Personal Data Processing Notice

Version date: 7 October 2026 · 2026-10-07-r3

This English translation is provided for information only. In the event of any discrepancy between the Turkish and English versions, the Turkish version shall prevail.

1. Data controller

Under Turkish Personal Data Protection Law No. 6698 (the “Law”), the data controller is Gloyd Teknoloji Anonim Şirketi, the operator of the Glodely platform.

• Address: İlkbahar Mah. Güneypark Küme Evleri No:19B/12, 06550 Çankaya/Ankara, Türkiye
• Email: kvkk@glodely.com | Telephone: +90 850 840 65 78
• Registered electronic mail (KEP): gloydteknoloji@hs01.kep.tr

This notice covers processing relating to visitors, guest users uploading files, members, customers, organisation representatives, delivery recipients and requesters. It provides information and is not a request for explicit consent.

2. Collection of data

A file opened only on the device in the Gerber viewer is not sent to Gloyd's servers. Files uploaded when continuing to obtain a price or configure an order are subject to the collection, processing and sharing rules below.

Personal data is collected through the website, account and order forms, file upload areas, emails and written requests, and automated transaction, measurement and security records. This includes representative and delivery information supplied by organisation owners, administrators or customers, and transaction results received from banking, electronic document and shipping services. On collection from the office, the recipient's previously supplied first and last names are compared with the information on the identity document presented. Collection takes place by wholly or partly automated means, or by non-automated means forming part of a data recording system.

Sign-in is available using an email address and verification code, a password, Google or LinkedIn. If Google or LinkedIn sign-in is selected, the provider supplies the name, email address and email verification information, which are used to create or link the account and enable sign-in. Relevant verification, device and contact information is processed for optional two-step verification and security notifications when a new device is used to sign in.

3. Data processed, purposes and legal bases

Activity and data category	Purpose	Legal basis
Account and customer transactions: name, contact, account, authentication, product selection, order, payment and delivery information; technical files containing personal data.	Providing the account service to an individual customer; entering into and performing the requested sale.	Article 5(2)(c) of the Law: necessity for entering into or performing a contract.
Saved cards: the bank's token reference and masked card number.	Providing the saved-card payment facility selected by the customer. The card is stored by the bank; Gloyd does not store the full card number or security code.	Article 5(2)(c) of the Law.
Organisation representatives, members and delivery recipients: identity, contact, workspace membership, authority and identity verification information concerning the match of the recipient's first and last names.	Maintaining corporate communications; ensuring workspace membership, authorised transactions and correct delivery.	For persons who are not parties to the contract, Article 5(2)(f) of the Law: necessity for legitimate interests, with regard to fundamental rights and freedoms.
Financial and commercial records: invoice, tax, accounting and mandatory commercial document information.	Fulfilling document preparation and retention obligations under the Tax Procedure Law, Turkish Commercial Code and electronic document legislation.	Articles 5(2)(a) and 5(2)(ç) of the Law: express provision by law and compliance with a legal obligation.
Payment records: payment results, collection and refund records, bank references.	Making and matching payments; reconciliation.	Article 5(2)(c) of the Law; Article 5(2)(ç) for mandatory financial records (Tax Procedure Law Articles 229-232 and 253, Turkish Commercial Code Article 82); Article 5(2)(e) for evidence in a transaction dispute.
Transaction evidence and disputes: contract acceptance, pre-contractual information confirmation, notification delivery and dispute records; date, IP and browser information necessary as evidence.	Establishing, exercising or protecting a right.	Article 5(2)(e) of the Law.
Security: IP, device, browser, session, permissions, access, security incident and technical connection records.	Platform and account security, new-device notifications and prevention of misuse.	Article 5(2)(f) of the Law; Article 5(2)(e) for the part constituting evidence in a specific dispute.
Cookieless analytics and performance: page path with order numbers and link codes replaced by placeholders and the query string removed; the referring site's address (browsers mostly pass only its origin); country, device type, operating system, browser, page loading and response times.	Assessing service usage and improving website performance through Vercel Web Analytics and Speed Insights.	Article 5(2)(f) of the Law: necessity for Gloyd's legitimate interests, provided that fundamental rights and freedoms are not harmed.
Support: messages, attachments and request information; necessary third-party information in technical files.	Resolving contract-related requests, corporate communications, assessing claims and carrying out the work.	Article 5(2)(c) for the customer's own contract; Article 5(2)(f) for communications with organisation representatives and necessary third-party information; Article 5(2)(e) for claims.
Personal data requests: identity, contact, request and response information.	Fulfilling the obligation to handle requests under Article 13 of the Law.	Article 5(2)(ç) of the Law.

