Privacy Policy

Effective Date: July 28, 2026

1. Introduction

This Privacy Policy explains how RozStock Digital Media and Technology Services (“RozStock”, “Company”, “We”) collects, uses, stores, shares, and protects personal data when you use our website, mobile applications, and related services (collectively, the “Platform”).

We process personal data in accordance with applicable data protection laws, including the Turkish Personal Data Protection Law No. 6698 (KVKK), the EU General Data Protection Regulation (GDPR) where applicable, and other relevant regulations.

RozStock undertakes to process the personal data of its users, customers, subscribers, content providers (Contributors), business partners, visitors, and other relevant persons in accordance with the law and the rules of good faith.

For data subjects in Türkiye, we also publish a separate KVKK Disclosure document that summarizes key information required under Article 10 of KVKK. That document is provided alongside this Privacy Policy and does not replace it.

2. Data Controller

Under KVKK and, where applicable, GDPR, the data controller is:

RozStock Digital Media and Technology Services
Headquarters: Diyarbakır, Türkiye
Email: privacy@rozstock.com
Support: support@rozstock.com
Website: www.rozstock.com

3. Categories of Personal Data Processed

Depending on your relationship with RozStock, we may process the following categories of personal data:

3.1 Identity Information

• First name
• Last name
• Username
• Date of birth (where required)
• Turkish ID number (where required)
• Tax identification number

3.2 Contact Information

• Email address
• Phone number
• Address information
• Billing address
• Delivery address

3.3 Financial Information

• Bank account information
• IBAN details
• Payment history
• Invoice records
• Tax-related information

RozStock does not store credit card information directly. Payment transactions are carried out by authorized payment institutions.

3.4 Transaction Security Data

• IP addresses
• Session records
• Device information
• Browser information
• Operating system information
• Security logs
• Two-factor authentication records

3.5 Usage Data

• Search history
• Purchase history
• License records
• Downloaded content
• Favorites
• Collections
• On-site behavior records

3.6 Contributor Data

For content providers, the following may also be processed:

• Identity verification documents
• Tax plates
• Company documents
• Copyright documents
• Model Release documents
• Property Release documents
• Payment records
• Earnings records
• Content upload history

3.7 Visual and Audio Data

• Profile photos
• Documents submitted with support requests
• Documents uploaded for identity verification
• Audio recordings (where a call center exists)

4. Methods of Collecting Personal Data

RozStock may collect personal data through the following methods:

• Website membership forms
• Mobile applications
• Contributor application forms
• Purchase transactions
• Payment systems
• Support requests
• Email correspondence
• Cookies and similar technologies
• Log records
• Security systems
• Social media interactions
• Campaign and survey participation
• API integrations
• Third-party service providers

Personal data may be processed by automated or non-automated means.

5. Purposes of Processing Personal Data

RozStock processes personal data for the following purposes:

Account Management

• Creating memberships
• Identity verification
• Account security
• Password reset processes

Sales and Licensing

• Providing content licenses
• Creating orders
• Conducting purchase transactions
• Maintaining license records

Contributor Services

• Earnings calculations
• Commission payments
• Tax obligations
• Copyright processes

Payment Transactions

• Collection processes
• Refunds
• Chargeback transactions
• Accounting processes

Security and Fraud Prevention

• Detecting fake accounts
• Preventing unauthorized access
• Ensuring system security
• Preventing unlawful activities

Legal Obligations

• Compliance with tax legislation
• Enforcement of court decisions
• Responding to official authority requests

Marketing and Communication

• Campaign announcements
• Newsletter distribution
• User notifications
• Satisfaction surveys

Platform Development

• Statistical analyses
• Performance improvements
• New product development processes

6. Legal Grounds for Processing Personal Data

Personal data is processed under the legal grounds set out in Articles 5 and 6 of KVKK and, where applicable, Article 6 of GDPR, including:

• Explicit consent,
• Establishment or performance of a contract,
• Fulfillment of legal obligations,
• Establishment, exercise, or protection of a right,
• Legitimate interests of the data controller,
• Explicit provision in the laws.

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Cookies and Similar Technologies

RozStock uses cookies and similar technologies on the Platform to operate core functions, maintain security, remember preferences, measure performance, and—where permitted—support marketing activities. Some cookies may be associated with personal data.

