
• System performance logs and error diagnostic records

Service Data

Any content, campaigns, news updates, operational records, tasks, and system preferences uploaded or configured by institutional administrators to operate their multi-tenant portal.

2 Payment Data & Merchant of Record (Paddle)

VERBİ Sistem does not directly collect or store complete credit card or debit card numbers, expiration dates, or CVV/CVC security codes on its servers.

All subscription transactions are processed by Paddle.com Market Ltd, operating as our Merchant of Record. Paddle processes transactions via PCI-DSS Level 1 certified infrastructure.

Paddle transmits only necessary transactional metadata to VERBİ Sistem, including transaction IDs, order status, subscription renewal dates, buyer email, and customer billing country to enable account provisioning and lifecycle management.

3 How We Use Collected Data

Data processed by VERBİ Sistem is used exclusively for legitimate business and technical operations:

• Provisioning and maintaining dedicated NGO software tenants
• Managing software licensing, upgrades, and billing status
• Delivering responsive customer service and technical support
• Safeguarding platform infrastructure, mitigating fraud, and blocking unauthorized access
• Complying with statutory accounting, tax, and reporting obligations

4 Legal Bases for Processing

We process personal data in compliance with applicable data protection regulations (including the Turkish Personal Data Protection Law — KVKK and the European GDPR) under the following legal bases:

• Performance of Contract: To provision and deliver subscribed SaaS features
• Legal Obligation: To maintain required commercial and tax records
• Legitimate Interests: To detect security incidents and maintain platform uptime
• Consent: Where explicitly provided for optional communications

5 Third-Party Service Providers

We engage trusted, reputable third-party infrastructure providers to support platform operations:

• Merchant of Record & Payments: Paddle.com Market Ltd
• Cloud Hosting & Databases: Certified European cloud infrastructure providers with encrypted at-rest storage
• Transactional Communications: Encrypted SMTP & SMS gateway providers

All third-party vendors are bound by strict confidentiality and data processing standards.

6 Data Security and Retention

We employ robust technical safeguards including TLS 1.3 encryption in transit, AES-256 encryption at rest, tenant-level data isolation, role-based access control (RBAC), and automated offsite backups.

Data is retained only as long as necessary to fulfill the operational purposes of the active subscription or to comply with mandatory statutory retention periods.

7 Your Data Protection Rights

Depending on your jurisdiction, you possess the right to:

• Request access to your personal information
• Request rectification of inaccurate or outdated records
• Request deletion (erasure) of personal records where legally permissible
• Request data portability in structured, machine-readable formats
• Object to or restrict specific processing operations

To exercise any of these rights, please email us at support@verbisistem.pro or founder@nimedya.com.

8 Data Controller & Contact Details