ReKid™ — Global Privacy Policy

Effective Date: August 22, 2026

ReKid™ and its related services, including getrekid.com, are operated by:

ARI BULUT DEPOLAMA BİLİŞİM TİCARET ANONİM ŞİRKETİ

This Global Privacy Policy (“Privacy Policy”) explains how we collect, use, disclose, retain, protect, and otherwise process personal information and personal data in connection with ReKid™, our websites, applications, search and information services, purchasing services, and related products and services (collectively, the “Services”).

This Privacy Policy is intended to provide privacy information for users located in Türkiye, the European Economic Area (“EEA”), the United Kingdom (“UK”), the United States, and other jurisdictions where our Services may be accessed.

Different privacy laws may apply depending on where you live. Where applicable law provides you with additional rights or protections, those rights will apply notwithstanding anything in this Privacy Policy.

1. Who We Are

The Services are provided by:

ARI BULUT DEPOLAMA BİLİŞİM TİCARET ANONİM ŞİRKETİ

ReKid™ is an information and search service designed to help children and other users access information in a more understandable and age-appropriate manner.

The commercial purchasing process for ReKid™ services may be provided through:

getrekid.com

For purposes of applicable privacy laws, ARI BULUT DEPOLAMA BİLİŞİM TİCARET ANONİM ŞİRKETİ may act as the controller, business, or equivalent responsible entity for personal information processed through the Services.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information processed through:

ReKid™ websites;
ReKid™ search and information services;
ReKid™ applications, where applicable;
getrekid.com;
Purchase and subscription processes;
Customer support;
Service-related communications;
Technical and security systems;
Related websites and services operated by us.

This Privacy Policy does not apply to third-party websites, applications, payment providers, or other services that we do not control.

3. Children and Personal Information

ReKid™ is designed to provide children and young users with access to information in a safer and more understandable format.

However, ReKid™ is not designed to collect personal information from children.

Children do not need to provide personal information in order to search for information or ask questions through the basic ReKid™ information service.

We do not intentionally require children to provide:

Name;
Surname;
Email address;
Telephone number;
Government identification number;
Home address;
School address;
Financial information; or
Similar identity information

in order to use the basic information and search functionality.

We do not intentionally create identity-based child profiles for the basic operation of the Service.

Parents, guardians, teachers, and other responsible adults should nevertheless supervise children's use of internet services and should instruct children not to enter unnecessary personal information into search boxes, questions, or other public or interactive areas.

4. Information We Collect

We seek to minimize the personal information collected through the Services.

Depending on how you use the Services, we may process the following categories of information.

4.1. Information Provided During Purchase

When a person purchases a ReKid™ product or service through getrekid.com, we may collect:

Email address;
Name, where it is needed to issue an invoice;
Order information;
License or subscription information;
Transaction status;
Billing information.

The email address is the only detail required to complete a purchase and receive a key.

Turkish identity information is requested only from customers invoiced in Türkiye. Where Turkish e-invoicing, tax or accounting law requires it, this may include tax identification information or the Turkish national identification number (T.C. Kimlik Numarası). We do not request Turkish identity information from customers outside Türkiye.

For a bank transfer, only an email address is needed. No name or surname is requested for the transfer itself.

5. Payment Information

Payments may be processed through third-party payment processors.

Depending on the payment method used, the payment provider may process:

Credit card information;
Debit card information;
Payment account information;
Transaction authentication information;
Other information necessary to complete the payment.

We do not intend to store complete payment card information, such as full card numbers or CVV/CVC security codes, on our own systems where such information is processed directly by the applicable payment service provider.

Payment providers may process payment information under their own privacy policies and terms.

We may receive limited transaction information necessary to:

Confirm payment;
Complete the purchase;
Activate a license;
Manage subscriptions;
Prevent fraud;
Maintain transaction records; and
Provide customer support.

6. Email Address

The email address provided during a purchase may be used for:

Order confirmation;
Purchase receipts;
E-invoice or invoice delivery;
License delivery;
Account or service access;
Service notifications;
Customer support;
Security notifications;
Transaction-related communications.

