Türkiye Personal Data Protection Law No. 6698 (KVKK) Disclosure Notice

1.1. Principal Covenant and Operational Scope: Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed lawfully and in good faith by Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat Anonim Şirketi ("Shellix Bilişim A.Ş.") as the Türkiye Data Controller and Mistikist LTD as Joint Data Controller:

1.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

1.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

1.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Türkiye Controller: Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. · MERSİS No: 0769152927300001 · Address: Kötekli Mahallesi Denizli Yolu Bulvarı No:4B/23 Menteşe / MUĞLA, Türkiye
• UK & Global Joint Controller: Mistikist LTD · Company No: 15705777 · Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• KVKK Contact Channels: [email protected] / [email protected] · Tel: +90 (252) 358 77 57

2.1. Principal Covenant and Operational Scope: Within the scope of Mistikist services, the following categories of personal data are processed in accordance with the general principles of KVKK Article 4:

2.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

2.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

2.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Identity Data: First name, last name, and Turkish ID Number (TCKN) solely where required for sole-proprietorship e-Archive invoicing.
• Contact Data: Email address, telephone number (for corporate inquiries), billing address, city, and country.
• Customer Transaction & Financial Data: Subscription tier, seat count, order history, tax office, tax ID (VKN), e-Invoice/e-Archive records, and payment reference IDs.
• Transaction Security Data: IP address, device identifiers, authentication tokens, and statutory traffic logs under Law No. 5651.
• Audio Data (Optional): User-recorded affirmation audio files created in the Own-Voice Studio.
• Wellness Biofeedback Data (Optional): Numerical heart rate, HRV, and stress awareness scores derived from camera rPPG scans or health kit sync.

3.1. Principal Covenant and Operational Scope: Your personal data is processed for the following explicit and legitimate purposes:

3.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

3.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

3.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Creating and managing user accounts across Mistikist mobile, web, and Microsoft Teams applications.
• Delivering 21-day subconscious mind programming journeys, binaural/isochronic frequency sessions, and Mistikist AI recommendations.
• Executing subscription and corporate license contracts pursuant to Consumer Protection Law No. 6502.
• Issuing official e-Invoices / e-Archive invoices under Tax Procedure Law No. 213.
• Ensuring information security, preventing fraud, and fulfilling statutory obligations under Law No. 5651.
• Sending commercial electronic communications (subject to prior opt-in under Law No. 6563).

4.1. Principal Covenant and Operational Scope: Personal data is collected electronically via automatic means through mistikist.com, app.mistikist.com, iOS/Android apps, checkout forms, and customer support channels based on the legal grounds set forth in KVKK Articles 5 and 6:

4.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

4.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

4.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• KVKK Art. 5/2-a (Explicitly stipulated by law): Tax, e-commerce, and internet law obligations.
• KVKK Art. 5/2-c (Directly necessary for the establishment or performance of a contract): Account provisioning, subscription delivery, and cloud synchronization.
• KVKK Art. 5/2-ç (Mandatory for compliance with legal obligations): Statutory invoicing, accounting, and consumer dispute resolution.
• KVKK Art. 5/2-f (Legitimate interests of the data controller): Cybersecurity, fraud prevention, and service reliability.
• KVKK Art. 5/1 & Art. 6/3-a (Explicit Consent): Optional own-voice recordings, camera rPPG/HRV wellness measurements, marketing emails, and non-essential cookies.

5.1. Principal Covenant and Operational Scope: Mistikist is a general wellness application and not a medical provider. Microphone voice recording and camera rPPG stress/HRV scans operate strictly on an opt-in basis. Raw camera imagery is processed on-device and never uploaded to servers, and personal voice recordings are encrypted and accessible only to the user.

5.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

5.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

5.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

6.1. Principal Covenant and Operational Scope: Your personal data may be transferred domestically within Türkiye strictly on a need-to-know basis to certified public accountants, legal counsel, authorized payment institutions, and competent public authorities (Revenue Administration GİB, KVKK Board, Consumer Arbitration Committees, and Courts).

6.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

6.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

6.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

7.1. Principal Covenant and Operational Scope: To provide global cloud synchronization and enterprise AI features, personal data is processed on encrypted infrastructure operated by Google Cloud/Firebase, Microsoft Azure, Stripe, Cloudflare, and Joint Controller Mistikist LTD (UK) in compliance with Article 9 of the KVKK (as amended by Law No. 7499 effective June 1, 2024), relying on Standard Contracts published by the Turkish Data Protection Authority, contractual necessity under Art. 9/6, and explicit consent where applicable.

7.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

7.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

7.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

8.1. Principal Covenant and Operational Scope: In accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data, account data is deleted within 30 days of account closure, voice and HRV records within 7 days, distance sales records after 3 years, and tax/invoice records after 10 years pursuant to Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102.

8.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

8.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

8.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

9.1. Principal Covenant and Operational Scope: Pursuant to Article 11 of the KVKK, every data subject has the right to apply to Shellix Bilişim A.Ş. to:

9.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

9.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

9.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• a) Learn whether their personal data is processed,
• b) Request information if their personal data has been processed,
• c) Learn the purpose of processing and whether data is used in accordance with its purpose,
• ç) Know the third parties to whom personal data is transferred domestically or abroad,
• d) Request rectification of incomplete or inaccurate personal data,
• e) Request deletion or destruction of personal data under the conditions set forth in KVKK Article 7,
• f) Request notification of rectification or deletion operations to third-party recipients,
• g) Object to unfavorable outcomes resulting exclusively from automated analysis,
• ğ) Claim compensation for damages arising from unlawful processing of personal data.

10.1. Principal Covenant and Operational Scope: You may submit your requests under KVKK Article 11 in writing to "Kötekli Mahallesi Denizli Yolu Bulvarı No:4B/23 Menteşe / MUĞLA, Türkiye" or via email from your registered email address to [email protected].

10.2. Principal Covenant and Operational Scope: Applications are concluded free of charge within at most thirty (30) days. If your application is rejected, answered insufficiently, or not answered within 30 days, you have the right to lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu — https://www.kvkk.gov.tr) within 30 days of learning our response and in any event within 60 days from the application date.

10.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

10.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.