Privacy Policy
What personal data jekcms.com processes, why and on what legal basis, who receives it and how long it is kept.
Last Updated: October 14, 2026
This policy explains what personal data is processed on jekcms.com and in the jekcms licence services, why, on what legal basis, who receives it and how long it is kept. It is written to meet Article 13 of the EU General Data Protection Regulation (GDPR), the UK GDPR and Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK). The Turkish version is published as the KVKK Aydınlatma Metni.
1. Who is responsible
The controller is Celil Uyanıkoğlu (ALFA Dizayn Web Tasarım ve Yazılım), a sole proprietorship in Türkiye that owns the jekcms brand and operates jekcms.com. Tax details and the postal address for formal requests are on the Legal notice page. Email: info@jekcms.com.
2. What we process, why, and on what legal basis
Legal bases are given under GDPR Article 6(1): (a) consent, (b) performance of a contract, (c) legal obligation, (f) legitimate interests. The KVKK basis is the matching point of Article 5(2) of Law 6698.
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Visiting the site | IP address, browser details, requested page, time (server logs) | Running the site; detecting attacks and abuse | 6(1)(f) | Security logs 1 year; the hosting provider's access logs for the provider's own retention period |
| Customer account | Name, email, password hash (the password itself is never stored), optionally company name, tax number, phone and address; sign-in records (IP address, browser details) | Opening the account, providing licences and downloads, protecting the account | 6(1)(b); sign-in records 6(1)(f) | Account records for the duration of the relationship and 10 years after the last licence ends; sign-in records (successful and failed) 90 days. If you delete your account, your name, email, phone, address and tax details are removed at once; invoice and contract records that the law requires us to keep remain. |
| Purchase (Polar) | Name, email, customer and order number, chosen plan and services, partner code if any; IP address and browser details at the time of the order | Creating the order, sending you to Polar for payment, delivering the licence, preventing fraudulent orders | 6(1)(b); IP and browser details 6(1)(f) | Order records 10 years; IP address and browser details deleted after 2 years |
| Bank transfer sales and invoicing | Billing name, address, tax number, payment record | Issuing invoices, complying with tax law | 6(1)(b), 6(1)(c) | 10 years (Turkish Tax Procedure Law Art. 253; Turkish Commercial Code Art. 82) |
| Accepting the licence agreement | Email, order number, time of acceptance, IP address, browser details, accepted version and a hash of the text | Proving that the contract was concluded | 6(1)(b), 6(1)(f) | 10 years after the licence ends (Turkish Code of Obligations Art. 146) |
| Licence checks and updates (requests from your installation) | Licence key, domain, installation fingerprint, distribution tag, server IP address and country, jekcms and PHP version, operating system family, days since installation, number of errors in the last 24 hours, last error line (with email addresses, IP addresses and URL query strings masked), update download records | Validating the licence, delivering updates and security patches, seeing the problem when you ask for support, detecting unlicensed use | 6(1)(b); detecting unlicensed use 6(1)(f) | Licence records 10 years after the licence ends; IP addresses in update downloads deleted after 1 year, in domain events after 2 years |
| Installation marker (request from your site's pages) | Domain, installation fingerprint, distribution tag | Detecting unlicensed copies | 6(1)(f) | 400 days. This request comes from your site visitor's browser; the visitor's IP address, browser details and the page they opened are not stored. The IP address is kept only as a hash for one hour, for rate limiting. |
| Google connection relay | Temporary access and refresh tokens issued by Google | Connecting your Google Search Console, Analytics and AdSense account to your own jekcms panel (read-only scopes) | 6(1)(b) | Tokens sit in a temporary file for at most 10 minutes and are deleted when your server fetches them or when they expire. Refresh requests pass through our server and are not stored. Your Google report data does not pass through jekcms.com. |
| Support tickets | Name, email, ticket content, attachments | Providing support | 6(1)(b) | 10 years after the ticket is closed (business correspondence, Turkish Commercial Code Art. 82) |
| Contact form | Name, email, subject, message, IP address | Replying to you, blocking spam | 6(1)(f) | 2 years |
