Scope notice: This Privacy Policy applies only to the website zfinanceapp.com. A separate, dedicated privacy policy will be published for the zFinance mobile application when it becomes available. Nothing in this Policy describes processing that takes place inside an app.

1. Who we are (Controller / Operator)

The controller responsible for processing personal data on this website, within the meaning of Art. 4(7) GDPR (EU/EEA/UK), data controller under the Turkish Personal Data Protection Law (KVKK Law No. 6698), and "business" under the California Consumer Privacy Act (CCPA/CPRA), is:

Bonita İnternet Teknoloji Ticaret A.Ş.
General Manager: Sefa Koç
Company No: 789758-0
Altunizade Mah. Ord. Prof. Fahrettin Kerim Gökay Cad. No: 35/1
Üsküdar / Istanbul, Türkiye
General contact: info@zfinanceapp.com

Person responsible for data protection (Datenschutzbeauftragter / Privacy Officer):
Bera Duranoğlu
Privacy-specific contact: privacy@zfinanceapp.com

Please use the privacy address above for any data-protection request (access, deletion, objection, complaint, etc.). We aim to respond within statutory deadlines (typically 30 days under GDPR/KVKK; 45 days under CCPA).

2. Scope and audience

This Policy describes how Bonita İnternet Teknoloji Ticaret A.Ş. ("we", "us", "our") collects, uses, stores, shares and protects personal data when you visit zfinanceapp.com (the "Website"). It is written to comply with:

• the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and equivalent regulations in the EEA, UK and Switzerland;
• the Turkish Personal Data Protection Law (KVKK Law No. 6698) and its secondary legislation;
• the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"); and
• reasonable, generally-accepted privacy practices for visitors from other jurisdictions.

Region-specific rights are detailed in Section 10.

3. What personal data we collect

3.1 Automatically: when you visit the Website

Our web server (our own server in Germany, see Section 5.1) automatically receives technical access data necessary to deliver the page to your browser. This may include:

• Your IP address (shortened before it is written to the log: the last part is removed)
• Date, time and time zone of access
• The page or resource requested (URL, query parameters)
• HTTP method, status code and transferred data volume
• Referring URL (the page that linked you to us)
• Browser type, version, language and user-agent string
• Operating system and device type

This data is processed in short-lived server logs. We do not use it to identify you personally, build a profile, or combine it with other datasets.

3.2 When you create a zFinance account

Apart from the optional feedback form (see 3.6), this website does not collect personal data through forms. If you create an account in the zFinance app, we collect:

• Your email address (required to create and secure your account)
• A timestamp of when you registered (used for audit and consent records)
• The IP address used at sign-up (used for security and anti-abuse purposes)

Submitting any additional personal data is not required.

If we suspect that an account was created automatically, the app may ask you to complete a short check provided by Cloudflare (Cloudflare Turnstile), which processes your IP address and device/browser information; we only receive the result. The zFinance app's own privacy policy describes this in detail.

3.3 When you contact us by email

If you write to us at any of our email addresses, we receive your email address, your name (if provided in the message), and the content of your message. This content is processed solely to respond to your enquiry.

3.4 Cookies, local storage and website analytics: see also Section 6. We measure the Website with our own analytics tool. It runs on our own server in Germany (see Section 5.3); no analytics company, advertising network or other third party receives this data.
• If you reject analytics or do not make a choice, your browser only tells our server which page was opened (for example "/support"), and we add one to that page's count for the day. Nothing is stored in your browser for this, and we keep no IP address, place or other detail with the count, so we cannot tell visitors apart.
• If you accept analytics, we also collect: a random visitor ID and visit ID kept in your browser (see Section 6); the pages you open, the page you came from and the order in which you move between pages; which parts of a page you see and how far you scroll; the links and buttons you click (their label, where they lead and the part of the page they are in, never what you type into a field); how long you actively spend on each page; the website that sent you and any campaign tags in the link (utm_source, utm_medium, utm_campaign); your device type, operating system, browser, language and screen size; and the approximate place you connect from (country, region and city), which our server looks up from your IP address in a local database when your visit starts. The IP address itself is not stored.

