Explicit Consent & Commercial Electronic Communication Declaration

1.1. Principal Covenant and Operational Scope: This Explicit Consent Declaration sets forth the optional data processing activities conducted by Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. ("Shellix Bilişim A.Ş.") and Mistikist LTD that require your freely given, specific, and informed consent under KVKK Articles 5/1 and 6/3 and EU/UK GDPR Articles 6(1)(a) and 9(2)(a).

1.2. Principal Covenant and Operational Scope: Core membership and subscription access are never conditioned upon granting consent to optional marketing communications or non-essential cookies.

1.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

1.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

2.1. Principal Covenant and Operational Scope: By activating the microphone in the Own-Voice Affirmation Studio, you explicitly consent to the recording, noise-reduction processing, binaural frequency mixing, and encrypted cloud storage of your voice affirmations solely for playback across your authenticated devices.

2.2. Principal Covenant and Operational Scope: Your voice recordings are never sold, shared with advertisers, or used to train third-party voice synthesis models.

2.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

2.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

3.1. Principal Covenant and Operational Scope: By initiating a Camera HRV & Stress Scan or connecting Apple HealthKit / Google Health Connect, you explicitly consent to the calculation and storage of your numerical heart rate, Heart Rate Variability (HRV), and autonomic stress scores to display your personal wellness trends and tailor your breathing/frequency sessions.

3.2. Principal Covenant and Operational Scope: Optical pulse detection occurs on-device in real time; raw camera images or videos are never uploaded or stored.

3.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

3.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

4.1. Principal Covenant and Operational Scope: When you voluntarily enter daily goals, mood reflections, or affirmation topics into Mistikist AI, you consent to the processing of those inputs via our enterprise Azure OpenAI environment to generate tailored session recommendations.

4.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

4.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

4.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

5.1. Principal Covenant and Operational Scope: You consent to the encrypted storage and synchronization of your optional voice recordings, wellness metrics, and session preferences across our global cloud infrastructure (Google Cloud/Firebase and Microsoft Azure) and between Joint Controllers Shellix Bilişim A.Ş. (Türkiye) and Mistikist LTD (United Kingdom).

5.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

5.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

5.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

6.1. Principal Covenant and Operational Scope: Where you opt in to receive newsletters or product updates, you consent to receiving emails and in-app push notifications from Shellix Bilişim A.Ş. and Mistikist LTD regarding new neuro-acoustic programs, scientific articles, and special offers in accordance with Turkish Electronic Commerce Law No. 6563 (ETK / İYS), UK PECR, and US CAN-SPAM.

6.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

6.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

6.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

7.1. Principal Covenant and Operational Scope: When you click "Accept" on our cookie consent banner, you consent to the activation of Google Analytics 4, Meta Pixel, TikTok Pixel, and Snap Pixel for aggregated traffic analysis and campaign attribution under Google Consent Mode v2.

7.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

7.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

7.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

8.1. Principal Covenant and Operational Scope: You have the absolute right to withdraw your explicit consent at any time without justification and without affecting the lawfulness of processing prior to withdrawal.

8.2. Principal Covenant and Operational Scope: You may revoke consent instantly by: (i) deleting individual voice recordings or HRV logs inside the app, (ii) revoking microphone, camera, or HealthKit permissions in your device settings, (iii) clicking "Unsubscribe" in any marketing email, or (iv) emailing [email protected] or [email protected].

8.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

8.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

9.1. Principal Covenant and Operational Scope: To comply with statutory accountability obligations under GDPR Article 7(1) and KVKK, timestamped records of your consent grants and withdrawals are securely logged for the applicable statutory limitation period.

9.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

9.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

9.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

10.1. Principal Covenant and Operational Scope: For any questions or requests regarding your consent preferences, contact Shellix Bilişim A.Ş. (MERSİS: 0769152927300001, Muğla, Türkiye) and Mistikist LTD (Company No. 15705777, London, UK) at [email protected] or [email protected].

10.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

10.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

10.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.