Marketing communications, where applicable, are subject to the requirements of the laws applicable to the recipient.

7. Technical Information

We may process limited technical information necessary to operate and secure the Services.

This may include:

Access date and time;
Technical event information;
Error information;
Security event information;
Device or browser information where technically necessary;
Service interaction information necessary for security or operation.

8. IP Addresses and Salted Hashes

We do not intend to permanently store users' IP addresses in their original readable form.

Where technically necessary for security, abuse prevention, system protection, or technical controls, an IP address may be processed temporarily or used to generate a salted one-way hash value.

The resulting salted hash may be retained instead of the original IP address for purposes such as:

Security controls;
Abuse prevention;
Detection of repeated malicious activity;
Protection against automated attacks;
Technical troubleshooting;
Service integrity.

The salted hash is not intended to be used to identify the individual user for advertising or profiling purposes.

We do not use the salted hash as a substitute for an identity profile.

Because the legal classification of hashed or pseudonymized information may differ depending on the applicable jurisdiction and the technical circumstances, we treat such technical information conservatively and apply appropriate safeguards.

9. Search Queries and Questions

ReKid™ is an information and search service.

Search queries, questions, or requests entered into the Service may be technically processed in order to:

Provide search results;
Generate or display information;
Classify or organize content;
Improve service functionality;
Detect abuse;
Maintain system security;
Troubleshoot technical problems.

We do not require users to provide their identity in order to ask ordinary informational questions.

Users should not intentionally enter unnecessary personal, confidential, financial, authentication, or sensitive information into search queries.

10. No Child Identity Profiling

The basic ReKid™ search and information service is not designed to determine or establish the identity of a child.

We do not intentionally use ordinary children's search activity to create a personal identity profile containing the child's:

Name;
Email address;
Telephone number;
Home address;
Government identification;
Financial information; or
Similar direct identifiers.

The fact that ReKid™ is designed for children does not mean that ReKid™ requires or collects children's identity information.

11. Purposes of Processing

We may process personal information for the following purposes:

Providing the Services;
Processing purchases;
Managing licenses and subscriptions;
Creating and managing accounts where applicable;
Providing customer support;
Delivering invoices and transaction documents;
Complying with tax and accounting requirements;
Processing payments through payment providers;
Preventing fraud and abuse;
Protecting the security of the Services;
Detecting unauthorized access;
Troubleshooting technical problems;
Maintaining system reliability;
Communicating with users about transactions and Services;
Complying with legal obligations;
Responding to lawful requests from authorities;
Establishing, exercising, or defending legal claims;
Protecting our rights, property, users, and Services;
Improving the functionality and reliability of the Services; and
Other purposes disclosed at the time information is collected.

12. Legal Bases Under the GDPR

Where the GDPR applies, we process personal data on one or more lawful bases under Article 6 GDPR, depending on the particular processing activity.

These may include:

Contract

Processing may be necessary to enter into or perform a contract with you, including processing purchases, providing licenses, and providing requested Services.

Legal Obligation

Processing may be necessary to comply with applicable legal obligations, including tax, accounting, invoicing, financial, and regulatory requirements.

Legitimate Interests

Processing may be necessary for our legitimate interests, including:

Information security;
Fraud prevention;
Service protection;
Abuse prevention;
Technical maintenance;
Customer support;
Enforcement of contractual terms;
Protection of legal rights.

We consider and balance our legitimate interests against the rights and freedoms of individuals.

Consent

Where applicable law requires consent, we will request consent before processing the relevant personal data.

Consent may be withdrawn at any time where the processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

13. GDPR Principles

Where GDPR applies, we seek to process personal data in accordance with applicable GDPR principles, including:

Lawfulness, fairness, and transparency;
Purpose limitation;
Data minimization;
Accuracy;
Storage limitation;
Integrity and confidentiality; and
Accountability.

We seek to collect and process only information that is reasonably necessary for the relevant purpose.

14. Your GDPR Rights

If the GDPR applies to you, you may have the following rights, subject to applicable legal limitations:

Right of Access

You may request confirmation as to whether we process your personal data and request access to that data.

