Milore Tekstil Gıda ve Toptan Ticaret Limited Şirketi ("Roicool") uses service providers to run roicool.com, and some of them process data on servers outside Türkiye. This page explains, under Article 9 of Law No. 6698 on the Protection of Personal Data ("KVKK") as amended in 2024, which data goes to whom, to which country and on which basis. The Turkish text prevails.
1. The rules
Under KVKK Art. 9, personal data may leave Türkiye, provided there is a processing condition (Art. 5 or 6):
- to a country for which the Personal Data Protection Board has made an adequacy decision;
- failing that, under one of the appropriate safeguards, in particular the Board's standard contract, notified to the Board within 5 business days of signing;
- failing both, only occasionally and in one of the cases the law lists (for example the explicit consent of a person told of the possible risks).
The Board has not yet made any adequacy decision.
2. The transfers we make
| Service | Provider | Country | Data | Purpose | Basis |
|---|---|---|---|---|---|
| Google Analytics 4 (with consent) | Google Ireland Limited / Google LLC | Ireland, US | Usage data, device and browser data, analytics IDs | Site analytics | Standard contract, Art. 9(4)(c) |
| Google Ads (with consent) | Google Ireland Limited / Google LLC | Ireland, US | Ad click IDs, conversion data, SHA-256 hash of e-mail and phone | Ad measurement | Standard contract, Art. 9(4)(c) |
| Google Tag Manager (web and server-side) | Google Ireland Limited / Google LLC; server: our own server, t.roicool.com (Hetzner Online GmbH) | Ireland, US; Germany (EU) | Passing on the data above | Managing the tags | Standard contract, Art. 9(4)(c) |
| Meta ad measurement (with consent) | Meta Platforms Ireland Limited / Meta Platforms, Inc. | Ireland, US | _fbp, _fbc, ad click IDs, SHA-256 hash of e-mail and phone | Ad measurement | Standard contract, Art. 9(4)(c) |
| Cloudflare (domain, content delivery, firewall, Turnstile) | Cloudflare, Inc. | US and Cloudflare's global network | All site traffic and IP addresses; browser signals for form security | Serving and protecting the Site, form security | Standard contract, Art. 9(4)(c) |
| Encrypted backups (Cloudflare R2) | Cloudflare, Inc. | EU (Cloudflare R2 EU jurisdiction) | Database and media backups, encrypted before upload | Backup against data loss | Standard contract, Art. 9(4)(c) |
| Error monitoring (Sentry) | Functional Software, Inc. | US | Error records; no request bodies, cookies, IP addresses or e-mails | Finding errors in the Site | Standard contract, Art. 9(4)(c) |
| Admin panel AI assistant | Anthropic (default); OpenAI / Google / DeepSeek only if enabled | US; China for DeepSeek | What an editor shares in a question; the content of an inbox request if asked about it | Helping editors | Standard contract, Art. 9(4)(c) |
| Customer relationship management (CRM) | Open-source Twenty on our own server (Hetzner Online GmbH); no separate CRM provider | Germany (EU) | Form requests | Following up requests | Standard contract, Art. 9(4)(c) |
| E-mail delivery | Resend (Plus Five Five, Inc.) | US | Name, e-mail, message content | Report, e-book and reply e-mails | Standard contract, Art. 9(4)(c) |
| Hosting | Hetzner Online GmbH | Germany (EU) | All Site, panel and database data | Running the Site | Standard contract, Art. 9(4)(c) |
| Meetings (Google Meet, Google Workspace) | Google Ireland Limited / Google LLC | Ireland, US | The name and e-mail you give for the meeting, the meeting link | Booking and holding meetings | Standard contract, Art. 9(4)(c) |
Until you allow them in your cookie choices, analytics and marketing tools set no cookies and receive no data that identifies you; in Consent Mode's advanced mode, Google's tags may then send only cookieless, count-only signals without identifiers. Your raw e-mail, phone or name is never passed to ad platforms.
The AI-visibility check runs on the tool of our own product Ossvy, on ossvy.com; Ossvy's own texts apply to what you enter there.
3. Standard contracts
For every transfer that rests on a standard contract, we notify the Board within 5 business days of signing. You can ask for a copy of a contract or for the safeguard we rely on through our data-subject request form.
4. People in the EU and the UK
How data that reaches us from the EU and the UK is protected is explained in our GDPR Privacy Notice.
More detail: KVKK Privacy Notice. All our legal texts are on Legal.