Cross-Border Data Transfer Explicit Consent Text

1. Data controller and contact

Pupas Teknoloji Yatırımları Danışmanlık Anonim Şirketi ("Company") is the data controller under Turkish Law No. 6698 ("KVKK").

Digital contact: [email protected]

Postal address: Barbaros Mah. Şebboy Sok. No:4/1 İç Kapı No:2, 34634 Ataşehir / İstanbul

2. Subject of explicit consent

This text obtains your explicit consent for cross-border transfer of personal data related to your subscription payment, card transaction, and payment processing to systems of licensed payment institutions and international payment infrastructure providers abroad.

Under KVKK Art. 9, cross-border transfer may occur via adequacy decisions, appropriate safeguards, or your explicit consent.

3. Data subject to transfer

Identity, contact, billing data, card transaction records (token/masked, not full PAN), transaction amount, installment preference, and transaction security data may be transferred.

4. Purpose of transfer

Payment execution, fraud prevention, PCI-DSS compliant processing, and subscription collection.

5. Recipients and countries

Licensed payment institution, card scheme operators, and hosting/payment infrastructure providers in the EEA, United States, and other regions where services are hosted.

6. Rights and withdrawal

You may exercise your KVKK Art. 11 rights by contacting [email protected]. Withdrawal does not affect prior lawful processing; new payment transactions requiring cross-border transfer may require consent.