Privacy Policy and GDPR Information

Last updated: 29/10/2023

This Privacy Policy ("Policy") explains the procedures we follow to protect personal data, including your personal data, as well as various information collected, used, and transferred by Mergenium Eğitim Teknolojileri ve Ticaret Ltd. Şti. ("Mergenium" or "we"). This Policy is prepared in accordance with Law No. 6698 on the Protection of Personal Data ("KVKK") and the General Data Protection Regulation ("GDPR") of the European Union.

The purpose of this Policy is to determine the conditions and terms of use of personal data and usage data that you share with Mergenium or that Mergenium collects during the operation of the website ("Site") and the mobile application ("Application") (together referred to as "Arfulus") and that are generated by the users ("Data Subject") of Mergenium during their use of the Site and Application.

Processed Personal Data

We collect, process, and store certain personal data and usage data to perform transactions related to your registration, membership, and trial version, to provide other services, and to improve our services.

The data collected when you sign up for the Arfulus service or update your account is classified as User Data and consists of personal data that is used to create your account and enable you to use the Arfulus service. Your email address and password that you use to create your account are included in this data.

The data collected through your use of the Arfulus service is classified as Usage Data and consists of personal data related to you that is collected and processed when accessing and using the Arfulus service. We process Calculation queries, Calculation history, Calculation settings, Account settings, and user preferences to improve the Arfulus service. We process your URL information, cookie information, IP address technical data for functional purposes such as security, performance, and prevention of account sharing.

As additional data that you may choose to provide us, we process your Payment and Purchase Data for the initiation and renewal of paid membership and your Survey and Research Data for research, analysis, and improvement purposes.

We also obtain your data from third-party sources. If you sign up for the Arfulus service or log in to the Arfulus service using another service, we obtain User Data from Identity Verification Partners, Usage Data and User Data from Technical Service Partners used to provide the technical infrastructure and security of the Arfulus service, and Payment and Purchase Data from Payment Partners and Sellers for processing your payments.

Methods of Collecting Personal Data

Your personal data mentioned above is collected through digital and printed forms (e.g., website contact form) or other web technologies (e.g., cookies) during customer experience (e.g., complaint management, satisfaction surveys, etc.) and sales processes.

Your personal data mentioned above is collected through the following channels, using both automated and non-automated methods:

Purposes of Processing Personal Data

Mergenium processes the personal data provided by the Data Subject for the purposes ("Purposes") of improving Mergenium's products and services, ensuring communication with the Data Subject regarding the use of the Site and Application, and performing business development and reporting activities in accordance with Article 5 of the Law.

With the explicit consent of the Data Subject, User personal data may be processed by Mergenium for direct marketing and sending commercial electronic messages to the communication address provided by the User.

  1. To improve Mergenium's products and services: We may use the personal data collected to analyze usage patterns, identify areas for improvement, and enhance the functionality and features of the Arfulus service.

  2. To ensure communication with the Data Subject: We may use personal data to communicate with you regarding your use of the Site and Application, respond to your inquiries, provide customer support, and send important notifications about the Arfulus service.

  3. To perform business development and reporting activities: We may process personal data for internal business purposes, such as analyzing customer trends, conducting market research, and generating reports to improve our business strategies and operations.

  4. Direct marketing and commercial electronic messages (with explicit consent): With your explicit consent, we may process your personal data for direct marketing purposes, including sending commercial electronic messages to the communication address you have provided. You have the right to withdraw your consent at any time.

Please note that we will not use your personal data for purposes other than those specified in this Policy without obtaining your consent, unless required or permitted by law.

Legal Grounds for Processing Personal Data

In this section, we explain the legal bases (each referred to as a "legal ground") under the data protection law that Mergenium relies on for processing your personal data for our purposes, as well as the categories of personal data we use for these purposes.

To assist you in understanding the legal bases mentioned below, a general description is provided for each legal ground:

The legal grounds for collecting and using personal data as described in this Privacy Policy depend on the circumstances existing at the time of processing the relevant personal data. Accordingly, we rely on the following legal grounds when processing your personal data:

legitimate interests in continuing to run our business successfully through research and planning.

Transfer of Personal Data

Your personal data may be shared with individuals explicitly authorized by legislation, including the Information Technologies and Communication Authority, in accordance with legal regulations and the applicable legislation. Additionally, your personal data may be shared with authorized individuals or institutions upon the request of a court order or competent authorized administrative authorities, within the scope prescribed by legal regulations.

Your personal data may be shared with our suppliers within the scope of the service agreement between us, regarding the products or services to be provided by the suppliers, for the execution of supply chain management processes, ensuring business continuity, conducting operations, and performing the contract.

