Personal Data Protection Notice

Data controller

For Turkish Personal Data Protection Law No. 6698, the data controller is BYMMB Bilişim Akademi ve Ticaret Limited Şirketi.

Contact: Barbaros Mah. Begonya Sk. Nidakule Ataşehir Batı No: 1 İç Kapı No: 2 Ataşehir, Istanbul, Türkiye. Email: support@xlmindstudio.com. Website: xlmindstudio.com.

Scope

This notice explains processing when a person visits the website, starts a trial, purchases or activates a license, requests support or contacts us.

XLMind Studio's Excel tools run on the user's computer. Excel files, cell contents and worksheet names are not sent to our licensing, payment or website servers and are not shared with artificial intelligence services.

Data processed

Depending on use, we may process:

Name, surname, email and billing details.

Order number, plan, price, currency, payment status, transaction time, invoice data and limited records from iyzico.

License key, license type, device limit, activation time, status and a technical device identifier not intended to directly identify the owner.

IP address, user agent, product and version, device name, operating system and Office version, time zone, timestamps, error and security logs.

In-product messaging: the add-in version, the language preference and the license status (trial or licensed). No license key, device identifier or user name is sent with that request.

Support messages and files voluntarily sent by the user.

Language and essential website preferences.

Marketing preferences only where separate consent exists.

We do not store full card numbers or security codes. Payment is processed through iyzico.

Purposes and legal grounds

Data is used for trials, sales, delivery, activation, device management, payment, invoicing, support, security, fraud prevention, updates, legal compliance and legal claims.

Showing information, release and announcement messages inside the product: these are displayed within the add-in, rely on contract performance and on legitimate interests that do not override fundamental rights, and do not require separate consent.

Product and campaign announcements sent by email: sent only where separate, valid consent exists. That consent is never required in order to purchase or use the service and can be withdrawn at any time.

Processing relies on contract necessity, legal obligations, establishment or protection of rights and legitimate interests that do not override fundamental rights. Marketing activities requiring consent rely on separate consent.

Collection

Data is collected through forms, purchase and payment pages, license activation, support email, server and security logs and information provided by the user.

It is also collected through the calls the add-in makes to our license verification, update check and in-product messaging services. As with any internet request, the IP address appears in ordinary server and security logs.

Where data is hosted

XLMind Studio's main production infrastructure and database are hosted in Türkiye. The application data behind customer, licence, sales and support processes is held on that infrastructure in Türkiye.

Backup and disaster recovery measures are maintained in Türkiye to keep that data available and secure.

Disclosure

Personal data may be disclosed only as far as necessary, and only for the purpose it was collected for, to the following groups of recipients:

Payment service providers, to collect payment for an order. Payments are taken through iyzico, a payment institution established in Türkiye.

Hosting and technical infrastructure providers, to deliver, maintain and secure the service.

Email and communications providers, to send and receive licence, order, contract, security and support messages.

Invoicing, accounting, legal and audit providers, to meet statutory obligations and to establish or defend a legal claim.

Public authorities, courts and enforcement offices legally entitled to receive it.

Where a service provider is established outside Türkiye, any transfer is made in line with the conditions of Article 9 of Law No. 6698 and remains limited to that purpose.

Your Excel files, cell contents and worksheet names are not part of any of these disclosures.

Retention and security

Data is retained only for the necessary purpose and statutory periods, then deleted, destroyed or anonymized. Files attached to a support request are deleted automatically 90 days after upload, while the correspondence itself is retained.

We apply appropriate technical and organizational measures to prevent unlawful processing of and access to personal data, including data minimisation, authorization and access control, encryption in transit and regular backups.

As with any internet system, no absolute guarantee of security is possible. Where a breach is suspected, the necessary investigation and notifications are carried out.

Rights and applications

Data subjects may exercise the rights under Article 11 of Law No. 6698, including access, information, correction, deletion where conditions apply, information about recipients, objection to certain automated outcomes and compensation for unlawful processing.

Applications may be submitted in writing to the company address or from an email address already registered in our systems to support@xlmindstudio.com. Requests are handled as soon as possible and no later than 30 days.