Pabli is a product and service brand operated by ONX Yazılım Anonim Şirketi, which is the data controller for the direct-user processing activities described in this Notice.
1. Data Controller Identity
For direct individual users, website visitors, and direct customers, the Data Controller is:
- Legal Name: ONX Yazılım Anonim Şirketi
- Brand: Pabli
- MERSIS No: 0643082673400001
- Tax No: 6430826734
- Address: Ayazağa Mah. Kemerburgaz Cad. Vadi İstanbul Park 7A Blok No: 7 B İç Kapı No: 4 Sarıyer / Istanbul / Turkey
- Official Email: info@pabli.co
- Application Form: Data Subject Application Form
2. Data Controller vs Data Processor Roles
2.1. Pabli as Data Controller: For individual registration, subscription purchases, billing, support tickets, website analytics (Google Analytics), and marketing preferences.
2.2. Pabli as Data Processor: For institutional accounts (schools, publishers), the institution acts as Data Controller for its teachers and students. Pabli acts as Data Processor under documented instructions and a Data Processing Agreement (DPA).
3. Processed Data Categories
Data categories processed include identity, contact, billing, payment results, session/security logs, device info, Google Analytics (upon consent), cookie preferences, user content, AI prompts/outputs, and student progress records.
4. Detailed Processing Table
Below is the detailed mapping of processing purposes, legal bases, third-party recipients, and retention periods:
| Data Category | Processing Purpose | Legal Basis | Recipients | Retention Period |
|---|---|---|---|---|
| Identity & Contact | Account creation and authentication | Contract performance | Email service providers | Active account duration + 10-year limitation period |
| Subscription & Billing | Purchases, invoicing, and tax accounting | Legal obligation | Financial advisors, Tax authority | 5 years under tax law (10 years commercial records) |
| Payment & Transaction Information | Payment confirmation, invoicing, refunds, chargebacks, and fraud prevention | Contract performance & Legitimate interest | Sipay, PayTR, Paddle & Financial institutions | 10-year limitation period |
| Security & Error Logs | System security and unauthorized access prevention | Legitimate interest & Legal obligation | Cloud hosting providers | Proportional security retention (1-2 years) |
| Google Analytics Data | Aggregate traffic and performance analytics | Explicit Consent | Google Analytics (Google LLC) | 2 years (Deleted immediately upon consent revocation) |
| Cookie Preference Records | Logging cookie consent preferences with timestamp/version | Legal obligation & Legitimate interest | None (Local storage) | 1 year |
| User Content & Media | Hosting and module generation | Contract performance | Cloud infrastructure | Until deleted by user or account closure |
| AI Inputs & Outputs | Executing AI module authoring features | Contract performance & Legitimate interest | AI infrastructure providers | Until deleted by user or account closure |
| Student Progress Data | Classroom activities and progress reports for institutions | Determined by Institutional Controller (Pabli is Data Processor) | Institutional Administrators | Duration of institutional contract |
5. Payment Data Flow
Payments in Türkiye may be processed through Sipay or PayTR. For eligible international transactions, Paddle may act as the authorized reseller and Merchant of Record. Name, email, billing country and address, product, amount, currency, subscription status, transaction ID, payment result, refund, and chargeback information may be shared for payment, tax, invoicing, fraud prevention, and dispute management.
Pabli does not store full card numbers or security codes. Paddle may be an independent data controller for its own legal obligations and transaction purposes when acting as Merchant of Record; it is not automatically characterized solely as Pabli's data processor.
6. AI Feature Data Principles
AI inputs and outputs are processed over TLS-encrypted API connections and are NOT used to train foundation AI models.
7. Student & Child Data
Institutional student data is processed strictly under institution instructions and is never used for advertising or automated profiling.
8. Third-Party Data Transfers
Data may be shared with Sipay, PayTR, Paddle, financial institutions, hosting providers, AI model providers, email services, Google Analytics (upon consent), advisers, and legal authorities. Paddle may act as an independent data controller for the relevant transaction.
9. Cross-Border Data Transfers
Where infrastructure providers process data abroad, transfers are conducted under technical and organizational safeguards. Google Analytics transfers occur only upon explicit user consent.
Where Paddle acts as Merchant of Record for an international transaction, limited data such as name, email, billing country/address, product, amount, subscription status, transaction ID, refund, and chargeback information may be transferred abroad in accordance with Article 9 of the Turkish Personal Data Protection Law.
10. Collection Methods
Collected automatically or semi-automatically via web forms, cookies, platform UI, and API integrations.
11. Retention & Erasure Rules
Data is retained according to statutory limitation periods and securely erased thereafter.
12. Data Subject Rights & Formal Applications
Data subjects may exercise their rights by filling out the Data Subject Application Form or by contacting us at info@pabli.co.