KombinIQ website · English notice, version en-0.1 · August 2026 · Türkçe sürüm
⚠️ DRAFT — this is not legal advice. This notice is provided for general information. It must be reviewed by a qualified data-protection lawyer (KVKK and, where applicable, GDPR) before it is treated as final. In case of any conflict, the reviewed Turkish notice prevails until this English version has been independently approved.
Who we are (data controller)
Your personal data is processed by Reyhan Açar ("KombinIQ"), acting as data controller within the meaning of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and, where it applies to you, the EU General Data Protection Regulation ("GDPR"). Contact:[email protected]
Which laws apply to you?
KombinIQ is established in Türkiye, so KVKK always applies. If you are located in the European Union or the European Economic Area and use our services offered to you there, the GDPR may additionally apply to our processing of your data. Where this notice states a right or safeguard, we apply the stronger of the two standards to your request.
What this notice covers
This English notice covers the waiting-list sign-up on this website — the form where you leave your email address to receive a pilot invite code. Two related processes are covered by their own notices:
The app pilot (photo upload): uploading wardrobe photos in the KombinIQ app is subject to a separate consent flow shown inside the app, before any photo is uploaded. That consent is currently presented in Turkish; an English version is being prepared. If you are not comfortable consenting in Turkish, please wait for the English in-app notice before uploading photos.
Studio home-shoot bookings: the Studio service (a team photographing your wardrobe at home, Istanbul only) is booked and documented through our Turkish-language flow and Turkish notice (KVKK Aydınlatma Metni, Section B). Booking confirmations and the separate written consent signed on shoot day are in Turkish.
Waiting list — what we collect
Through this form we collect only your email address. We do not collect your name, phone number, precise location or photos. Technically, we also record the country code of the request (e.g. "TR", "DE"), the form's language ("en") and, where present, the campaign source (utm parameters). This page uses no cookies and no tracking or analytics tools. Your IP address is not stored.
Why we process it, and on what legal basis
Purpose: sending you your pilot invite code, early-access information and product launch news for the KombinIQ app, by email.
Legal basis: your explicit consent — KVKK Art. 5/1 and, where the GDPR applies, consent under GDPR Art. 6(1)(a). Consent is given by ticking the box on the form; if you do not tick it, your email address is not stored. The moment, version and scope of your consent are logged server-side so that we can demonstrate it (GDPR Art. 7(1)).
No obligation: signing up is entirely optional; not signing up has no consequence for you.
No profiling: we do not use your email address for profiling, ad targeting or automated decision-making that produces legal or similarly significant effects (GDPR Art. 22).
Where your data is stored — international transfers
Your email address is never sold and never shared for marketing. Records are stored on infrastructure provided by Cloudflare, Inc. (headquartered in the USA) — Cloudflare D1 — which hosts and runs this website under a data-processing agreement.
Under KVKK (Art. 9): because the provider's servers are located outside Türkiye, your data is treated as transferred abroad on the basis of your explicit consent, which the form's consent box covers.
Under GDPR (Chapter V), where it applies: transfers to Cloudflare rely on the safeguards Cloudflare provides for international transfers, including Standard Contractual Clauses in its data-processing terms. ⚠️ Lawyer review item: confirm the current transfer mechanism (SCCs / EU–US Data Privacy Framework status) before this notice is finalised.
How long we keep it
Your email address is deleted 12 months after the app's launch or as soon as you withdraw your consent — whichever comes first.
Security
Data travels over an encrypted connection (HTTPS) and is stored in an access-restricted database. External access to the records is possible only with a confidential access key that is rotated regularly. No cookies, tracking or analytics tools are used on this site; IP addresses are not stored.
Your rights
Under KVKK Art. 11 — and, where the GDPR applies, under GDPR Arts. 15–22 — you have the right to:
learn whether your data is processed, and request information about it (access)
learn the purpose of processing and whether it is used in line with that purpose
have incomplete or inaccurate data corrected (rectification)
have your data deleted or destroyed (erasure / "right to be forgotten")
know the third parties to whom your data is transferred, in Türkiye or abroad
object to a result that arises against you from analysis by automated systems, and — under GDPR — object to processing and request restriction of processing
receive your data in a structured, commonly used, machine-readable format (GDPR Art. 20 — data portability), to the extent applicable
claim compensation if you suffer damage due to unlawful processing
withdraw your consent at any time, with effect for the future — withdrawal does not affect the lawfulness of processing carried out before it
To exercise any of these rights, or to withdraw consent, email [email protected]. Requests are answered free of charge within 30 days at the latest (KVKK m. 13; GDPR Art. 12(3) allows one month, extendable — we apply the shorter period).
If your request is refused, you find the answer insufficient, or you receive no answer in time, you may lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu — KVKK Arts. 14–15). If the GDPR applies to you, you may also lodge a complaint with the supervisory authority of your EU member state of residence or workplace (GDPR Art. 77).
Changes to this notice
This notice carries a version number (top of page). If the scope of processing changes, the notice is updated, the version number increases, and consent is re-sought where the change requires it. Earlier versions are retained as part of the consent log.