3.5 Sensitive personal data: We do not knowingly collect sensitive personal data (special categories of data under Art. 9 GDPR / KVKK Art. 6, or sensitive personal information under CPRA). Please do not submit such data to us through the Website.

3.6 When you send us feedback: On zfinanceapp.com/feedback you can rate zFinance from 1 to 5 and send a suggestion. We store your rating, your suggestion and the type you chose, the language of the page and the approximate place you sent it from (country and city, looked up on our own server from your IP address, the IP address itself is not stored). Your name and email are optional; if you give an email address, we use it only to reply to you. To mark repeat submissions, we also keep two one-way codes with each entry: one made from your network address and, only if you accepted analytics (see Section 6), one made from the random visitor ID in your browser. These codes cannot be turned back into the address or the ID, are only compared with other feedback, and are deleted together with it. To keep automated spam out, the page also runs Cloudflare Turnstile, a check that normally works invisibly; for it, Cloudflare processes your IP address and technical information about your browser (see Section 5.4). Entries that fail the check are kept apart and not counted. Feedback is stored on our own server in Germany (see Section 5.3), read only by our team, never used for marketing, and deleted automatically after 12 months.

4. Purposes and legal bases of processing

We process personal data only for the purposes listed below.

(a) Operating, securing and stabilizing the Website: processing of technical access data.
• GDPR: Art. 6(1)(f): legitimate interest in a stable, secure website.
• KVKK: Art. 5(2)(f): legitimate interests.
• CCPA business purpose: security and integrity, debugging, short-term transient use.

(b) Marketing communications: to send you product news, launch announcements, product updates, promotional offers, special campaigns, and other marketing emails about zFinance and related products or features we believe may interest you.
• GDPR: Art. 6(1)(a): your explicit consent, given by submitting the form ("opt-in"). You can withdraw consent at any time and unsubscribe via the link in every email, see Section 10.
• KVKK: Art. 5(1): explicit consent (açık rıza), including under the Turkish Law on Electronic Commerce (Law No. 6563) which requires explicit consent for commercial electronic messages.
• CCPA: collected directly from you with notice at collection. You can opt out at any time.

(c) Responding to email enquiries: to handle questions, support requests, complaints or pre-contractual communication.
• GDPR: Art. 6(1)(b), pre-contractual/contractual measures; or Art. 6(1)(f), legitimate interest.
• KVKK: Art. 5(2)(c) or 5(2)(f).

(d) Storing your cookie-consent choice and language preference: saved locally in your browser so we do not have to ask again on every visit.
• GDPR: Art. 6(1)(f). § 25(2) TDDDG: strictly necessary, no consent required.
• KVKK: Art. 5(2)(f).
• CCPA: necessary to honour your stated preferences.

(e) Compliance with legal obligations: e.g. tax retention or law-enforcement requests.
• GDPR: Art. 6(1)(c). KVKK: Art. 5(2)(a). CCPA: legal obligation.

(f) Establishing, exercising or defending legal claims.
• GDPR: Art. 6(1)(f). KVKK: Art. 5(2)(e). CCPA: business purpose.

(g) Website analytics and improvement: to understand how visitors use the Website (which pages and sections hold attention, how visitors move between pages, where they come from and which devices they use) and to improve the Website and the product. Performed with our own analytics tool on our own server (see Section 3.4); no third-party analytics provider is involved.
• GDPR: Art. 6(1)(a) and § 25(1) TDDDG: your consent, given by clicking "Accept all" or by switching on Analytics under "Manage". You can withdraw it at any time via the "Cookie preferences" link in the footer; withdrawing deletes the analytics IDs from your browser straight away. The anonymous daily page counts collected without consent (Section 3.4) contain no personal data and store nothing on your device; receiving the page request itself relies on Art. 6(1)(f) (legitimate interest in knowing how often our pages are visited).
• KVKK: Art. 5(1): explicit consent (açık rıza); anonymous page counts: Art. 5(2)(f).
• CCPA: notice at collection; we never sell or share this data (see Section 8).

