This policy explains how personal data is processed when you use the Wolob news CMS and the www.wolob.com website. It serves as our privacy notice under the EU General Data Protection Regulation (GDPR) and our information notice under Turkey's Personal Data Protection Law No. 6698 (KVKK).
1. Who we are
Data controller: Wolob (the company is being incorporated; its legal name and address will be published on this page once incorporation is complete).
Contact: hello@wolob.com
2. Who this policy covers
- Website visitors: anyone browsing www.wolob.com.
- People who use our forms: anyone sending an early-access, demo or contact request.
- Customers and their users: publishers with a Wolob account and the editors and administrators working in the dashboard.
For the readers of news sites that our customers publish with Wolob, the publisher is the controller; Wolob processes that data on the publisher's behalf and instructions as a processor. Readers should contact the publisher first.
3. Data we process
- Visit and security logs: IP address, browser details, the page requested, date and time, kept to run the service securely and prevent abuse.
- Form data: name, email, publication or site name, current website, country, the plan and theme you are interested in, your message and the time of your consent. We do not store your IP address in plain form with a request; we keep only a one-way hash of it to spot abuse.
- Customer account data: name, email, role and permissions, sign-in and session records, two-factor settings, billing and contract details.
- Email delivery records: delivery, bounce and complaint status of the service emails we send you (invitations, password resets, billing and security notices).
Card details are entered on the payment provider's secure page; Wolob never sees or stores your card number.
4. Purposes and legal bases
- Answering your request, arranging a demo and preparing a quote: steps prior to entering a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) and your consent.
- Providing the service, managing your account, support and billing: performance of the contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
- Meeting legal obligations such as tax and bookkeeping rules and laws on online publications: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
- Keeping the service secure, preventing abuse and spam, measuring service quality: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- Product news and promotional emails: only with your explicit consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)).
5. Email communication
Apart from answers to your request and service emails, we send promotional emails only with your consent. Every promotional email contains a one-click unsubscribe link, and unsubscribe requests take effect immediately. We stop sending to addresses that bounce or report a complaint. We never use purchased or scraped address lists.
6. Sharing and service providers
We do not sell your data. To provide the service we share it, only as far as needed and under contract, with providers in these categories:
- Hosting: data centres in the European Union and Turkey. Customers can choose the Turkey, EU or US region for their site data.
- Content delivery network (CDN) and security: fast and secure delivery of pages, attack and bot protection.
- Email delivery service: sending service and reply emails.
- Payment provider: taking payments.
Some of these providers may process data outside your country. Such transfers rely on appropriate safeguards under Chapter V of the GDPR and Article 9 of the KVKK (for example standard contractual clauses). We may disclose information where lawfully required by competent authorities.
7. Retention
- Form requests: up to 24 months after the request is closed; if you become a customer, together with your account data.
- Customer account data: for the term of the contract and afterwards for the statutory retention periods (for example tax rules for invoices).
- Visit and security logs: as long as the applicable law requires, at most two years.
- Backups are kept on a limited rotation and expire automatically.
When a period ends, the data is deleted, destroyed or anonymised.
8. Security
All connections are encrypted (HTTPS). Access is limited by role and need, administrator accounts use two-factor authentication, secrets are stored encrypted and our systems are monitored around the clock. If a personal data breach occurs, we notify the people affected and the competent authority within the legal time limits.
9. Your rights
Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to processing and to data portability. Where processing is based on consent, you can withdraw it at any time. Under the KVKK (Art. 11) you can also learn whether your data is processed and for what purpose, who it has been shared with, and ask for correction, deletion and notification of third parties.
Send requests to hello@wolob.com; we reply within 30 days. If you are not satisfied, you can complain to the data protection authority in your country or to Turkey's Personal Data Protection Board.
Our services are not directed at people under 18.
10. Changes
We update this policy when our service or the law changes. The current version is always on this page, and we email customers about significant changes.