Privacy and data protection notice

Data controller

Shipzone is a Stokzone product operated by Stokzone Teknoloji Limited Şirketi; the data controller is Stokzone Teknoloji Limited Şirketi. Address: Esentepe Mah. Büyükdere Cad. Levent 199 No: 199 İç Kapı No: 6 Şişli / İstanbul. Contact: hello@shipzone.app · 0850 840 15 46

What we collect

We only take what the service needs. The list below is what the system actually stores:

• Application: full name, email, phone, company/brand name, tax number and tax office, whether you hold a tax certificate or an exemption
• Shipping origin: country, city, district, postal code and full address
• To understand your business: sales channel, average monthly parcel volume, website or social media address, referral code, your notes
• Document: tax certificate or small-trader exemption document
• Account security: sign-in attempts and the IP address they came from
• Shipment record: the recipient's name, address and phone — required for a label to be created at all

Your card details never reach us

Top-ups happen on the payment provider's own page. Your card number, expiry date and CVV never reach Shipzone servers and are not stored anywhere on our side.

Why we collect it

• To open your account and review your application
• To create shipping labels — a carrier cannot create a shipment without recipient details
• For billing, reconciliation and refunding invoice differences
• To protect your account against unauthorised access
• To meet our legal retention and reporting obligations

Legal basis

Your data is processed on the following grounds under article 5 of Law No. 6698:

• Formation and performance of a contract (art. 5/2-c): opening an account, creating shipments, collecting fees.
• Legal obligation (art. 5/2-ç): records and retention required by tax and commercial law.
• Legitimate interest (art. 5/2-f): protecting your account against unauthorised access, preventing fraud, improving the service.
• Explicit consent: requested only for processing that is not necessary. We have NO such processing today.

Who we share it with

We do not sell your data. We pass on only what the service requires, and only as much as it requires:

• The carrier — the recipient's name, address and phone. A shipment cannot be created without them.
• The payment provider — the identity and amount details needed to run a top-up. Card data already goes to them directly.
• Public authorities — only where legally required and limited to the scope requested.

Where and how long it is stored

Data is held on our servers in Türkiye over encrypted connections. Your carrier credentials are stored ENCRYPTED in the database and are never displayed again on any screen once saved. After your account closes, data is retained for the period required by tax and commercial law, then deleted.

Retention periods

Each type of data is kept only as long as its purpose requires:

• Shipment and invoice records: 10 years, per commercial and tax law.
• Application documents (tax certificate, exemption document): while the account is open and 10 years after it closes.
• Sign-in attempts and source IP: 1 year, for security review.
• Your carrier credentials: until you delete them or the account closes; stored encrypted.
• Once the period ends, data is deleted or anonymised.

Data security

The technical measures we take:

• All connections are TLS-encrypted; plain HTTP is not accepted.
• Your carrier credentials are stored ENCRYPTED and never shown on any screen once saved.
• Your password is hashed irreversibly; no plaintext is stored.
• Tenant boundary: every query is limited to your account, and that boundary is continuously verified by automated tests.
• Application servers run on a READ-ONLY filesystem; an intruder cannot leave persistent traces.
• Rate limits on sign-in and sensitive endpoints; repeated failures temporarily lock the account.
• Changing your password invalidates OLD SESSIONS.

Your rights

Under Turkish Personal Data Protection Law No. 6698, article 11, you may:

• Learn whether your data is processed and request information about it
• Learn the purpose and whether it is used in line with that purpose
• Know the third parties it is transferred to, at home or abroad
• Request correction if it is incomplete or inaccurate
• Request erasure or destruction within the conditions of the law
• Request that correction, erasure and destruction be notified to the third parties it was transferred to
• Object to an adverse outcome produced solely by automated analysis
• Claim compensation for damage caused by unlawful processing

How to apply

To exercise your rights, send your request from the email address registered on your account to hello@shipzone.app, or with a secure electronic signature to our registered e-mail (KEP) address. State clearly the information that lets us identify you and what you are requesting. Requests are resolved within 30 days at the latest and are free of charge; if the action itself incurs a cost, the tariff set by the Authority applies.

Cookies

We use NO advertising or profiling cookies. There are no third-party tracking scripts either — every script on the site is served from our own servers.

• Strictly necessary — Keeps you signed in. Without them the panel cannot be used, so no consent is sought.
• Preference — Remembers your language and time zone. Deleting them only resets your preference.
• Analytics — NOT USED.
• Advertising — NOT USED.