(h) Improving zFinance from your feedback: reading your ratings and suggestions and, if you leave an email address, replying to you.
• GDPR: Art. 6(1)(f): legitimate interest in improving our product and in feedback we can rely on (marking repeats); the code made from the browser ID only with your consent under (g); the human check: Art. 6(1)(f) (legitimate interest in keeping the form free of automated spam), strictly necessary for the form you use (§ 25(2) TDDDG); replying at your request: Art. 6(1)(b).
• KVKK: Art. 5(2)(f).
• CCPA: business purpose (product improvement).

4a. Marketing emails: what to expect

By opting in to our marketing emails, you give us your explicit consent to send them. These may include:

• Launch announcements: when zFinance becomes available;
• Product updates: new features, improvements and milestones;
• Promotional offers: discounts, special deals or limited-time campaigns related to zFinance or related products and features;
• Educational content: financial-literacy tips, news, and content we believe will interest you;
• Surveys and feedback requests: to help us improve the product.

We may send these emails on a regular basis. Each email will include a clear, one-click unsubscribe link at the bottom. You can also unsubscribe at any time by emailing privacy@zfinanceapp.com. Unsubscribing applies immediately to all marketing communications and does not affect the lawfulness of any messages sent before you unsubscribed.

We do not rent, sell or trade your email address with third parties for their own marketing. We do not use an external newsletter service: our mailing list is stored in our own database on our own server (hosted by Hostinger in Germany), and our emails are sent through the mail servers of STRATO in Germany, both acting strictly on our behalf (see Section 5). Our marketing emails contain a small image and personalised links that tell us whether an email was opened and which links were clicked, so we can see what our readers find useful.

5. Service providers we use (processors / sub-processors)

We rely on the following third-party service providers, each processing personal data on our behalf under a written data-processing agreement where required.

5.1 Hosting: our own server (HOSTINGER, UAB)
Švitrigailos str. 34, LT-03230 Vilnius, Lithuania: server located in Germany
Role: serving the Website and keeping its server logs (with shortened IP addresses)
Location of processing: Germany (EU)
Safeguards: Art. 28 GDPR data-processing agreement; data remains within the EU.
Privacy policy: hostinger.com/legal/privacy-policy

5.2 Domain name: STRATO GmbH
Otto-Ostrowski-Straße 7, 10249 Berlin, Germany
Role: registrar and name servers for zfinanceapp.com (they point the name to our server; your visits do not pass through STRATO)
Location of processing: Germany (EU)
Privacy policy: strato.de/datenschutz

5.3 Our own server (Hostinger) and STRATO: marketing email, feedback and website analytics
HOSTINGER, UAB, Švitrigailos str. 34, LT-03230 Vilnius, Lithuania: server located in Germany
Role: storing the mailing list and the consent records; the unsubscribe and legal-notice pages at marketing.zfinanceapp.com; the feedback sent from zfinanceapp.com/feedback; our own website analytics (Section 3.4)
STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany
Role: sending our marketing emails, receiving replies and bounce notices
Location of processing: Germany (EU) only
Safeguards: data-processing agreements under Art. 28 GDPR; no transfer outside the EU/EEA.
Privacy policies: hostinger.com/legal/privacy-policy · strato.de/datenschutz

5.4 Human check on the feedback page: Cloudflare, Inc.
101 Townsend St, San Francisco, CA 94107, USA
Role: Cloudflare Turnstile on zfinanceapp.com/feedback only, to tell people from automated spam
Location of processing: worldwide, including the United States
Safeguards: EU Standard Contractual Clauses; Cloudflare participates in the EU-U.S. Data Privacy Framework.
Privacy policy: cloudflare.com/privacypolicy

6. Cookies and local storage

We use strictly necessary browser storage (always active) and, only if you agree, analytics storage for our own analytics. We do not use third-party cookies, advertising cookies or tracking pixels on the Website.

