1. Who this notice is for
PeykMail is a platform that businesses use to email their own customers and subscribers. Personal data is processed here in two different roles:
- If you are on a business's email list, that business is the data controller for your data. PeykMail is the data processor, working on the business's instructions and on its behalf. The one exception is the fingerprint of addresses that do not exist, for which we are the data controller. Details in section 3.
- If you use an account on PeykMail, have written to us or are visiting this site, we, Engin Satıcı – Bonduo Dijital Ajans, the operator of PeykMail, are the data controller for your data. Details in sections 4 and 5.
2. The data controller
- Legal name
- Engin Satıcı – Bonduo Dijital Ajans
- Address
- Yamanevler Mah. Akgül Sok. No: 1 İç Kapı No: 18, Ümraniye, İstanbul, Türkiye
- Tax office and number
- Alemdağ tax office, 7520604076
- info@peykmail.com
3. People on businesses' lists
If you are on a business's email list, your data is processed on that business's instructions. The business decides which data is collected and what it is used for; we use it only to send the business's emails and to keep the service safe. The data comes from the lists the business uploads, from forms you fill in and, automatically and in electronic form, from the sending of the emails.
Data processed
- Your email address; your name and any other fields the business uploaded or you filled in on a form; which lists you are on.
- Consent records: the text you were shown on the form, when you signed up and confirmed, and the IP address the form was sent from. Your browser details are not kept.
- Sending records: which email was sent to you and when, whether it was delivered, whether it bounced, whether it was marked as spam.
- If the business left measuring on, opens and clicks: the kind of event, its time and a rough class (for example a person or a security scan). These records do not keep your IP address or browser details.
- The reason you chose to give when unsubscribing, or your answer “I never signed up”.
Purposes
To deliver the business's emails to you; to apply your unsubscribe or complaint at once; to protect the sending service against abuse by watching bounces and complaints; to show the business the results of its sends.
Traces kept for the safety of the service
When an email bounces for good because the address does not exist, we keep, for 180 days from the last bounce, not the address but a one-way fingerprint of it made with a secret key. It stops other businesses from sending to the same address in vain and does not show which business it came from. We are the data controller for this fingerprint; our ground is our legitimate interest in protecting recipients and the sending service (KVKK art. 5(2)(f)).
If you unsubscribed or complained, your choice stays in that business's account as a keyed fingerprint even after your address is deleted, so that you are not emailed again if your address is uploaded once more. We keep this fingerprint on the business's behalf, so that your choice is respected.
Applying
For your rights over this data, apply to the business that emailed you; its name and postal address are at the bottom of every email. When an application reaches us, we pass it on to that business without delay and help it to answer. If you simply want no more emails, the quickest way is the unsubscribe link at the bottom of the email.
4. Account users and people who write to us
Data processed
- Identity and contact: first and last name, email address, your role in the account.
- Sign-in security: a one-way hash of your password (the password itself is never stored), an encrypted key for two-step verification and hashes of your recovery codes.
- Sessions: the IP address and browser details a session was opened from, and when.
- Activity records: who did what in the account, when and from which IP address, failed sign-in attempts included.
- The consent confirmation you give when uploading a list, and your acceptance of the terms of use: your name, email address, the time and your IP address.
- Emails you send us and our replies.
Purposes and legal grounds
| Purpose | Legal ground (KVKK art. 5(2)) |
|---|---|
| Opening your account and providing the service | Making and performing a contract (c); legitimate interest (f) for staff who use the account on a business's behalf |
| Security of accounts and of the platform, preventing and investigating abuse | Legitimate interest (f) |
| Duties under the law | Legal obligation (ç) |
| Proving the consent confirmation given when a list is uploaded and the acceptance of the terms of use; protecting our rights in a dispute | Establishing, using or protecting a right (e) |
| Answering your questions and reports | Performing a contract (c) and legitimate interest (f) |
We collect this data electronically: from the details your business gave us when the account was opened or that the person who added you to the team entered, from the application while you use it, and from your email when you write to us. We use none of it for marketing or advertising.
Cookies in the application
app.peykmail.com uses only the cookies it needs to work: a session cookie (at most 7 days for customer accounts), a device cookie that recognises a browser that has signed in before (400 days), and your language and theme choices (1 year). No advertising or measuring cookies are used.
Signing in to your account for support
To give support or look into a problem, we can enter your account for at most one hour at a time. Every such visit shows on your account's activity page, and the account owner is told by email.