Analytics and performance measurement runs only on the production website; sign-in, registration, operator and administration pages are excluded. These tools do not write cookies or other information to the device and do not track users across other websites.

Special categories of personal data are not requested as part of the service. Technical files and correspondence should not contain personal information unnecessary for the work. Cookies and other device storage tools used for account sessions, security and user-initiated actions are explained in the Cookies Policy.

4. Recipients of data

Domestic disclosures are limited to the purposes and legal bases above and are carried out in accordance with Article 8 of the Law. Recipient groups and service providers receiving data necessary for the transaction are listed below.

Recipient	Scope and purpose of disclosure
Türkiye Garanti Bankası A.Ş. and QNB Bank A.Ş.	Payment amount, order, bank and transaction references; virtual POS collection using 3D Secure, payment verification, saved-card services and refunds.
QNB eSolutions Elektronik Ticaret ve Bilişim Hizmetleri A.Ş. and the Turkish Revenue Administration	Identity, tax, address and order line information; issuing and transmitting e-Invoices, e-Archive invoices and e-Delivery Notes. QNB eSolutions is not a payment collection recipient.
Yurtiçi Kargo Servisi A.Ş.	The recipient's name, address, telephone number and shipment information; delivery and returns within Türkiye.
Production and component suppliers	Technical files, product specifications and transaction references; preliminary review, pricing and production. The current PCB and SMD stencil production recipient is JiaLiChuang (HongKong) Co., Limited.
AWS Turkey Pazarlama Teknoloji ve Danışmanlık Hizmetleri Limited Şirketi / Amazon Web Services	Lightsail object storage for uploaded files and generated documents; technical connectivity through two egress servers. Egress servers log only the time, destination, duration and size of a connection; its contents are not viewed.
Databricks, Inc. / Neon	Account, permission, order, financial and file information; database services.
Vercel Inc.	Application requests, transaction and error records; operation of the platform. Also, the measurement data described in section 3; usage and performance measurement through Web Analytics and Speed Insights.
Plus Five Five, Inc. / Resend	Email addresses, message contents and attachments; sending account, security and order notifications.
Google Cloud EMEA Limited / Google Workspace	Email addresses, message contents and attachments; handling support correspondence and requests.
Google and LinkedIn sign-in providers	Information necessary for sign-in connections and authentication when the user selects one of these sign-in methods.
Cloudflare, Inc. / Turnstile	IP, browser and connection information; form checks, bot detection and transaction security.
Competent public authorities and judicial bodies	Information and documents required by statutory obligations and authorised requests.

The customer's name, address, email address and telephone number are not sent to the overseas warehouse, the domestic carrier in China or the international carrier. Products are transported using the Glodely order number and Gloyd's contact details. An order number can be linked to a customer through Gloyd's records and is therefore not considered anonymous. Gloyd handles import and customs formalities, as the importer, for products arriving in Istanbul by international air freight; necessary recipient details are shared with Yurtiçi Kargo for domestic delivery, or products are collected from the office.

5. Overseas services

Service provider and function	Processing or access locations	Role
Vercel Inc.: application hosting, usage and performance measurement services.	The application runs in Frankfurt, Germany. According to the provider, the primary processing location is the United States.	Processor on Gloyd's behalf.
Neon: database services; the contracting entity is Databricks, Inc.	The database is in Frankfurt, Germany; the provider is a US company.	Processor on Gloyd's behalf.
Amazon Web Services: file storage and technical connectivity; the contracting entity is AWS Turkey.	The Lightsail object store and two egress servers are in Frankfurt, Germany. Egress server logs are limited to the time, destination, duration and size of connections; their contents are not viewed.	Processor on Gloyd's behalf in Türkiye, processing the data through its sub-processor in Germany.
Plus Five Five, Inc. / Resend: sending transactional emails.	Sending takes place in Ireland; records are stored in the United States.	Processor on Gloyd's behalf.
Google Cloud EMEA Limited / Google Workspace: support emails.	Ireland.	Processor on Gloyd's behalf.
Cloudflare, Inc. / Turnstile: form checks.	Data is transferred to the US-based provider and accessed from infrastructure used to provide the service.	Processor acting on Gloyd's behalf for form checks; controller for improving its own bot detection.
JiaLiChuang (HongKong) Co., Limited: PCB and SMD stencil preliminary review and production.	Files sent to the Hong Kong production partner may be stored on infrastructure in Germany and accessed from China.	Controller for its own commercial transactions. Access from its affiliates in the People's Republic of China is also part of this transfer.