In order to obtain information related to customer relationship management and to conduct our activities, we may collaborate with a range of IT service providers, both within and outside of Turkey, to provide unexpected situation recovery services, payment services, security, and related IT services. Third parties authorized by us to process your personal data are bound by contractual obligations to ensure the security of your personal data in accordance with the terms of this Privacy Policy.

With the explicit consent of the Data Subject, User's personal data may be shared with suppliers and business partners for the purpose of direct marketing and sending commercial electronic messages to the communication address provided by the Data Subject.

In the event of a merger with another commercial company or the acquisition of our shares by another company, we may share information about you with the parent company with whom we will have a relationship. In such a case, we will inform you as soon as possible.

Your personal data is transferred abroad due to the presence of servers and data centers abroad. During the transfer of personal data to countries outside of Turkey, we ensure that the transfer of personal data is made in compliance with this Privacy Policy and the applicable legislation on data protection.

Storage of Personal Data

Your personal data processed in accordance with the purposes stated in this Privacy Policy will be stored and destroyed in compliance with the Law and the Regulation on Deletion, Destruction, or Anonymization of Personal Data. As Mergenium, we store and destroy your personal data in accordance with this Privacy Policy. We will continue to store your personal data as long as you have an Arfulus account or subscription. When your account is deleted or your subscription ends, we may continue to store some of your personal data to fulfill our legal obligations and to establish, use, and protect our rights and interests.

Your Rights Regarding Personal Data

In accordance with Article 11 of the Personal Data Protection Law (KVKK), every Data Subject can exercise the following rights by contacting Mergenium:

You can submit your requests regarding these rights in writing to Mergenium's address at {ADDRESS} or via the email address [email protected], in accordance with the "Communiqué on Principles and Procedures for Application to the Data Controller". Your applications will be responded to in writing or electronically within the shortest possible time and no later than 30 (thirty) days, depending on the nature of the request. If your application is negatively evaluated, the justified reasons for rejection will be communicated to you through electronic mail or by post, if possible, using the method of application you have specified.

While it is essential not to request any fees regarding the requests, if the requested operation requires a separate cost, Mergenium reserves the right to request a fee from the applicant according to the fees determined by the Personal Data Protection Board.

Security of Data

To ensure the necessary protection against the risks of loss, theft, unauthorized access, processing, and alteration of your personal data, we take reasonable technical, administrative, logical, physical, and organizational measures. These measures are specifically designed to establish a level of security appropriate to the risks that may arise during the processing of your personal data. However, please note that no system is completely secure. Third-party service providers, payment gateways, and payment processors (often referred to as PCI-compliant service providers, verified to be compliant with all payment card industry standards) are verified for compliance.

The measures we take to protect your personal data include encryption, access restrictions, isolation of application networks, and adherence to globally accepted standards.

To protect your user account, we recommend the following:

If other individuals have access to your Arfulus account, they may have access to your personal data and account controls. It is your responsibility to allow them to use your account only if you do not have any concerns about sharing this personal data with them.

External Links, Other Websites, Applications, and Services

We are not responsible for any internet sites or services, including their applications and content, accessed through or linked from the Arfulus service. Please note that our Privacy Policy does not apply to any third-party internet sites or services when you navigate and interact with them through a link from our service. This includes third-party internet sites or services that have a link on our website. Your navigation and interaction on third-party internet sites or services are subject to the third party's own rules and policies. Additionally, you acknowledge that we are not responsible for and have no control over third parties to whom you grant access to your User Content. If you choose to use a third-party internet site or service and grant them access to your User Content, you do so at your own risk.

We recommend carefully reading the privacy policies of third parties.


Individuals under the age of 18 can also benefit from our products and services. However, as Mergenium, we do not intentionally process the data of individuals under the age of 18. We are aware of the sensitivity of your children's personal data and take the utmost care to protect these data, including all our departments and the individuals and legal entities we collaborate with. It is the responsibility of a parent or legal guardian to share their child's personal data with us. You can contact us at [email protected] regarding the personal data of your child.

We recommend that parents take an active role in monitoring their children's online activities.

Changes to this Policy

We may modify this Policy due to changing laws, regulations, operational requirements, or as we deem necessary. In the event of such changes, we will provide you with a legally compliant notification (including the effective date). By continuing to use the Site and Application after these changes have been implemented, you signify that you have accepted and (to the extent applicable) agreed to these modifications. If you do not wish to accept any changes to this Policy, you may terminate your use of the Site and Application and delete your account.

The current Policy will come into effect on the date it is published on the Site.


For general inquiries regarding your membership, you can contact customer service at [email protected]. If you have any questions about this Policy, how we use your personal data, cookies, or similar technologies, you can always reach us at [email protected].

Please note that in order to ensure your security, we may need to verify your identity before fulfilling your request when you reach out to us for support.