Cookie, Pixel & Local Storage Policy

1.1. Principal Covenant and Operational Scope: This Cookie, Pixel & Local Storage Policy explains how Mistikist LTD ("Mistikist UK") and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. ("Shellix Bilişim A.Ş.") use cookies, browser storage (localStorage / sessionStorage), and tracking pixels on mistikist.com and app.mistikist.com.

1.2. Principal Covenant and Operational Scope: Our practices strictly comply with the EU ePrivacy Directive (2002/58/EC), EU GDPR (2016/679), UK Privacy and Electronic Communications Regulations (PECR 2003), the Turkish KVKK Cookie Guidelines, and US CCPA/CPRA opt-out standards.

1.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

1.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

2.1. Principal Covenant and Operational Scope: Cookies are small text files placed on your device by your web browser when you visit a website. LocalStorage and sessionStorage are standard browser storage mechanisms that allow web applications to remember your language selection, consent state, or checkout session locally on your device.

2.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

2.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

2.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

3.1. Principal Covenant and Operational Scope: We categorize cookies and local storage keys into four distinct groups:

3.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

3.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

3.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• 1. Strictly Necessary Cookies (Always Active): Required for core site security, Cloudflare DDoS mitigation, Stripe PCI-DSS payment security, and storing your cookie consent choice. Operated under GDPR Art. 6(1)(b)/(f), PECR Regulation 6(4), and KVKK Art. 5/2-c/f.
• 2. Functional & Preference Storage: Remembers your selected interface language (across 16 languages) and audio player state.
• 3. Analytics & Performance Cookies (Opt-In Required): Helps us understand page load performance and aggregated visitor journeys via Google Analytics 4. Disabled by default until you grant consent.
• 4. Marketing & Attribution Pixels (Opt-In Required): Measures the effectiveness of our digital campaigns on Meta, TikTok, and Snapchat. Disabled by default until you grant explicit consent.

4.1. Principal Covenant and Operational Scope: The following first-party keys are set directly by mistikist.com:

4.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

4.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

4.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• mk_cookie_consent (localStorage · Duration: 12 Months · Strictly Necessary): Stores your granular cookie consent decision and timestamp.
• mk_preferred_lang (localStorage · Duration: 12 Months · Functional): Stores your preferred language locale.
• mk_checkout_draft (sessionStorage · Duration: Session · Strictly Necessary): Preserves selected plan and license seat count during checkout.
• __cf_bm & cf_clearance (Cookie · Provider: Cloudflare · Duration: 30 mins – 1 year · Strictly Necessary): Bot management and WAF security protection.

5.1. Principal Covenant and Operational Scope: The following third-party cookies operate for payment security or when explicitly enabled by your consent:

5.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

5.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

5.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• __stripe_mid & __stripe_sid (Provider: Stripe, Inc. · Duration: 1 Year / 30 Mins · Strictly Necessary): Fraud prevention and PCI-DSS payment security on checkout pages.
• _ga & _ga_* (Provider: Google Ireland Ltd. · Duration: 13–24 Months · Analytics - Consent Required): Aggregated traffic and funnel analytics with IP anonymization.
• _fbp & _fbc (Provider: Meta Platforms Ireland Ltd. · Duration: 90 Days · Marketing - Consent Required): Campaign conversion attribution.
• _ttp (Provider: TikTok Technology Ltd. · Duration: 13 Months · Marketing - Consent Required): Campaign conversion measurement.
• _scid (Provider: Snap Inc. · Duration: 13 Months · Marketing - Consent Required): Campaign conversion measurement.

6.1. Principal Covenant and Operational Scope: Mistikist implements Google Consent Mode v2 across all regions. Upon your initial visit, ad_storage, analytics_storage, ad_user_data, and ad_personalization are initialized to "denied" by default. No analytics or marketing cookies are written unless you actively click "Accept" on the consent banner.

6.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

6.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

6.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

7.1. Principal Covenant and Operational Scope: To display localized pricing currency, phone country codes, and applicable regional legal notices (KVKK, UK GDPR, EU GDPR, CCPA), our server reads the cf-ipcountry header provided by Cloudflare at the network edge. This lookup does not set any tracking cookie or store your raw IP address.

7.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

7.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

7.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

8.1. Principal Covenant and Operational Scope: You can change or withdraw your cookie consent at any time via the cookie banner or by clearing site data in your browser. You may also block third-party cookies directly in Chrome, Safari, Firefox, Edge, or Brave settings, and we honor Global Privacy Control (GPC) browser signals.

8.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

8.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

8.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

9.1. Principal Covenant and Operational Scope: Where you consent to analytics or attribution cookies, pseudonymous technical identifiers may be processed by Google, Meta, TikTok, or Snap on servers in the European Union and the United States under the EU-US Data Privacy Framework, EU SCCs, and UK IDTA.

9.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

9.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

9.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

10.1. Principal Covenant and Operational Scope: We review our cookie inventory regularly. For any questions regarding this Cookie Policy, please contact our Data Protection Officer at [email protected] or [email protected].

10.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

10.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

10.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.