Right to Rectification

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

You may request deletion of personal data in circumstances provided by law.

Right to Restriction

You may request restriction of processing in circumstances provided by law.

Right to Data Portability

Where legally applicable, you may request personal data provided by you in a structured, commonly used, and machine-readable format.

Right to Object

You may object to certain processing activities, including processing based on legitimate interests.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time.

Rights Regarding Automated Decision-Making

Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

15. European Economic Area and UK Users

If you are located in the European Economic Area, GDPR rights apply where the GDPR applies to our processing.

If you are located in the United Kingdom, applicable UK data protection legislation, including the UK GDPR and Data Protection Act 2018, may apply.

Where required by applicable law, we will provide the additional information and rights applicable to individuals in those jurisdictions.

16. International Data Transfers

ReKid™ may use technology and infrastructure providers located in countries other than the country in which you reside.

As a result, personal information may be transferred to or accessed from other jurisdictions.

Where GDPR or another law governing international data transfers applies, we will use an applicable lawful transfer mechanism.

Depending on the circumstances, this may include:

An adequacy decision;
Standard Contractual Clauses;
Applicable contractual safeguards;
Approved safeguards under applicable law; or
A legally recognized exception where applicable.

We seek to ensure that international transfers are subject to appropriate privacy and security protections.

17. United States Privacy

The United States does not have a single comprehensive consumer privacy law applicable to every business and every consumer.

Instead, privacy requirements may arise from federal laws, state laws, sector-specific laws, and other regulations.

Accordingly, additional rights may apply depending on your state of residence.

Where a U.S. state privacy law applies to us and to your personal information, we will provide the rights and disclosures required by that law.

18. California Privacy Rights

If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to us and to your information, you may have additional rights.

These may include the right to:

Know what personal information we collect;
Know the categories of sources from which information is collected;
Know the purposes for which information is used;
Know the categories of third parties to whom information is disclosed;
Request access to personal information;
Request deletion of personal information, subject to exceptions;
Request correction of inaccurate personal information;
Opt out of the sale of personal information;
Opt out of the sharing of personal information for cross-context behavioral advertising, where applicable;
Limit certain uses and disclosures of sensitive personal information, where applicable; and
Receive equal treatment for exercising privacy rights.

California provides specific privacy rights and notice requirements for covered businesses.

19. Sale and Sharing of Personal Information

We do not sell personal information for monetary consideration.

We also do not intentionally share personal information for cross-context behavioral advertising where prohibited by applicable law.

If our practices change in a manner that constitutes “sale,” “sharing,” targeted advertising, or a similar regulated activity under applicable law, we will update this Privacy Policy and provide legally required choices and opt-out mechanisms.

Where applicable law gives you the right to opt out, we will provide a reasonably accessible mechanism for exercising that right.

20. California Notice at Collection

For California residents, where CCPA applies, the categories of personal information that may be collected include:

Identifiers

Name;
Email address;
Government identification information where required for invoicing;
Account identifiers where applicable.

Commercial Information

Purchase history;
License information;
Subscription information;
Transaction records.

Internet or Network Information

Technical interaction information;
Security-related information;
Salted hash derived from an IP address where technically necessary.

Geolocation

We do not intentionally collect precise geolocation information as part of the basic ReKid™ service.

Sensitive Personal Information

We do not intentionally request sensitive personal information from children through the basic ReKid™ service.

T.C. Kimlik Numarası may be processed in the Turkish purchasing and invoicing context where legally required.

The purposes for collecting these categories are described throughout this Privacy Policy.

California law requires covered businesses to provide information about categories collected and purposes at or before collection.

21. California Requests

California consumers may submit privacy requests using the contact information provided in the “Contact Us” section.

We may need to verify your identity before fulfilling certain requests.

We will not require you to create a new account solely to submit a privacy request where applicable law prohibits such a requirement.

We will respond within the periods required by applicable law.

