Privacy Policy

Effective date: 2026-09-22

This Privacy Policy explains how personal data is collected, used and stored when you visit ocuvanta.com (the "Site") or purchase a software license for OCUVANTA products. The Site is operated by the merchant identified below as the data controller. This policy is written in plain language; it does not limit the rights granted to you by applicable law.

1. Data controller

The data controller responsible for personal data processed through the Site is:

• Legal name / trade name: ŞÜKRAN ŞEN
• Tax office: SULTANBEYLİ
• Tax number: 8030293567
• Address: Kemal Türkler Mah. Prof Nurettin Tanrıverdi Sk. B Blok No: 6 İç Kapı No: 11, Sancaktepe / İstanbul
• Email: sukran.ocuvanta@gmail.com
• KEP address (if any): Bulunmamaktadır.
• MERSIS number (if any): Bulunmamaktadır.

The merchant is a sole proprietorship established in the Republic of Türkiye and has no establishment in the European Economic Area or the United Kingdom. All privacy requests, wherever you are located, are handled through the contact details above.

2. What we collect

The Site does not require you to create an account. We collect only the data needed to complete a purchase and deliver a license.

• Email address: required at checkout. It is checked for format only and is not verified. It is used to identify your order and, if email sending is configured, to send order and license information.
• Billing information: on the international storefront, business name, country and tax ID are optional and used only if you request an invoice showing them. On the Turkish storefront, name or company title and city are required for invoicing; tax or national identification number, tax office, district and full address are optional.
• Order and license records: products purchased, license term, order number, amounts, currency, order status, the license key (stored encrypted) and a hash of the recovery code.
• Legal acceptance record: the version of the documents you accepted at checkout, and the date and time of acceptance.
• Activation data: a hashed device identifier and application version when a license is activated in the desktop application. We do not receive the raw device identifier.
• Technical data: a hashed form of your IP address, used for rate limiting, fraud prevention and download logging, and download records (order, license, file, time, result). Raw IP addresses are not stored.
• Contact and demo requests: the name, email address, subject and message you submit through the contact form, and the name, email address, company and optional phone number you submit through the demo request form.
• Support correspondence: messages you send through the contact channels listed in Section 13.

3. Payment data and payment security

Payments are processed by the bank virtual POS you select at checkout. Card details (card number, expiry date, CVV) are entered on the bank's secure payment page or transmitted directly to the bank's systems over an encrypted connection, and 3D Secure authentication is applied where the selected bank supports it. The merchant does not receive, store or log card data, and no cookie or log on the Site contains card details. We keep only the transaction reference, amount, currency, status and the payment date returned by the bank. All pages of the Site are served over HTTPS.

4. Purposes and legal bases

We process personal data for the following purposes:

• To conclude and perform the purchase contract: process your order, deliver the license key and downloads, and provide license access (legal basis: performance of a contract).
• To comply with legal obligations: issue invoices, keep accounting and tax records, and respond to lawful requests from public authorities (legal basis: legal obligation).
• To protect the Site and licenses: rate limiting, abuse and fraud prevention, activation limits, security logging (legal basis: legitimate interest in the security and integrity of the service).
• To answer your contact, demo, support and refund requests (legal basis: performance of a contract and legitimate interest).

We do not use your data for profiling, advertising, marketing messages or automated decision-making that produces legal effects. No processing on the Site is based on consent.

5. Cookies

The Site sets only strictly necessary cookies. It sets no analytics, advertising or social-media cookies, and fonts, scripts and styles are self-hosted, so visiting the Site does not send requests to third-party providers. The Cookie Policy lists every cookie, its purpose and its lifetime. If an analytics or similar service is ever enabled, this policy and the Cookie Policy will be updated first and, where the law requires it, your consent will be requested before such cookies are set.

6. Recipients

Personal data is shared only with the following categories of recipients, and only to the extent necessary:

• The bank or payment service provider operating the virtual POS you choose, to process the payment and any refund or chargeback.
• The hosting and infrastructure provider that operates the servers on which the Site runs.
• The email service provider that delivers order, license and invoice notifications, where email sending is configured.
• The merchant's accountant, for invoicing and bookkeeping.
• Public authorities, including the Turkish tax administration, where required by law.

We do not sell personal data and do not share it with advertisers.

7. International transfers

The merchant is established in Türkiye, and personal data processed to perform your order is processed in Türkiye. The Site is hosted on servers operated by our hosting provider. Where personal data is transferred outside the country in which you are located, including to Türkiye, the transfer is made only for the purposes described above and we rely on appropriate safeguards, such as contractual commitments with the provider that impose confidentiality and security obligations equivalent to those in this policy. You can ask us for information about the safeguards that apply to a transfer by using the contact details in Section 13.

8. Retention

• Order, invoice and payment records are kept for the periods prescribed by Turkish tax and commercial legislation, which for commercial books and records is ten years.
• License records are kept for the life of the license and for the statutory period that follows.
• Activation and download logs are kept for the life of the license and, afterwards, only for as long as needed to handle disputes and abuse investigations, then deleted or anonymized.
• Hashed IP data used for rate limiting and abuse prevention is kept only for as long as that purpose requires and is deleted within twelve months at the latest.
• Contact form, demo request and support correspondence are kept for as long as needed to handle the request and any follow-up.

At the end of these periods personal data is deleted, destroyed or anonymized.

9. Security

License keys are stored encrypted. Recovery codes, device identifiers and IP addresses are stored only as hashes. Payment provider credentials are stored encrypted and are never displayed again after they are saved. Administrative access is restricted, logged and protected by strong authentication. Product files are stored outside the web root and delivered through signed, expiring links. No security measure is perfect; please keep your license key and recovery code safe, because they are shown in full only once at purchase time.

10. Your rights

Depending on your location, you may have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of data that we are not required to keep by law;
• object to or request restriction of processing based on legitimate interest;
• request a copy of your data in a portable format;
• lodge a complaint with a supervisory authority.

To exercise these rights, use the contact details in Section 13 and include your order number and the email address used at checkout so that we can identify your records. We will respond within the period required by applicable law. If you are in the European Economic Area or the United Kingdom, you may also lodge a complaint with the data protection authority of your country. Persons in Türkiye may exercise the rights set out in the Turkish Personal Data Protection Law (KVKK) and may complain to the Personal Data Protection Authority; see the KVKK notice on the Turkish storefront.

11. Children

The Site sells business software and is not directed at children. We do not knowingly collect data from persons under the age of majority.

12. Changes

We may update this policy from time to time. The effective date at the top of this page identifies the current version. Substantive changes will be published on the Site before they take effect.

13. Contact

Questions about this policy can be sent through the Contact page. You can also email sukran.ocuvanta@gmail.com.