# Privacy Notice (GDPR)

**mCommerce365 — Marketing Website**  
**For visitors and contacts in the EEA and United Kingdom**

**Effective date: 31 July 2026**  
**Last updated: 31 July 2026**

---

## 1. Introduction

**ICI Tech Teknoloji A.Ş.** processes personal data in connection with [https://mcommerce365.com](https://mcommerce365.com/) in compliance with the **EU General Data Protection Regulation (GDPR)** and, where applicable, the **UK GDPR**.

| | |
|---|---|
| **Controller** | ICI Tech Teknoloji A.Ş. |
| **Email** | app@icitech.com.tr |

**EU Representative (Article 27):** We are assessing Article 27 requirements for our EU-facing activities. Updated details will be published on https://mcommerce365.com/en/privacy/ when appointed.

**Data Protection Officer:** We do not currently meet the mandatory DPO designation threshold under Article 37 GDPR. Contact: app@icitech.com.tr.

This notice supplements our [Privacy Policy](https://mcommerce365.com/en/privacy/). It covers Site visitors and people who contact us. Licensed use of mCommerce365 software may involve additional processing described in your commercial agreement.

---

## 2. Roles

For marketing website and enquiry data, **ICI Tech Teknoloji A.Ş. is the controller**.

For personal data processed inside mCommerce365 deployed for a customer (for example employee user accounts tied to that customer’s Dynamics 365 environment), the **customer organisation is typically the controller** of its business data, and ICI Tech Teknoloji A.Ş. acts as a **processor** or service provider only to the extent set out in the commercial agreement. Microsoft Dynamics 365 Business Central processing is also subject to Microsoft’s own terms.

---

## 3. Data We Process (Website)

**Enquiry data:** Name, email, phone, company, message content.  
**Technical data:** IP address, device/browser data, logs.  
**Cookies:** As described in the [Cookie Policy](https://mcommerce365.com/cookie-policy/), including analytics/marketing tools where you consent.

---

## 4. Legal Bases

| Purpose | GDPR basis |
|---|---|
| Handling demo and sales enquiries | Art. 6(1)(f) and/or Art. 6(1)(b) |
| Site security and operation | Art. 6(1)(f) |
| Optional analytics/marketing cookies | Art. 6(1)(a) |
| Legal obligations | Art. 6(1)(c) |

---

## 5. What We Do Not Do

We do not sell personal data. We do not run end-customer WhatsApp commerce or AI chatbots via this Site. We do not store payment card details on the Site.

---

## 6. Your Rights

You may request access, rectification, erasure, restriction, portability, and objection, withdraw consent where processing is consent-based, and lodge a complaint with a supervisory authority (Art. 77).

**Contact:** app@icitech.com.tr — subject “GDPR Data Subject Request — mCommerce365”.

| Country | Authority | Website |
|---|---|---|
| 🇫🇷 France | CNIL | https://www.cnil.fr |
| 🇩🇪 Germany | BfDI + state DPAs | https://www.bfdi.bund.de |
| 🇪🇸 Spain | AEPD | https://www.aepd.es |
| 🇬🇧 United Kingdom | ICO | https://ico.org.uk |
| Other EEA | National DPA | https://edpb.europa.eu/about-edpb/about-edpb/members_en |

We respond within one month, free of charge, subject to GDPR exceptions.

---

## 7. International Transfers

ICI Tech Teknoloji A.Ş. is established in Türkiye. No EU adequacy decision currently covers Türkiye under Article 45 for all transfers. Where we transfer EEA/UK personal data internationally, we rely on appropriate safeguards (including SCCs and, for UK transfers, IDTAs where applicable) and provider documentation.

---

## 8. Retention and Security

Enquiry records: as needed for the request and related legitimate business/legal purposes (typically up to 3 years unless longer retention is required). Technical logs: limited periods for security. We use appropriate technical and organisational measures, including TLS for data in transit where applicable.

**Breach notification:** Where GDPR applies, we notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach where required (Art. 33), and affected individuals without undue delay where high risk (Art. 34).

---

## 9. Changes and Contact

Material updates are published at https://mcommerce365.com/en/privacy/gdpr/.

**Email:** app@icitech.com.tr