SultanaExpress

Privacy Policy

Last updated: 1 August 2026 · Version 2026-08.1

How we collect, use, and protect your personal information.

Privacy Policy — update specification (delta list against the live policy)

The live policy describes a marketplace that is not running and omits the only processing the site actually performs. Apply the deltas below to the existing 13-section policy; renumber as needed. The TR version is rewritten natively around KVKK apparatus, not translated (see d9).

  1. CONTROLLER. Replace "SultanaExpress ('Company', 'we', 'us') — Istanbul, Turkey" with the full legal identity block (legal.entity.block): registered name, MERSİS, tax office / VKN, address, KEP, info@sultana.express.

  2. ADD a section "Waitlist and lead forms — what we process today", placed first among the processing descriptions: the fields collected per funnel (supplier early access, buyer waitlist, talent pool, investor contact, build updates); purposes; legal bases (explicit consent for marketing; contract / legitimate interest for handling the request); double opt-in; the consent-evidence record (timestamp, salted IP hash, exact text shown, policy version); retention (30-day purge of unconfirmed sign-ups; until-withdrawal for marketing; 12 months talent; 24 months investor); withdrawal route and the one-click unsubscribe link in every email.

  3. REMOVE, or convert to future tense under a "when the platform launches" heading, every processing claim that presumes a live marketplace: account data, profile data, transaction data, verification documents, communications between users, and the 7-year transaction-retention row. The policy must not describe processing that does not exist. (Cures site-leads §4.2(g).)

  4. NAME the processors. Replace generic "trusted service providers" language with the six named processors and their roles: Vercel (hosting/CDN, form handling in fra1 Frankfurt), Neon (lead + consent database, Frankfurt), MailerLite (email delivery + double opt-in, EU), Plausible (cookieless aggregate analytics, Germany), Cloudflare (Turnstile bot defense; note its dual processor/controller role), Sentry (error diagnostics, EU region, session replay off).

  5. CROSS-BORDER. Keep the GDPR SCC paragraph; add the KVKK Art. 9 mechanism: the Board-published standard contracts adopted verbatim, with the filings via the Data Transfer Module within five business days confirmed by counsel before publish.

  6. CONTACT. Replace sc@sultana.express everywhere with info@sultana.express; add the KEP address for formal applications.

  7. RIGHTS. Keep the GDPR rights and the 30-day answer; add the KVKK Art. 11 enumeration and the application procedure (email or KEP per the Application Communiqué). State that unsubscribing requires no formal application.

  8. ANALYTICS. Add one paragraph: traffic is measured with cookieless Plausible on legitimate interest; nothing is stored on the device; an opt-out toggle lives on the Cookies page. Remove any wording that implies consent-gated analytics.

  9. TR VERSION. Rebuild — do not translate. The Turkish policy must use the KVKK apparatus (Law 6698, aydınlatma, açık rıza, veri sorumlusu, Art. 11 application) and link to /legal/kvkk as the authoritative disclosure text. The current TR text is a literal GDPR translation with zero KVKK terminology (site-leads §4.2(b)).

  10. İYS. Add the commercial-message paragraph: consent under Law 6563, İYS-ready consent records, and no commercial email to recipients in Türkiye before İYS registration completes.

  11. VERSIONING. Stamp the policy with a machine-readable version key (e.g. privacy-2026-09-xx); this exact key is written into every consent-evidence row. Refresh "Last updated"; keep a changelog.

  12. SITE CHROME. Link /legal/cookies and /legal/kvkk from the footer of every page (the cookie policy is currently unlinked — site-leads §4.2(e)). No claim of a cookie banner anywhere unless and until one ships.

1. Introduction

SultanaExpress ("Company", "we", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our B2B marketplace platform ("Platform").

We comply with the General Data Protection Regulation (GDPR), the Turkish Law on Personal Data Protection (KVKK), and other applicable data protection laws.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, phone number, company name, job title, and business address
  • Profile Information: Company description, product categories, certifications, and business capabilities
  • Transaction Data: RFQ details, quotes, order information, and payment records
  • Communications: Messages exchanged through the Platform, support requests, and feedback
  • Verification Documents: Business registration, tax ID, and certification documents (for suppliers)

2.2 Information Collected Automatically

  • Usage Data: Pages visited, features used, search queries, and interaction patterns
  • Device Information: Browser type, operating system, device identifiers, and IP address
  • Cookies: Session cookies, preference cookies, and analytics cookies

3. How We Use Your Information

We use collected information for the following purposes:

  • Platform Operation: To provide, maintain, and improve the Platform's features and services
  • Account Management: To create and manage your account, verify your identity, and process transactions
  • Communication: To send transactional notifications, respond to inquiries, and provide support
  • Matching: To connect buyers with relevant suppliers based on product categories and requirements
  • Analytics: To understand usage patterns, generate market insights, and improve user experience
  • Security: To detect and prevent fraud, abuse, and unauthorized access
  • Legal Compliance: To comply with applicable laws, regulations, and legal processes

4. Legal Basis for Processing (GDPR)

We process personal data based on the following legal grounds:

  • Contract Performance: Processing necessary to provide our services
  • Legitimate Interests: Processing necessary for our business interests where not overridden by your rights
  • Consent: Where you have given specific consent (marketing communications, non-essential cookies)
  • Legal Obligation: Processing required by applicable laws

5. Information Sharing

We do not sell your personal data. We may share information with:

  • Other Users: Your public profile, product listings, and business information are visible to other Platform users
  • Service Providers: Third-party providers who assist with hosting, analytics, payment processing, and logistics
  • Legal Requirements: When required by law, regulation, or legal process
  • Business Transfers: In connection with a merger, acquisition, or sale of assets

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. After account termination:

  • Transaction records are retained for 7 years for legal and accounting purposes
  • Communication logs are retained for 2 years
  • Usage data is anonymized after 1 year
  • You may request earlier deletion of your personal data (subject to legal retention requirements)

7. Your Rights

Under GDPR and KVKK, you have the right to:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Request correction of inaccurate or incomplete data
  • Erasure: Request deletion of your personal data
  • Restriction: Request restriction of processing in certain circumstances
  • Portability: Request your data in a structured, machine-readable format
  • Objection: Object to processing based on legitimate interests
  • Withdraw Consent: Withdraw previously given consent at any time

To exercise these rights, contact us at sc@sultana.express. We will respond within 30 days.

8. Cookies

We use cookies and similar technologies:

  • Essential Cookies: Required for Platform functionality
  • Preference Cookies: Remember your settings
  • Analytics Cookies: Understand how users interact with the Platform

You can manage cookie preferences through your browser settings.

9. Data Security

We implement appropriate technical and organizational measures:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Regular security audits and vulnerability assessments
  • Access controls and authentication requirements
  • Employee training on data protection practices

10. International Data Transfers

Your data may be transferred to countries outside your country of residence. We ensure appropriate safeguards including Standard Contractual Clauses (SCCs) and data processing agreements with all service providers.

11. Children's Privacy

The Platform is intended for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or Platform notification.

13. Contact Us

For privacy-related questions, requests, or complaints:

  • Email: sc@sultana.express
  • Address: Istanbul, Turkey

SULTANA EXPRESS İstanbul, Türkiye · Email: info@sultana.express Full legal-entity details (registered trade name, MERSİS, tax and KEP records) will be published here once incorporation is complete.