22. U.S. State Privacy Rights

Depending on your state of residence and whether a particular state law applies to us, you may have rights including:

Right to access;
Right to know;
Right to correct;
Right to delete;
Right to data portability;
Right to opt out of sale;
Right to opt out of targeted or cross-context behavioral advertising;
Right to opt out of certain profiling;
Right to limit certain processing of sensitive data;
Right to appeal a privacy decision; and
Right to non-discrimination.

The exact rights and applicable exemptions vary by state.

We will apply the rights required by the law applicable to your request.

The U.S. state privacy framework continues to evolve, with comprehensive privacy laws enacted in numerous states.

23. Verification of Privacy Requests

To protect users against unauthorized disclosure of personal information, we may need to verify the identity of a person submitting a privacy request.

The verification method will depend on the type and sensitivity of the requested information.

We will seek to request only information reasonably necessary for verification.

We will not use verification information for unrelated purposes except where permitted or required by law.

24. Authorized Agents

Where applicable law permits you to appoint an authorized agent to exercise privacy rights on your behalf, we may require:

Proof of authorization;
Verification of your identity;
Verification of the authorized agent's identity; and
Other information reasonably necessary to process the request.

25. Non-Discrimination

We will not unlawfully discriminate against individuals for exercising privacy rights available under applicable law.

This may include refusing goods or services, charging different prices, or providing a different level or quality of service solely because an individual exercised a legally protected privacy right, except where permitted by law.

26. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Retention periods may depend on:

The purpose of processing;
The nature of the information;
The contractual relationship;
Legal obligations;
Tax and accounting requirements;
Dispute resolution;
Fraud prevention;
Security requirements; and
Applicable limitation periods.

When information is no longer required, it may be deleted, anonymized, or securely destroyed.

27. Turkish Tax and Accounting Records

Information required for invoices, e-invoices, accounting, tax, and other legal records may be retained for periods required by Turkish law.

This may include the purchaser's:

Name;
Surname;
T.C. identity information where legally required;
Email address;
Transaction information;
Invoice information.

Deletion requests may not result in immediate deletion where retention is legally required.

28. Data Processors and Service Providers

We may use third-party service providers to operate the Services.

These may include providers of:

Cloud infrastructure;
Hosting;
Databases;
Email delivery;
Payment processing;
E-invoicing;
Security;
Monitoring;
Technical support;
Customer communication;
Software infrastructure.

Where required by applicable law, appropriate contractual arrangements and data protection obligations will apply to service providers processing personal data on our behalf.

29. Payment Providers

Payment providers are independent entities with their own privacy policies.

When you make a payment, information may be processed directly by the payment provider.

We may receive information such as:

Payment status;
Transaction identifier;
Amount;
Currency;
Payment date;
Limited payment method information.

We do not intend to store complete payment card information on our own systems where payment is processed directly by the payment provider.

30. Cookies and Similar Technologies

We may use cookies and similar technologies.

These may include:

Essential Technologies

Used for:

Security;
Session management;
Authentication;
Core functionality.

Preference Technologies

Used to remember user settings and preferences.

Analytics Technologies

Where used, these may help us understand how the Services are used and identify technical problems.

Advertising Technologies

We do not intend to use advertising technologies to sell or share children's personal information.

If advertising or tracking technologies are introduced in the future, applicable legal notice and consent/opt-out requirements will be implemented before or when required.

31. Do Not Track and Global Privacy Signals

Different browsers and jurisdictions may provide privacy signals or mechanisms for expressing privacy preferences.

Where legally required, we will recognize applicable privacy signals, including legally recognized opt-out preference signals such as the Global Privacy Control (“GPC”), where applicable to our processing and legal obligations.

Browser-level “Do Not Track” signals may not have the same legal effect in every jurisdiction.

Where applicable law requires a specific response to a privacy signal, we will process the signal in accordance with that law.

32. Security

We implement reasonable technical and organizational measures designed to protect personal information against:

Unauthorized access;
Unauthorized disclosure;
Loss;
Destruction;
Alteration;
Misuse;
Accidental disclosure.

Security measures may include:

Access controls;
Authentication;
Authorization;
Encryption;
Secure communications;
Infrastructure security;
Logging;
Monitoring;
Backup procedures;
Security testing;
Software updates.