| Newsletter | Email, name if given, time of consent, IP address and browser details at the time of consent | Sending product news; proving consent | 6(1)(a), confirmed in two steps (you click the link in our email) | While you are subscribed; the consent record is kept for 3 years after you unsubscribe (Turkish Regulation on Commercial Communication, Art. 13) |
| Service emails | Name, email, licence and order details | Sending licence keys, receipts, renewal reminders and security notices | 6(1)(b) | Together with the account |
| Partner programme | Name, email, payee name, IBAN, IP address at the time you accepted the terms, click counts of your link, attributed sales | Calculating and paying commission | 6(1)(b), 6(1)(c) | Payment records 10 years |
| Piracy reports | Reporter's name, email and IP address; the reported site address | Reviewing the report, protecting our rights | 6(1)(f) | For the review and any resulting dispute |
| Outreach and partnership emails | Publicly available business contact details of press, agencies, organisations and creators (name, title, organisation, work email, profile link) and the correspondence | Introducing jekcms, proposing cooperation | 6(1)(f) | 2 years after the last contact if there is no reply. If you object, your details are deleted and we will not write to you again. |
3. Who receives the data
| Recipient | Data | Purpose | Location and transfer basis |
|---|---|---|---|
| Hostinger International Ltd. (hosting and email) | All data processed on the site and in the database; emails sent and received | Running the site, the database and email | United Kingdom. The European Commission has an adequacy decision for the UK (renewed in December 2025, valid until 27 December 2031). |
| Polar Software, Inc. | Name, email, customer and order number, plan, partner code if any | Taking payment. Polar sells our product as reseller (Merchant of Record) and processes your payment data itself under its own privacy policy; card details never reach us. | United States. Polar's Data Processing Addendum incorporates the EU Standard Contractual Clauses (Decision 2021/914). |
| Google LLC | Access tokens if you connect Google | Connecting your account | United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, including the UK Extension. |
| Banks | Payer name and account details if you pay by bank transfer | Receiving payment | Türkiye |
| Authorities and courts | Data requested by law | Legal obligation, protecting our rights | Türkiye |
For people in Türkiye, transfers abroad are governed by Article 9 of Law 6698. As of the date of this policy, the standard contract published by the Turkish Personal Data Protection Board has not been signed with these providers; we are working on it and will update this policy when that changes.
4. How we collect data
From forms you fill in (account, order, support, contact, newsletter, partner application), from the automatic requests your jekcms installation makes to our licence server, and from server logs. Business contact details used for outreach come from what people publish on their organisation's website or professional profiles; we link to this policy in our first email.
5. Cookies
jekcms.com uses no advertising or tracking cookies. Only the customer panel uses strictly necessary cookies that keep you signed in. See the Cookie Policy.
6. Your rights
Under the GDPR and UK GDPR you can ask for access to your data, rectification, erasure, restriction of processing and data portability, and you can object to processing based on legitimate interests. Where processing is based on consent (the newsletter), you can withdraw consent at any time with the link in every email; this does not affect earlier processing. Under Article 11 of Law 6698 you have the equivalent rights listed in the Turkish notice. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
Send your request to info@jekcms.com from the email address registered with us, or in writing to the address on the Legal notice page. We answer within one month (GDPR) and at the latest within 30 days (Law 6698), free of charge.
You also have the right to lodge a complaint with a supervisory authority: in the EU, the authority of the country where you live or work; in the UK, the Information Commissioner's Office; in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
7. Children
jekcms.com and the jekcms licences are meant for website owners and businesses, not for children. We do not knowingly collect data from children under 16.
8. Security
Connections use TLS. Passwords are stored as one-way hashes. Access to the customer and admin panels is protected by session and CSRF checks, rate limiting and optional two-factor authentication. No system is completely secure; if a breach affects your data, we will notify you and the competent authority as the law requires.
9. Changes
When our processing changes we update this policy and show the date at the top of the page. Before using data for a new purpose we inform you about that purpose separately.