Data Processing Notice

This notice explains, under Turkish Personal Data Protection Law no. 6698 (KVKK), for which purposes and on which legal grounds your personal data is processed in the Ortak Bütçe app, who it is shared with, and what rights you have over it. For a detailed breakdown of the data itself, see the Privacy Policy.

1. Data controller

The data controller is Dualyx Labs, which operates the Ortak Bütçe app. You can send the requests described in this notice to support@dualyxlabs.com.

2. Categories of personal data processed

• Identity and contact data: Name, email address, phone number if provided,

profile photo.

• Account and preference data: Language and currency preference, account

status, session and device records.

• Financial records: Ledgers, accounts, categories, income and expense

transactions, recurring transactions, shopping lists, and their descriptions.

• Receipt images: Receipt reading runs on your phone; the image is never

uploaded to our servers. Only the read fields you save onto a transaction are kept, as part of that financial record.

• Transaction security data: IP address, sign-in records, error and crash

records.

• Payment and subscription data: Subscription status, purchases, and credit

movements.

3. Purposes and legal grounds

Formation and performance of a contract (KVKK art. 5/2-c). Creating and managing your account, storing ledger and transaction records, governing access in shared ledgers, tracking your subscription and credit balance, and answering support requests.

Legitimate interest (KVKK art. 5/2-f). Keeping your account secure, preventing unauthorized access and abuse, keeping the technical records needed for service continuity, and informing you about the basic operation of the service.

Legal obligation (KVKK art. 5/2-ç). Retention duties arising from financial legislation and responding to requests from authorized public bodies.

Explicit consent (KVKK art. 5/1). Sending notifications, usage analytics, sharing error reports, showing personalized ads, and sending marketing messages. These are carried out only if you give the relevant approval, and withdrawing it stops the processing.

4. How data is collected

Data comes from what you enter while using the app, from the technical records your device sends automatically, and from the records the app store reports to us when you buy a subscription.

5. Transfers

Your data is shared with the following parties to the extent needed to provide the service:

• Hosting and infrastructure providers: to store data and run the app.
• App stores and subscription infrastructure: to verify subscription and

purchase records.

• Notification providers: to deliver push notifications, if you allow them.
• Advertising and measurement providers: to show ads and measure usage, if

you allow it.

• Authorized public bodies: where a legal obligation applies.

People you invite to a shared ledger see the records you add to that ledger. That sharing happens at your own request.

Some of these providers are located abroad; in that case the transfer is made in line with the KVKK provisions on transfers abroad, under contractual safeguards or your explicit consent.

6. Retention

Account and financial records are kept for as long as your account is open. When you delete your account, data is deleted or anonymized within 30 days at the latest. No files are kept on our servers; report and data exports are generated with the request and sent straight to you, with no copy retained. Records we are legally required to retain are kept for the prescribed period.

7. Your rights

Under article 11 of the KVKK you may:

• Learn whether your personal data is processed and, if so, request information

about it.

• Learn the purpose of processing and whether the data is used accordingly.
• Know the third parties in Türkiye or abroad to whom your data is transferred.
• Request that incomplete or incorrect data be corrected.
• Request that your data be erased or destroyed where the conditions are met.
• Request that corrections, erasures, and destructions be notified to the third

parties the data was transferred to.

• Object to a result reached against you through the analysis of processed data.
• Claim compensation if you suffer damage because your data was processed

unlawfully.

8. Exercising your rights

Send your requests to support@dualyxlabs.com from the email address associated with your account. We answer within 30 days at the latest. Where we cannot verify your identity, we may ask for further information.

To get a copy of your data without waiting, create a data archive from the profile screen in the app. You can withdraw the approvals you gave at any time from the privacy center.