5. This website
peykmail.com sets no cookies, does no visitor measuring, has no forms and loads nothing from other sites. The hosting service that delivers its pages (Cloudflare) processes connection data such as your IP address in order to deliver the page to you and protect the site against attacks. The ground for this is our legitimate interest in publishing the site safely (KVKK art. 5(2)(f)).
6. Where data is kept, and transfers
- Server: the PeykMail application and its database run on a server we rent in Türkiye.
- Email delivery: every email that leaves PeykMail is sent through Amazon SES, the email service of Amazon Web Services, from its Frankfurt (Germany) region. For this, the recipient's address, the email's content and the delivery, bounce and complaint information are transferred to Amazon. This is a transfer abroad.
- Backups: database backups are encrypted with a key only we can unlock, then stored in Cloudflare's storage service (Cloudflare R2), outside Türkiye.
- Emails you send us: email to info@peykmail.com is passed to our mailbox by Cloudflare's email routing service.
- This website: hosted by Cloudflare (Cloudflare Pages), which also has servers outside Türkiye; the connection data of your visit reaches Cloudflare.
- Authorities: where the law requires it, we share the requested information with the competent public authorities.
We do not sell data and do not share it with anyone for advertising. The transfers to Amazon and Cloudflare are transfers abroad; they are made only for the purposes written above, only as far as the service needs, and under article 9 of the KVKK.
7. How long data is kept
| Record | Period |
|---|---|
| Opens, clicks and other sending events | 13 months |
| Which email went to whom | In full for 13 months. Then the address, error texts and message id are deleted and a keyed fingerprint takes the address's place; the record is deleted completely in the 36th month. |
| Form sign-ups never confirmed | 30 days |
| Consent history, unsubscribe and complaint records, the do-not-send list | As long as the business's account is open |
| Fingerprints of addresses that do not exist | 180 days from the last bounce |
| Activity records (failed sign-ins included) | 2 years |
| Sessions | Deleted when they end (at most 7 days for customer accounts) |
| A closed account | Deleted 30 days after closing begins; earlier if the business asks |
| Evidence archive kept after an account is deleted | 3 years. It holds no recipient addresses or names; it holds the business's name and legal details, campaign summaries, the name and email address of the staff member who confirmed consent, fingerprints of the consent history, the texts shown and IP addresses. |
| Encrypted backups | 14 days on the server, 30 days in outside storage |
| The server's connection records (IP address, time, page asked for) | 30 days |
| Server records of unsubscribes and form actions (with IP addresses) | 30 days on the server, 90 days encrypted in outside storage |
| Emails you send us | While the matter is open, and at most 2 years after it is closed |
When a period ends, the records are deleted, or stripped of the address, by a job that runs every night. Deleted data also leaves the backups when their period ends. We keep the evidence archive of a deleted account so that, in a dispute or an inquiry by a competent authority, we can show that consent and sending followed the rules (KVKK art. 5(2)(e)). If we change a period, we update this table.
8. Your rights
Under article 11 of the KVKK you can apply to the data controller to:
- learn whether your personal data is processed,
- ask for information about it if it is,
- learn the purpose of the processing and whether the data is used for that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- ask for it to be corrected if it is incomplete or wrong,
- ask for it to be deleted or destroyed under the conditions of article 7 of the KVKK,
- ask that corrections, deletions and destructions be passed on to the third parties the data was transferred to,
- object to a result against you that comes only from analysis by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
9. How to apply
If you are on a business's list, apply to that business first (section 3). You can apply to us, as set out in the Communiqué on the Procedures and Principles of Application to the Data Controller, in one of these ways:
- By a signed letter to this address: Yamanevler Mah. Akgül Sok. No: 1 İç Kapı No: 18, Ümraniye, İstanbul, Türkiye
- By email to info@peykmail.com, from an email address you gave us before and that is in our records.
Your application should give your name, your Turkish ID number if you are a Turkish citizen (otherwise your nationality and passport number), your address for notices, your email address if you have one, and what you are asking for.
We answer free of charge within 30 days at the latest. If the request causes a separate cost, the fee set by the Personal Data Protection Board may be charged. If you find our answer insufficient, you can complain to the Board.
10. Changes to this notice
When we change this notice, we publish the new version on this page and update the date it takes effect. We tell account users about important changes by email.