Privacy Notice

1. Data controller

ENM Teknoloji Sanayi ve Ticaret A.Ş. — Muradiye Mah. Celal Bayar Üniversitesi Kampüsü, Küme Evler Teknokent No: 22, Yunusemre / Manisa, Türkiye. Tax office Mesir, tax number 3350846051. Email: [email protected].

2. Personal data we process

• Identity and contact: first name, last name, email address.
• Account security: password (stored only as a one-way hash; we never have the plain password), two-step verification settings, email verification status.
• Transaction security: IP address, browser and device details, sign-in, sign-out and failed sign-in records, CLI device sessions and access times.
• Customer transactions: license tier, the date you accepted the terms, support correspondence you send us.
• When you purchase: billing details (name or company name, address, national ID or tax number) and order records. Card details are processed by the payment provider; they are not sent to or stored by us.
• Preferences: language and theme (stored in your browser).

3. Purposes

• Creating your account, verifying your identity and managing your sessions,
• Granting access to Pro content according to your tier and checking compliance with the license,
• Running sales, invoicing and accounting,
• Keeping information secure and preventing abuse and unauthorized access,
• Answering support requests and sending mandatory service notices,
• Meeting legal obligations and requests from authorized bodies,
• Establishing and protecting our rights in possible disputes.

4. Legal bases and collection method

Your data is collected electronically and automatically through the sign-up form, sign-in screens, the CLI, email and cookies, and processed on these grounds of Article 5(2) KVKK:

• (c) It is directly related to the formation or performance of a contract (account, license, sale),
• (ç) It is necessary to meet our legal obligations (tax and commercial law),
• (e) It is necessary to establish, exercise or protect a right,
• (f) It is necessary for our legitimate interests, provided it does not harm your fundamental rights (security logs, abuse prevention).

Processing that does not rely on these grounds, such as promotional email, happens only with your separate explicit consent.

5. Transfers

Limited to the purposes above, your data may be shared with:

• Hosting: Account and application data is hosted in a data center in Türkiye (Istanbul).
• Payment provider: at checkout, to process the payment.
• Accountant and e-invoice provider: for invoicing and statutory books.
• Authorized public bodies and courts: when legally required.

Transfers abroad: Servers abroad of our content delivery and security provider (Cloudflare) and our email infrastructure provider (Google) are used to deliver website traffic securely and quickly. These transfers follow the procedures in Article 9 KVKK, including standard contracts and notification.

6. Retention

• Account data: while your account is open; after closure, for the general limitation period for possible disputes.
• Sign-in and security event logs: 30 days.
• Invoices and accounting records: 10 years under the Tax Procedure Law and Turkish Commercial Code.
• Support correspondence: 2 years.

When the period ends, data is deleted, destroyed or anonymized.

7. Cookies and browser storage

We use only what is strictly needed for the website and sign-in to work; we use no advertising or third-party tracking cookies.

• bloxa-locale: remembers your language choice (1 year).
• Theme preferences: kept in your browser's local storage, never sent to the server.
• auth.bloxa.dev session cookies (KEYCLOAK_SESSION, AUTH_SESSION_ID, KC_RESTART, etc.): to let you sign in and keep the session secure; for the session.
• Cloudflare security cookies (e.g. __cf_bm): to tell malicious traffic apart; up to 30 minutes.

You can block strictly necessary cookies in your browser settings; sign-in and some features may then stop working.

8. Security

We protect your data with technical and organizational measures such as encrypted connections (HTTPS), one-way password hashing, account lockout against brute-force attempts, role-based access, admin panels reachable only from a private network, and logging.

9. Your rights

Under Article 11 KVKK you may ask us to:

• Tell you whether your personal data is processed and, if so, give information about it,
• Tell you the purpose of processing and whether data is used for that purpose,
• Name the third parties in Türkiye or abroad your data is transferred to,
• Correct incomplete or inaccurate data,
• Delete or destroy your data under the conditions of Article 7 KVKK,
• Notify third parties your data was transferred to of corrections and deletions,
• Object to a result against you that arises solely from automated analysis,
• Compensate damage you suffer due to unlawful processing.

10. How to apply

Send your request in writing with information that verifies your identity to Muradiye Mah. Celal Bayar Üniversitesi Kampüsü, Küme Evler Teknokent No: 22, Yunusemre / Manisa, Türkiye, or email [email protected] from the address registered on your Bloxa account.

Requests are answered free of charge within 30 days at the latest. If handling the request involves an additional cost, the fee set by the Personal Data Protection Board may be charged.

11. Changes

We may update this notice; the current version is always published on this page and the date at the top changes.