Files may be transferred to the production partner during preliminary review before a sales contract is concluded, including during guest use. Personal data contained in the files is included in the transfer. Using a transaction reference instead of customer contact details does not make linkable records anonymous.

For transfers abroad, the transfer conditions of Article 9 of the Law apply in addition to the processing condition stated above for the relevant activity. Gloyd works with the providers that process data on its behalf under each provider's own data processing agreement and the safeguards in it. Accepting the sales contract or uploading a file does not constitute explicit consent to a transfer abroad.

6. Retention periods

Record category	Retention period
Contracts, orders, invoices and mandatory commercial records	10 years from the end of the relevant calendar year. The date, IP and browser information necessary to evidence acceptance and pre-contractual information, together with dispatch and delivery records for contract and transaction notifications, are retained with these records.
Production files and working copies	2 years after the order is closed. Records forming a necessary part of a mandatory commercial document or a specific legal claim are separately preserved for the relevant period. A cancelled order counts as closed on the day it is cancelled. Message attachments of completed orders are deleted within 30 days after closure of the workspace or the last authorised member's account.
Account profile and personal file library	While the service continues; deletion or destruction from active systems within 30 days after account closure. Active sessions end when the account is closed.
Organisation's shared file library	While the relevant workspace remains open; deletion or destruction from active systems within 30 days after closure of the workspace or the last authorised member's account.
Guest session	Expires 72 hours after the last activity.
Support correspondence	3 years after closure of the request.
Routine security and access logs, including operators' access to customer identity data	2 years after creation of the record.
Audit records of operator actions	10 years, together with the records they evidence; the IP address in these records is deleted after 2 years.
Personal data requests and responses	2 years after the response is provided.
Deletion and destruction records	At least 3 years after the operation.

Records necessary for a specific dispute or an ongoing statutory obligation may be retained separately, limited to that purpose. When the conditions for processing no longer exist, data is deleted, destroyed or anonymised. Cookie and device storage periods are stated in the Cookies Policy.

The profile and sign-in information of a person whose account is closed is subject to the closure process even if other members' accounts remain open. The organisation's shared order documents may continue to be retained for access by authorised users and statutory retention obligations.

In Neon and Vercel services, restricted-access backup copies of data deleted from active systems may be retained for up to a further thirty days. Resend retains sent emails and sending logs for thirty days and their backups for a further seven days. Backups are not used for ordinary operations; if restored, records due for deletion are deleted before being made available for use again. Copies retained by suppliers, banks, electronic document integrators and carriers as independent controllers are subject to their own statutory retention obligations.

7. Rights and requests

You may exercise your rights under Article 11 of the Law to obtain information, request correction, request deletion or destruction where the conditions are met, request notification of relevant operations to recipients, object to outcomes of automated analysis, and seek compensation for damage.

You may submit a written request to our address above, to our registered electronic mail address, using a secure electronic signature or mobile signature, or by emailing kvkk@glodely.com from an email address previously provided to us and recorded in our system. The request must include your first and last names, your signature for a written request, your Turkish identity number for Turkish citizens, your nationality and passport number or identity number, if any, for foreign nationals, your address for service and the subject of your request.

Requests are answered in writing or electronically as soon as possible and within thirty days at the latest. Requests are generally free of charge; if additional costs arise, the Board's tariff may apply. If your request is rejected, the response is inadequate or no timely response is given, you may complain to the Board within thirty days of learning of the response and, in any event, within sixty days of your request.

8. Data security

Gloyd takes the following measures to protect personal data: data is encrypted in transit; access to personal data is limited to authorised persons who need it for their duties, and two-step verification is mandatory for operator accounts; operator actions and operators' access to customer identity data are logged; the database is protected by the restore facilities offered by its provider.

If Gloyd learns that personal data has been obtained by others through unlawful means, it notifies the Personal Data Protection Board without delay and within 72 hours at the latest from learning of it, and informs the affected data subjects as soon as reasonably possible after identifying them.