Prepared under Law No. 6698 on the Protection of Personal Data (“KVKK”) art. 10 and the Communiqué on the Procedures and Principles of the Obligation to Inform. Effective: 16 August 2026. This is the English version of the same notice.
1. Data controller
Cormsor LLC (the “Company”), under the Webhostric brand on webhostric.com.tr, is the data controller under KVKK for personal data processed in domain search, site setup and related digital services.
- Registration: State of Wyoming, United States
- Registered address: 30 N Gould St Ste R, Sheridan, WY 82801, United States
- Service area: online services for users in Turkey
- Contact: destek@webhostric.com.tr · WhatsApp +1 978 584 4616 · Contact form
As a controller established abroad, the Company meets its KVKK duties through this notice and related processes. If a data-protection representative is appointed, it will be announced here.
2. Personal data processed
- Identity: name, surname (if shared via Google or during an order / contact)
- Contact: email, phone number, WhatsApp correspondence
- Customer transaction: searched / purchased domain, chosen theme, order and setup status
- Transaction security: IP address, browser/device, session cookie, security and abuse logs
- Marketing / account: name, email, profile picture and account id shared by Google when you sign in with Google
- Payment: payment session id, amount, status. Card numbers are not stored on our site; collection is through Polar.sh
Special-category data (health, religion, union membership, etc.) is not requested and is not processed on purpose. Please do not send such data on support channels.
3. Purposes of processing
- Forming and performing the contract: domain search, payment check, registration, DNS, publish, support
- Creating an account and keeping the session (Google sign-in, cookies)
- Security, fraud and abuse prevention, rate limits, logs
- Legal duties (invoices, disputes, official requests)
- Improving the service and fixing errors (anonymous or with as little data as possible)
4. Legal grounds (KVKK art. 5)
- art. 5/2-c: forming or performing a contract
- art. 5/2-a: expressly provided for by law
- art. 5/2-ç: legal obligation
- art. 5/2-e: establishment, exercise or protection of a right
- art. 5/2-f: legitimate interest (security, continuity of service; without harming your fundamental rights)
- art. 5/1: explicit consent — only where consent is required (for example optional contact)
5. How we collect
Data are collected automatically or partly automatically through website forms, Google OAuth, payment redirect, cookies/local storage, server and security logs, and WhatsApp/email support.
6. Transfers and abroad (KVKK arts. 8–9)
Because of the nature of the service, data may be transferred to the following recipients, limited to the purpose:
- Polar.sh — card payments (card data is processed on Polar’s systems)
- Hosting and security provider — CDN, DDoS/bot protection, logs
- Domain registrar — legal registration and WHOIS/TRABIS duties
- Google LLC — identity if you choose “Sign in with Google”
- Meta / WhatsApp — if WhatsApp is used for support
Some recipients are established abroad. Transfer is made for performance of the contract, legal duty, or other suitable safeguards under KVKK art. 9. Identity/contact data that must be shared for registration is sent to the registrar under applicable domain rules.
7. Retention
- Account and site records: for the membership / service relationship
- Order and payment records: minimum commercial and tax periods (as a rule 10 years)
- Security and access logs: up to 2 years (or the relevant period if there is an investigation)
- Google session cookie: until you sign out, or at most 3 months
- Support correspondence: until the request is resolved and limitation periods expire
When the period ends, data are deleted, destroyed or anonymised (KVKK art. 7 and related regulation).
8. Cookies
Essential session cookies (sign-in, security, order tracking) are used to provide the service. Third-party advertising or tracking cookies are off by default. You can delete cookies in the browser; if essential cookies are blocked, sign-in and payment may not work.
9. Your rights under KVKK art. 11
As a data subject you may:
- Learn whether your personal data are processed
- Request information if they are processed
- Learn the purpose and whether they are used in line with it
- Know third parties to whom they are transferred in Turkey or abroad
- Request correction if incomplete or inaccurate
- Request deletion or destruction under KVKK art. 7
- Request that correction/deletion is notified to third parties
- Object to a result against you that arises solely from automated systems
- Claim compensation if you suffer damage from unlawful processing
10. How to apply (KVKK art. 13)
Send your request in Turkish or English, with information that identifies you, through:
Applications are concluded free of charge within 30 days under the Communiqué on the Procedures and Principles of Application to the Data Controller. If the process has an extra cost, the tariff in that communiqué may apply. A refusal is notified in writing or electronically with reasons.
If your application is refused, you find the reply insufficient, or no reply is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the reply and in any case within 60 days of the application (KVKK art. 14).
11. Security
HTTPS, access control, bot protection and least privilege are applied. Card data is not kept on our site. Absolute security cannot be promised; access may be limited if a transaction looks suspicious.
12. Children
The service is not designed for people under 18. If we learn you are under 18, we delete the related account and data.
13. Updates
This text is updated when the law or the service changes. The current version is always at webhostric.com.tr/kvkk. Material changes may be announced on the site.
14. Related documents
Privacy summary · Terms of use · About