KVKK Information Notice

Data controller: Eser Memişoğlu (Startup Doktoru) Website: startupdoktoru.com Email: doktorstartup@gmail.com

• Identity: first and last name.
• Contact: email address, phone number.
• Customer transactions: order details, products purchased, payment reference, book reviews, form answers.
• Professional and startup information: company/project name, startup stage, startup profile (description, deck link, sector, team, city, valuation); for investors, title, firm, investment thesis, sectors, portfolio and public profile links.
• Marketing: email open/click data, campaign source, products of interest, unsubscribe records.
• Security: login records, session ID, pages visited.
• Messages typed to the AI mentor (not stored permanently).

We do not process card details; they are collected by the payment provider Stripe. We do not ask for special categories of data (health, religion, biometrics, etc.); please do not enter such information in forms or the chat.

• Providing purchased products and courses, delivering and copy-protecting the e-book, managing accounts.
• Handling orders, payments and invoicing.
• Sending course content, information and campaign emails.
• Matching startups with investors, presenting startup profiles to investors and passing on meeting requests.
• Introducing relevant startups to investors and inviting them to the platform.
• Providing the AI mentor.
• Measuring site usage and campaign performance, improving our services.
• Information security, meeting legal obligations and protecting our rights in disputes.

Personal data is collected electronically, by automated or partly automated means, through site forms, sign-up and Google sign-in, the checkout page, the startup profile form, the AI mentor, email correspondence and browser storage. Investor data is compiled from publicly available sources such as firm websites, LinkedIn and investor databases.

The data is processed on the following legal bases under KVKK Article 5:

• Formation or performance of a contract (Art. 5/2-c): purchases, e-book delivery, accounts, startup–investor matching.
• Compliance with a legal obligation (Art. 5/2-ç): keeping invoices and commercial records.
• Establishing, exercising or defending a right (Art. 5/2-e): using records in disputes.
• Data made public by the data subject (Art. 5/2-d): investors' publicly available professional information.
• Legitimate interest (Art. 5/2-f): measuring site usage, improving services, information security, professional introductions to investors.
• Explicit consent (Art. 5/1): processing with no other legal basis, and transfers abroad that rely on explicit consent.

Commercial electronic messages (campaign emails) are sent on the basis of your approval under Law No. 6563 on Electronic Commerce; prior approval may not be required for messages to merchants and tradespeople. Every message offers a free, one-click opt-out.

Your personal data may be transferred, limited to the purposes above, to:

• Service providers: hosting (Vercel), database and login (Supabase), payments (Stripe), email (Resend), AI (Google Gemini, OpenAI, Moonshot AI), video and previews (Bunny.net, YouTube, Google Drive).
• Investors: approved startup profiles and contact requests, to matched investors.
• Startups: an investor's meeting request, to the startup concerned.
• Competent public authorities: where legally authorised and requested.

Because many of these providers' servers are abroad (mainly the USA; China for Moonshot AI), your personal data is transferred abroad in accordance with the conditions of KVKK Article 9.

Personal data is kept for as long as the purpose requires and for the retention periods set by law (e.g. 10 years for commercial records), after which it is deleted, destroyed or anonymised. The email address of someone who opts out of commercial messages is kept on a suppression list so that no further messages are sent.

• To learn whether your personal data is processed,
• To request information if it has been processed,
• To learn the purpose of processing and whether it is used accordingly,
• To know the third parties in Turkey or abroad it is transferred to,
• To request correction if it is incomplete or inaccurate,
• To request deletion or destruction under the conditions of KVKK Article 7,
• To request that correction, deletion and destruction be notified to third parties it was transferred to,
• To object to an outcome against you arising exclusively from automated analysis,
• To claim compensation for damage caused by unlawful processing.

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request by email to doktorstartup@gmail.com from the email address registered in our system, with a secure electronic or mobile signature, or in writing. Include your name, contact details and a clear description of your request.

Requests are concluded free of charge within 30 days at the latest. If the action involves an additional cost, the fee set by the Personal Data Protection Board may be charged.