Strictly necessary (always active: no consent required under Art. 6(1)(f) GDPR and § 25(2) TDDDG):
• zf_cookie_consent (localStorage): your choice (analytics on or off). Kept for 12 months; after that we ask again.
• zf_language (localStorage, where used): your interface-language preference.

Analytics (only after you accept analytics, § 25(1) TDDDG):
• zf_vid (localStorage): a random visitor ID, so we can recognise a returning browser. It contains nothing about you. If you send feedback, a one-way code made from it is stored with the feedback to mark repeats (Section 3.6).
• zf_sid (localStorage): the current visit (a random visit ID, the time of your last activity and the previous page), so that pages opened within 30 minutes count as one visit.
Both are deleted from your browser as soon as you withdraw consent, or on your first visit after your consent has expired (12 months).

Your control: when you first visit, a banner lets you accept all, reject all, or choose under "Manage". You can change your choice at any time using the "Cookie preferences" link in the footer, or by clearing your browser storage for this site.

For questions about cookies, contact privacy@zfinanceapp.com.

7. International data transfers

The Website, our own analytics, the feedback form and our marketing email run on servers in Germany (EU). The only exception is the human check on the feedback page (Cloudflare, see Section 5.4), which may involve processing in the United States; apart from it, we do not transfer personal data from the Website outside the EU/EEA.

For visitors from Türkiye, processing on our servers in Germany is a transfer abroad under KVKK. For this and for the Cloudflare check, we rely on:

• EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR (Commission Implementing Decision (EU) 2021/914);
• Participation by the recipient in the EU-U.S. Data Privacy Framework (DPF);
• For Türkiye-originating data, the explicit consent (açık rıza) provided by you when submitting the form, in accordance with KVKK Art. 9.

You can request a copy of the relevant safeguards by emailing privacy@zfinanceapp.com.

8. Recipients of data: do we sell or share your data?

We do not sell personal data and we do not share personal data for cross-context behavioural advertising, terms defined under CCPA/CPRA. We have not done so in the past 12 months and have no plans to do so.

Personal data is disclosed only to:

(a) the service providers listed in Section 5, acting as processors / sub-processors under contract;
(b) competent public authorities, where legally compelled (e.g. court orders, regulatory requests);
(c) professional advisors (lawyers, accountants) bound by professional confidentiality, where strictly necessary;
(d) successors in the event of a merger, acquisition, restructuring or sale of assets, in which case you will be notified and your rights will be preserved.

9. How long we keep your data (retention)

We keep personal data only as long as necessary for the purpose for which it was collected, or as required by law.

• Server log data: automatically deleted or anonymized within 7 days of collection, except where extended retention is required to investigate a security incident.
• Marketing email address: kept until (i) you unsubscribe via the link in any email, (ii) you ask us to delete it, or (iii) our launch communications are concluded. Following any of these, your data is removed from active systems within 30 days. Backups are overwritten on rolling cycles.
• Feedback: ratings and suggestions are deleted automatically 12 months after you send them, or earlier if you ask us to.
• Website analytics: anonymous daily page counts and, if you accepted analytics, the records of your visits (pages, clicks, time spent, place) are deleted automatically 26 months after they were recorded. The visitor and visit IDs stay in your browser until you withdraw consent or your consent expires.
• Cookie-consent / language preference (localStorage): stored on your device for up to 12 months or until you clear it.
• Email correspondence: retained for the duration of the matter and for up to 12 months thereafter, then deleted, unless statutory retention obligations apply.
• Legal / tax retention: where applicable (e.g. invoices), Turkish Tax Procedure Law and German commercial/tax law (§§ 257 HGB, 147 AO) require retention for up to 10 years.

10. Your rights

The exact rights you have depend on the jurisdiction whose law applies to you. Please contact us if you are unsure.