Cookie types, retention periods, third-party providers, and your preference options are described in our separate Cookie Policy. Please review that document for detailed information about how we use cookies and how you can manage your choices.

8. Transfer of Personal Data

RozStock may share personal data with the following parties, only to the extent necessary:

Authorized Public Institutions

• Courts
• Prosecutors’ offices
• Law enforcement authorities
• Regulatory bodies

Payment Institutions

• PayTR
• Stripe
• Payoneer
• Wise
• Banks

Technical Service Providers

• Cloud infrastructure providers
• Data storage services
• CDN providers
• Security services

Accounting and Consulting Services

• Certified public accountants
• Auditors
• Legal advisors

9. Cross-Border Data Transfers

RozStock may transfer personal data abroad due to:

• Cloud services,
• Payment systems,
• Analytics services,
• Technical support services.

Such transfers are carried out in accordance with:

• Article 9 of KVKK,
• Decisions of the Turkish Personal Data Protection Board,
• GDPR Chapter V, to the extent applicable,
• Appropriate safeguards such as standard contractual clauses or adequacy decisions, where required.

10. Rights of the Data Subject

Under Article 11 of KVKK, data subjects have the right to:

• Learn whether personal data is being processed,
• Request information regarding processed data,
• Learn the purpose of processing,
• Learn the third parties to whom data is transferred,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction,
• Request notification of third parties to whom data has been transferred,
• Object to results arising from analysis by automated systems,
• Claim compensation in case of damage.

Where GDPR applies, you may also have additional rights, including data portability, restriction of processing, and the right to lodge a complaint with a supervisory authority in your country of residence.

11. Retention Periods for Personal Data

Personal data is retained for no longer than necessary for the purposes for which it was collected, and in any event for the periods prescribed by applicable legislation. For example:

At the end of the retention period, data is deleted, destroyed, or anonymized in accordance with applicable law and our internal data retention procedures.

12. Application Procedure

You may submit requests relating to your personal data through the following channels:

• Email: privacy@rozstock.com
• Support: support@rozstock.com
• Subject line: “KVKK Application” or “Privacy Request”

RozStock will respond to verified requests within the periods specified in applicable legislation. We may request additional information to confirm your identity before processing your request.

13. Data Security Measures

To protect personal data, RozStock implements technical and administrative measures such as:

• SSL/TLS encryption,
• Firewalls,
• Authorization systems,
• Access control mechanisms,
• Logging systems,
• Regular backups,
• Penetration tests,
• Multi-factor authentication,
• Data minimization,
• Staff training.

Despite these measures, no method of transmission or storage over the internet is completely secure. We continuously review and improve our security practices.

14. Marketing Communications

We may send promotional emails, newsletters, and service notifications where permitted by law. You may opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting privacy@rozstock.com.

Opting out of marketing does not affect transactional or legally required communications related to your account, purchases, or Contributor activities.

15. Automated Processing and Profiling

RozStock may use automated systems to detect fraud, protect account security, recommend content, and analyze Platform usage. Where such processing produces legal or similarly significant effects, you may request human review and object to the outcome in accordance with applicable law.

16. Children’s Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data to RozStock, please contact us at privacy@rozstock.com and we will take appropriate steps to delete such data.

17. GDPR Provisions for EU/EEA Data Subjects

Where GDPR applies to our processing, RozStock acts as data controller and processes personal data on the legal bases described in Section 6. EU/EEA data subjects may exercise the rights listed in Section 10 and may lodge a complaint with their local data protection authority.

Where required, we will provide information about our representative or contact point for EU/EEA data subjects upon request.

18. Third-Party Links and Services

The Platform may contain links to third-party websites, plugins, or services. RozStock is not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing personal data.

19. Updates to This Privacy Policy

RozStock may update this Privacy Policy due to:

• Legal or regulatory changes,
• Technological developments,
• Changes to our services or data processing activities.

The updated version will be published on the Platform with a revised effective date. Material changes may also be communicated by email or in-app notice where appropriate.

20. Effectiveness

All users who visit the RozStock Platform, become members, purchase content, license content, or upload content are deemed to have read and understood this Privacy Policy.

RozStock Digital Media and Technology Services
Diyarbakır, Türkiye