1. Data controller
Under applicable personal data protection rules (including Türkiye’s KVKK where applicable), the data controller is Firma. Contact: the portal contact channels.
Privacy & Data Protection
This notice is issued for odeme.ddkristal.com.tr and is effective as of 2026-10-14. Transactions on this portal are subject to the terms below.
2. Personal data processed
During online collection we may process name, company title, email, phone, billing/contact details, payment amount and currency, transaction time, and only the last four digits of the card (card_last4). Full card numbers, CVV and similar sensitive payment data are not stored by Firma; processing is handled by the virtual POS / bank.
3. Purposes and legal bases
Data is processed for collecting debts / service fees, payment records and reconciliation, legal retention, fraud prevention, and customer support. Legal bases include performance of a contract, legal obligation and legitimate interest.
4. Transfers
Data may be shared, only as needed, with bank / virtual POS providers, hosting and email / SMS notification services, and competent authorities when required. Transfers are purpose-limited and protected by security measures.
5. Retention
Payment and accounting records are kept for the periods required by law; support records for a reasonable period to complete the transaction and resolve disputes. Thereafter data is deleted, destroyed or anonymised.
6. Your rights
You may request access, correction, deletion/destruction, information about recipients, and object to processing where applicable. Contact Firma via the portal contact channels.
7. Security
Firma applies technical and organisational measures against unauthorised access, loss or alteration. The payment page is served over HTTPS; card data is sent to PCI DSS compliant POS channels.