10.1 For visitors from the EU, EEA, UK and Switzerland (GDPR / UK GDPR)

You have the right to:

• Access (Art. 15 GDPR);
• Rectification (Art. 16 GDPR);
• Erasure, "right to be forgotten" (Art. 17 GDPR);
• Restriction of processing (Art. 18 GDPR);
• Data portability (Art. 20 GDPR);
• Object to processing based on legitimate interest (Art. 21 GDPR);
• Withdraw consent at any time (Art. 7(3) GDPR), without affecting prior lawfulness;
• Lodge a complaint with a supervisory authority (Art. 77 GDPR);
• Not be subject to a decision based solely on automated processing (Art. 22 GDPR): we do not carry out such decisions on this Website.

10.2 For visitors from Türkiye (KVKK)

Under Art. 11 KVKK you have the right to:

• Learn whether your personal data is being processed;
• Request information if it has been processed;
• Learn the purpose and whether the data is used in accordance with that purpose;
• Know third parties to whom data has been transferred (domestically or abroad);
• Request correction of incomplete or inaccurate data;
• Request erasure or destruction within the framework of KVKK Art. 7;
• Request notification of these operations to third parties to whom data has been transferred;
• Object to results based solely on automated processing;
• Claim compensation for damages arising from unlawful processing.

You may file a complaint with the Turkish Personal Data Protection Authority (KVKK, kvkk.gov.tr).

10.3 For residents of California (CCPA / CPRA)

You have the right to:

• Know / access the categories and specific pieces of personal information we have collected, the sources, the business or commercial purpose, and the categories of third parties with whom it is shared;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of "sale" or "sharing" of personal information: as noted in Section 8, we do not sell or share, but you may submit a request at any time;
• Limit use of sensitive personal information: we do not knowingly collect sensitive PI, so this right is automatically honoured;
• Non-discrimination: we will not deny you service, charge a different price, or provide a different level of service because you exercised your rights.

You may also designate an authorized agent. We may need to verify your identity before fulfilling certain requests.

10.4 For visitors from other jurisdictions: We will honour reasonable requests for access, correction or deletion of your personal data even where no specific law applies.

How to exercise your rights: Email privacy@zfinanceapp.com. Please describe your request and provide enough information for us to identify you. We will respond within statutory deadlines.

11. Supervisory authorities

If you believe your rights have been violated, you may lodge a complaint with the competent authority:

• EU/EEA: the data protection authority of your country of residence, place of work, or place of alleged infringement;
• Germany: the Landesdatenschutzbeauftragter of your federal state;
• UK: Information Commissioner's Office (ico.org.uk);
• Türkiye: Kişisel Verileri Koruma Kurumu (kvkk.gov.tr);
• California, USA: California Privacy Protection Agency (cppa.ca.gov) and the California Attorney General.

12. Security

We use industry-standard technical and organizational measures, including:

• TLS / HTTPS encryption for all data transmitted to and from the Website (HSTS where supported);
• Restricted access to user data on a strict need-to-know basis;
• Vendor due diligence on all processors we use;
• Regular review of access permissions, logs and security configurations.

No internet transmission is 100% secure. If a personal-data breach occurs that is likely to result in a high risk to your rights, we will notify you and the competent supervisory authority within the statutory deadlines (72 hours under GDPR Art. 33).

13. Children's privacy

This Website is not directed at children under 13 (or, where applicable, under 16). We do not knowingly collect personal data from children below this age. If you become aware that a child has provided us with personal data, please contact privacy@zfinanceapp.com and we will delete it promptly.

14. Links to third-party websites

The Website may contain links to third-party websites. We are not responsible for their privacy practices. Please consult their privacy policies before providing any personal data.

15. Updates to this Policy

We may update this Privacy Policy from time to time. The current version is always published on this page with the "Last updated" date. Material changes will be highlighted via a notice on the Website or communicated to you directly where required by law.

16. Contact

For any privacy-related question, request or concern:

Bera Duranoğlu: Person responsible for data protection
Bonita İnternet Teknoloji Ticaret A.Ş.
Altunizade Mah. Ord. Prof. Fahrettin Kerim Gökay Cad. No: 35/1, Üsküdar / Istanbul, Türkiye
Email: privacy@zfinanceapp.com

For non-privacy enquiries: info@zfinanceapp.com

Last updated: October 2026, Version 2.3 (website-only)