Privacy and Security Policy
This policy explains which personal data autoecufile.com collects, why, who it is shared with, how long it is kept and how it is protected. It is written for Law No. 6698 on the Protection of Personal Data (KVKK) and, for customers in the European Union, the GDPR.
- We collect only what is needed to sell and deliver files: account details, billing details, order and download history, support messages and basic technical logs.
- Card numbers never reach us; payment is handled by iyzico with 3D Secure.
- We do not sell personal data. It is shared only with the services that run the store (payment, hosting, e-mail, chat, analytics).
- You can ask to see, correct or delete your data at any time at [email protected].
01 Who is responsible
The data controller is AutoECUFile, operator of autoecufile.com, Malatya, Türkiye. Contact for all privacy matters: [email protected].
02 What we collect
| Account data | Name, e-mail address, username, password (stored hashed), account settings. |
|---|---|
| Order data | Billing name, company, address, country, phone, VAT/tax number if you enter one, the files ordered, prices, order status, invoice details. |
| Download data | Which files you downloaded and when; the IP address at the time of download (used to detect abuse and to prove delivery). |
| Support and requests | Messages you send through the contact form, file-request form, live chat or e-mail, including any label photos you attach. |
| Technical data | IP address, browser type, pages visited, referring page, approximate location derived from the IP, collected in server logs and analytics. |
| Payment data | Transaction ID, amount, last four digits and card brand as returned by iyzico. The full card number and security code are entered on iyzico’s secure form and never stored by us. |
03 Why we use it and legal basis
- Performing the contract: creating your account, taking payment, delivering files, keeping them available for re-download, answering support requests (KVKK Art. 5/2(c); GDPR Art. 6/1(b)).
- Legal obligations: issuing invoices, keeping accounting and tax records, responding to lawful requests from authorities (KVKK Art. 5/2(ç); GDPR Art. 6/1(c)).
- Legitimate interests: securing the site, preventing fraud, chargebacks and file sharing, measuring which pages are used, improving the catalogue (KVKK Art. 5/2(f); GDPR Art. 6/1(f)).
- Consent: marketing e-mails and non-essential cookies, which you can withdraw at any time (KVKK Art. 5/1; GDPR Art. 6/1(a)).
04 Who we share it with
We do not sell or rent personal data. Data is shared only with processors that are necessary to run the store, under contracts that limit its use:
- iyzico (payment processing, 3D Secure, fraud checks);
- hosting and infrastructure: our server provider and Cloudflare (CDN, DDoS and bot protection), which see IP addresses and request data;
- e-mail delivery for order confirmations, download links and support replies;
- live chat (Tawk.to) if you use the chat widget;
- analytics (Google Analytics) in anonymised form;
- authorities where the law requires it, and card issuers in the case of a payment dispute.
Some of these providers process data outside Türkiye or the European Economic Area. Where that happens we rely on the provider’s standard contractual safeguards and on your explicit consent where KVKK requires it.
05 Cookies
| Strictly necessary | WooCommerce session and cart cookies (wp_woocommerce_session_*, woocommerce_cart_hash, woocommerce_items_in_cart), login cookies, security cookies from Cloudflare. Without these the cart and account do not work. |
|---|---|
| Functional | Recently viewed files, chosen filters, live chat state. |
| Analytics | Google Analytics cookies that measure visits and page use. IP addresses are truncated. |
You can delete or block cookies in your browser settings; blocking the necessary cookies will prevent you from buying.
06 How long we keep data
- Account and download history: as long as your account exists, so that you can re-download your files. You may ask us to delete the account at any time.
- Orders and invoices: 10 years, as required by Turkish tax and commercial law.
- Support messages: 2 years after the last contact.
- Server logs: 90 days, longer only if needed for a security investigation.
07 Security
The site is served only over HTTPS. Passwords are stored as salted hashes. Card payments run on iyzico’s PCI-DSS certified infrastructure with 3D Secure; we never receive card numbers. Access to the server and the store administration is limited to authorised staff with individual credentials, and the site is protected by a web application firewall, rate limiting and daily backups. If a data breach affecting you ever occurs, we will notify you and the Personal Data Protection Authority as the law requires.
08 Your rights
Under Article 11 of KVKK, and Articles 15–22 of the GDPR where applicable, you can ask us:
- whether we process your data and, if so, to receive a copy;
- to correct incomplete or inaccurate data;
- to delete or anonymise data that we no longer need to keep;
- to know the third parties your data was transferred to;
- to object to processing based on legitimate interests, and to withdraw consent;
- to receive compensation if you suffer damage from unlawful processing.
Send your request to [email protected] from the e-mail address registered on your account. We answer within 30 days at the latest and free of charge. You may also complain to the Personal Data Protection Authority (KVKK Kurumu) or, in the EU, to your national supervisory authority.
09 Marketing e-mails
We send order and delivery e-mails to everyone who buys. Newsletters or offers are sent only if you opted in, and every such e-mail contains an unsubscribe link. Opting out does not affect order e-mails.
10 Changes and contact
We may update this policy when our services or the law change; the date at the top shows the current version. Questions and requests: [email protected] or the contact page.