Privacy Policy

Scope

This Privacy Policy applies to all users who visit the GoGlobal platform (including the website and the mobile/desktop applications to be published in the future), become a member, or place an order.

This text complements the KVKK Privacy Notice; for the purposes and legal bases of the processing of your personal data, see the KVKK Privacy Notice. This text instead focuses specifically on data held in your browser and on security measures.

Data collected

When you create an account, your full name and email address are processed; when you pay as a guest, your passport number is also processed. When you place an order, the service you selected, the payment amount, the currency, and the order status are recorded.

The platform does not purchase, or share with third parties, additional data about you from third-party advertising networks or data brokers.

Cookies

The platform holds only three pieces of data in your browser, and none of them is for advertising or tracking purposes.

The first is a cookie named `gg_rt`, readable only by the server (httpOnly). This cookie carries the refresh token required to keep your session active; it cannot be read by JavaScript, it is sent only to authentication endpoints, and it is renewed automatically at regular intervals. Because your session cannot be maintained without this cookie, it is a "strictly necessary" (session-essential) cookie.

The second is a cookie named `NEXT_LOCALE`; it remembers the language you chose (e.g. `tr`) so that you are greeted in your own language when you come back. It is written by the application's multilingual routing layer, is kept for about a year, and carries nothing but a language preference — no identity, tracking or profiling data.

The third is a preference record named `gg-theme`, stored in your browser's local storage; it is used only to remember your light/dark theme preference and is not sent to the server.

The platform does NOT use any cookies for analytics, tracking, or marketing purposes (`gg_rt` is required to maintain your session and `NEXT_LOCALE` to honour your language preference; both are functional). As there is therefore no third-party cookie requiring cookie consent, a cookie consent banner is not shown. This is not an omission; it is a measured and deliberate choice — the moment an advertising/analytics cookie is added, this section and the platform's cookie consent flow will be updated accordingly.

Security

The `gg_rt` cookie that carries your session is marked to be sent only over a secure (HTTPS) connection (Secure); a signed-in session can therefore never travel over an unencrypted connection.

Sensitive identity data such as the passport number collected in the guest payment flow is encrypted with the AES-256-GCM algorithm at the application layer before being written to the database; the encryption keys are not kept together with the application code or configuration files.

The platform's architecture is designed to keep each country's data on a separate technical infrastructure ("cell") hosted in that country. Today the platform runs on a single deployment; the country in which your data is actually hosted, and whether any transfer abroad takes place, is declared as [avukat/sahip tarafından doldurulacak].

Third parties

To process your payment, your payment amount is transferred to a licensed payment institution. This institution accesses only the data necessary for processing the payment.

The platform does not share or sell your data to third parties for marketing purposes.

Rights

For your rights regarding your personal data (access, correction, erasure, objection, etc.), see the "Data subject rights" section of the KVKK Privacy Notice.

Contact

For questions about privacy, contact address [avukat/sahip tarafından doldurulacak].