Distance Sales and Digital Subscription Contract

1.1. Principal Covenant and Operational Scope: This Distance Sales and Digital Subscription Contract ("Contract") is entered into electronically between the Seller/Provider and the Buyer ("Customer"):

1.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

1.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

1.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Seller / Provider (International): Mistikist LTD · Company No. 15705777 · Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Seller / Provider (Türkiye): Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. ("Shellix Bilişim A.Ş.") · MERSİS No: 0769152927300001 · Registered Office: Kötekli Mahallesi Denizli Yolu Bulvarı No:4B/23 Menteşe / MUĞLA, Türkiye
• Contact: [email protected] / [email protected] · Tel: +44 7962 645717 (UK) / +90 (252) 358 77 57 (TR)
• Buyer / Customer: The individual or corporate entity whose name, email address, and billing details are submitted on the checkout form.

2.1. Principal Covenant and Operational Scope: The subject of this Contract is the electronic sale, immediate digital provisioning, and licensing of the Mistikist subscription plan (Monthly Premium, Annual Transformation, Lifetime Access) or Enterprise Team License (B2B seats) ordered by the Buyer via mistikist.com, and the determination of the mutual rights and obligations of the parties pursuant to Turkish Law No. 6502, the UK Consumer Rights Act 2015, and EU Directive 2011/83/EU.

2.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

2.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

2.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

3.1. Principal Covenant and Operational Scope: The selected plan tier, license seat quantity, applicable volume or promo discount, tax-inclusive total due today, and renewal terms are exactly as displayed on the checkout summary page approved by the Buyer and confirmed in the electronic invoice.

3.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

3.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

3.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

4.1. Principal Covenant and Operational Scope: Payment is collected electronically via Stripe (PCI-DSS Level 1 certified) using credit card, debit card, Apple Pay, or Google Pay. If a payment is reversed or dishonored by the issuing bank due to unauthorized card use or unjustified chargeback, the Seller reserves the right to immediately suspend the corresponding subscription or license keys.

4.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

4.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

4.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

5.1. Principal Covenant and Operational Scope: The contracted service is intangible digital software content. No physical shipment takes place. Performance commences immediately upon payment authorization, upgrading the Buyer’s account and delivering the activation receipt by email.

5.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

5.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

5.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

6.1. Principal Covenant and Operational Scope: Monthly and Annual plans renew automatically at the end of each billing cycle unless canceled by the Buyer before the renewal date. Lifetime Access plans are billed once and never auto-renew. Cancellation takes effect at the end of the current paid billing period, preserving full access until that date.

6.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

6.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

6.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

7.1. Principal Covenant and Operational Scope: Notwithstanding statutory exceptions for immediately performed digital content (Turkish Distance Contracts Regulation Art. 15/1-ğ and EU/UK digital content rules), the Seller grants the Buyer an unconditional 7-Day Money-Back Guarantee on all initial direct web purchases made on mistikist.com.

7.2. Principal Covenant and Operational Scope: Upon receiving a refund request at [email protected] within 7 calendar days of purchase, the Seller shall refund the full amount to the original payment method within 14 days.

7.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

7.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

8.1. Principal Covenant and Operational Scope: Where the Buyer purchases multiple seats or selects corporate invoicing, the Buyer warrants that all submitted corporate tax details (Company Legal Name, Tax/VAT ID, Tax Office, Billing Address) are accurate. Enterprise seats may only be assigned to personnel of the Buyer’s organization.

8.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

8.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

8.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

9.1. Principal Covenant and Operational Scope: This Contract grants a limited, non-exclusive, non-transferable license to use the Mistikist Platform. All intellectual property rights remain the exclusive property of Mistikist LTD and Shellix Bilişim A.Ş.

9.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

9.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

9.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

10.1. Principal Covenant and Operational Scope: Personal data collected under this Contract is processed in accordance with our Global Privacy Policy, KVKK, and EU/UK GDPR. Electronic contract records are retained for 3 years and statutory accounting invoices for 6 to 10 years as required by tax law.

10.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

10.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

10.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

11.1. Principal Covenant and Operational Scope: Disputes arising from this Contract are subject to Consumer Arbitration Committees and Consumer Courts in Türkiye for Turkish residents, and the laws and courts of England and Wales (or mandatory local consumer forums) for UK and international customers. This Contract enters into force electronically upon checkout completion.

11.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

11.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

11.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.