1. Who is responsible
The data controller for BuyCux is PROCUX Technology Inc., Ege University Technopark, İnci Building, No. 103, Bornova, İzmir, Türkiye ("we", "us"). For any privacy question or request, email support@buycux.com with "Privacy request" in the subject, or write to the address above.
This policy covers the buycux.com website, BuyCux accounts, our forms and our newsletter.
2. What we collect
- Account and business details: your name, email address, password (stored only in hashed form), business name, country, city, type of business, phone number, VAT number and website.
- Purchasing information: the categories you buy, purchase requests, quotes, the framework prices you use and the savings shown on your quotes.
- Form submissions: what you send through the contact form, savings report requests and supplier applications, including company details, delivery regions and certifications.
- Newsletter: your email address, where you signed up, the version of the consent text you saw, and when you confirmed or unsubscribed.
- Billing: Paddle collects your payment details at checkout. We receive your customer and subscription references, plan, billing status, amounts and invoice numbers. We never receive full card numbers.
- Technical data: IP address, browser and device information in server logs, and the signals the bot-protection check uses to tell people from automated traffic.
3. Why we use it, and on what legal basis
| Purpose | GDPR basis | KVKK basis |
|---|---|---|
| Providing your account and membership, routing purchase requests, showing savings on quotes, service emails | Contract, Art. 6(1)(b) | Art. 5(2)(c), performance of a contract |
| Answering enquiries and reviewing supplier applications | Steps before a contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) | Art. 5(2)(c) and 5(2)(f) |
| Keeping billing and tax records | Legal obligation, Art. 6(1)(c) | Art. 5(2)(ç), legal obligation |
| Security, preventing fraud and abuse, protecting forms from bots | Legitimate interests, Art. 6(1)(f) | Art. 5(2)(f), legitimate interests |
| Combining member demand, without identifying anyone, to negotiate framework prices | Legitimate interests, Art. 6(1)(f) | Art. 5(2)(f), legitimate interests |
| Sending the newsletter | Consent, Art. 6(1)(a) | Explicit consent, Art. 5(1) |
You can withdraw newsletter consent at any time with the unsubscribe link in any newsletter or by emailing us. Withdrawing consent does not affect anything we did before.
4. Who we share it with
We use the following service providers. They process personal data only on our instructions, except Paddle as noted.
| Provider | Location | What they do |
|---|---|---|
| Payment reseller and merchant of record: Paddle (Paddle.com Market Limited, or Paddle.com Inc. for purchases from the United States) | United Kingdom, United States | Takes membership payments, issues invoices, handles sales tax and VAT, and processes refunds. Paddle acts as a separate controller for the payment data it collects at checkout. |
| Email delivery provider | United States | Sends account, form, billing and newsletter emails on our behalf. |
| Hosting provider | Germany | Runs the servers and the database that hold your account and purchasing data. |
| Network security and content delivery provider | United States, with a global network | Protects the site against attacks, delivers pages quickly and runs the bot-protection check on our forms. |
Suppliers. When you send a purchase request or an order, we share the request details and the business contact details needed for a quote or delivery with the suppliers concerned.
Authorities. We disclose personal data to public authorities only where the law requires it.
We do not sell personal data, and we do not share it for advertising.
5. International transfers
We are based in Türkiye, and some of our providers are in other countries, including the United States and the United Kingdom. When personal data leaves the European Economic Area, the United Kingdom or Türkiye, we rely on adequacy decisions where they exist and otherwise on standard contractual clauses or equivalent safeguards. Transfers from Türkiye follow Article 9 of the KVKK, including standard contracts notified to the Personal Data Protection Authority where that is required.
6. How long we keep it
- Account and purchasing data: while your account is open, then up to 24 months unless you ask us to delete it sooner.
- Billing and tax records: for as long as tax and commercial law require.
- Enquiries and supplier applications: up to 24 months after our last contact with you.
- Newsletter: until you unsubscribe. We keep a record of your consent and of the unsubscribe for as long as we need to show we respected your choice.
- Server logs: for a limited period, for security and troubleshooting.
7. Your rights
Under the GDPR you can ask for access to your personal data, correction, erasure, restriction of processing, data portability, and you can object to processing based on legitimate interests. Under Article 11 of the KVKK you can ask whether we process your data, request information about that processing and its purpose, learn who we transfer it to in Türkiye or abroad, ask for correction, deletion or destruction and for those changes to be passed on to recipients, object to a result produced solely by automated analysis that is against you, and claim compensation for damage caused by unlawful processing.
Send requests to support@buycux.com. We reply within 30 days. We may ask you to confirm your identity first.
You can also complain to a data protection authority: in Türkiye, the Personal Data Protection Authority (KVKK); in the EU or the United Kingdom, the authority where you live or work.
8. Security
We encrypt data in transit, store passwords only in hashed form, limit access to personal data to the people who need it, and keep our systems up to date.
9. Cookies
We use only strictly necessary cookies. The cookie policy lists them.
10. Children
BuyCux is a service for businesses and is not directed at children.
11. Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version. If a change is significant, we will tell members by email.