Privacy Notice (KVKK)

KVKK Aydınlatma Metni · SahteAvcı · version of 1 July 2026

This Notice has been prepared in accordance with Article 10 of Turkish Law No. 6698 on the Protection of Personal Data and the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation.

This document is for information only. No consent is requested in connection with it and no acknowledgement is required. Where explicit consent is necessary, it is requested through a separate document, the Explicit Consent Text (Açık Rıza Metni).

1. Data controller

Data controller: VENTOS ARQUEÁVEIS UNIPESSOAL LDA, a company incorporated in Portugal.
Address: Rua D. Afonso Henriques, n.º 132, 7.º E, Cortes, 4950-854 Monção, Portugal
Registration and tax number (NIPC): 519153529, Conservatória do Registo Comercial de Viana do Castelo.
Email: info@sahteavci.com · Website: sahteavci.com

The controller has no establishment in Türkiye. As the service is directed at the Turkish market, personal data of individuals located in Türkiye are processed in accordance with Law No. 6698.

2. Scope

This Notice covers the sahteavci.com website, the forms available on it, and the «SahteAvcı» Chrome browser extension, which helps detect potentially counterfeit products on Trendyol, Hepsiburada, n11, Amazon.com.tr, Dolap and Çiçeksepeti.

3. Data processed, purposes and legal grounds

Each processing activity is set out separately below.

Special categories of personal data under Article 6 of the KVKK are not processed. The controller does not collect identity document details, payment card details, or browsing history outside the supported marketplaces.

4. Method of collection

Personal data are collected solely by electronic means: through the forms on sahteavci.com (the services enquiry form and the pop-up form), whose handlers are hosted on the same domain and forward the information to the controller by email; through the interface of the extension installed by the user; and automatically through the technical logs kept by the web server when the site is visited.

Information about products and sellers is read locally within the user's browser when the user visits a supported marketplace and is not transmitted to the controller's servers.

5. Recipients

Independent law firms in Türkiye — only where the user requests assistance in finding a lawyer, and solely on the basis of explicit consent.
Artificial intelligence providers (OpenAI, Anthropic, Hugging Face; United States) — only where AI features are used, at the user's initiative and with the user's own access key.
Web analytics provider (Plausible Analytics; European Union) — anonymised visit statistics collected without cookies.
Font provider (Google LLC; United States) — the IP address and technical browser information become available when pages are loaded.
Hosting provider — to the extent necessary for the operation of the site and email delivery.
Competent public authorities and courts — in the cases provided for by law.

The controller does not sell personal data and does not share them with third parties for advertising purposes.

6. Cross-border transfers

Some of the recipients listed in section 5 are located outside Türkiye. The Personal Data Protection Board has not published a list of countries providing an adequate level of protection, and the controller does not rely on an undertaking (taahhütname) or on the standard contract announced by the Board for these transfers. Accordingly, cross-border transfers are based on the separately obtained explicit consent of the data subject under Article 9 of the KVKK.

Consent is requested separately for each transfer in the Explicit Consent Text. Withholding this consent does not prevent the use of the extension's core features or the submission of enquiries through the website forms.

7. Retention periods

Personal data are retained for as long as necessary to achieve the purpose of processing and are erased, destroyed or anonymised once that purpose ceases to exist, or upon withdrawal of consent where no other legal ground applies.

Enquiries through the services form — 3 years after the matter is concluded.
Email addresses collected through the pop-up — 24 months from the last interaction, or until consent is withdrawn.
Records of consent — 10 years after the end of the relationship, for evidentiary purposes.
Web server technical logs — no longer than 12 months.
Data held in the extension reside on the user's device and are kept until the user deletes them; no separate period is set, as the controller does not store these data on its servers.

8. Rights of the data subject (Art. 11 KVKK)

Every data subject has the right to apply to the controller and:

learn whether their personal data are being processed;
request information if such processing has taken place;
learn the purpose of the processing and whether the data are used in accordance with that purpose;
know the third parties in Türkiye or abroad to whom the data are transferred;
request rectification where the data are incomplete or inaccurate;
request erasure or destruction under the conditions set out in Article 7 of the KVKK;
request that rectification, erasure and destruction be notified to the third parties to whom the data were transferred;
object to an adverse outcome arising solely from automated analysis;
claim compensation for damage suffered as a result of unlawful processing.

9. How to apply

Applications may be sent to info@sahteavci.com under the subject line «KVKK Veri Sahibi Başvurusu», or by any other method set out in the Communiqué on the Procedures and Principles of Application to the Data Controller, including through a notary, via a registered electronic mail (KEP) address, or in writing to the controller's address.

The application must state the applicant's name and surname, the Turkish identity number for Turkish citizens or the nationality and passport number for foreign nationals, a residential or business address for service, an email address and telephone number if available, and the subject of the request.

The controller responds as soon as possible and in any event within 30 days. Responses are provided free of charge; where the request entails an additional cost, a fee may be charged in accordance with the tariff set by the Board.

If the application is rejected, the response is considered insufficient, or no response is given within the period, the data subject may lodge a complaint with the Personal Data Protection Authority (kvkk.gov.tr) within 30 days of learning of the response and in any event within 60 days of the date of application.

10. Changes

The controller may update this Notice where processing activities change. The current version is published on the website with its date; earlier versions are retained and provided on request.