No internet transmission or storage system can be guaranteed to be completely secure.

33. Data Breach and Security Incidents

If we become aware of a personal data breach that requires notification under applicable law, we will make the required notifications to relevant authorities and/or affected individuals within the legally required timeframe.

Notification requirements may differ depending on the applicable jurisdiction.

34. Automated Processing and AI-Assisted Services

Some ReKid™ features may use automated processing, algorithms, artificial intelligence, machine learning, search systems, classification systems, or content-processing technologies.

These technologies may process search queries and information in order to provide the requested Service.

ReKid™ does not intend to use children's ordinary search questions to create identity-based advertising profiles.

Where applicable law provides specific rights regarding solely automated decisions that produce legal or similarly significant effects, those rights remain available.

35. Sensitive Personal Information

We do not intentionally request sensitive personal information from children through the basic ReKid™ search service.

Depending on the jurisdiction, sensitive information may include health information, biometric information, precise location, government identifiers, financial information, or other legally defined sensitive categories.

Users should not enter sensitive personal information into search fields unless the Service specifically requests it for a legitimate and disclosed purpose.

36. No Sale of Children's Personal Information

We do not intentionally sell children's personal information.

The basic ReKid™ information service is not designed to require children's identity information.

Where a child uses the information service without creating an identity-based account, we do not intend to create a child identity profile for sale or advertising purposes.

37. Third-Party Websites

The Services may contain links to third-party websites.

Third-party websites operate independently and may have their own:

Privacy policies;
Cookies;
Tracking systems;
Advertising systems;
Data collection practices.

Once you leave ReKid™ and visit a third-party website, the third party's privacy practices may apply.

We are not responsible for the privacy practices of third-party websites that we do not control.

38. International Users

The Services may be accessed from different countries.

If you access the Services from outside Türkiye, your information may be processed in Türkiye or other countries where we or our service providers operate.

By using the Services, you acknowledge that privacy laws may differ between jurisdictions.

Where required by applicable law, we will provide appropriate safeguards and rights for international users.

39. European Representative

Where required by Article 27 GDPR, we will appoint an EU representative and publish the applicable representative's details in this Privacy Policy.

EU Representative: [IF APPLICABLE — INSERT EU REPRESENTATIVE DETAILS]

If Article 27 GDPR does not apply, no EU representative is appointed solely by virtue of this Privacy Policy.

40. UK Representative

Where required by applicable UK data protection law, we will appoint a UK representative.

UK Representative: [IF APPLICABLE — INSERT UK REPRESENTATIVE DETAILS]

41. Data Protection Officer

We do not designate a Data Protection Officer unless required by applicable law.

If a Data Protection Officer is appointed, the relevant contact information will be published in this Privacy Policy.

42. Privacy Requests

For privacy requests, you may contact us at:

Privacy Email: [PRIVACY EMAIL ADDRESS]

KVKK / Data Protection Email: [KVKK EMAIL ADDRESS]

Postal Address: [COMPANY ADDRESS]

Company: ARI BULUT DEPOLAMA BİLİŞİM TİCARET ANONİM ŞİRKETİ

43. GDPR Complaints

If GDPR applies to you, you may have the right to lodge a complaint with a supervisory authority in the EU/EEA country where you live, work, or believe an infringement occurred.

UK residents may have the right to lodge a complaint with the UK Information Commissioner's Office (“ICO”).

You may contact the relevant supervisory authority directly.

44. California Privacy Requests

California residents may use the privacy contact information above to submit applicable CCPA requests.

Requests may include:

Right to Know;
Right to Delete;
Right to Correct;
Right to Opt Out of Sale;
Right to Opt Out of Sharing;
Right to Limit Sensitive Personal Information;
Other rights provided under applicable California law.

Where required, we will provide the legally required response within the applicable statutory period.

California law also provides consumers with protections against discrimination for exercising privacy rights.

45. Children's Privacy

ReKid™ is intended to provide child-friendly information, but the basic Service is designed to operate without requiring children to provide identity information.

We do not intentionally request a child's:

Full name;
Email;
Telephone number;
Government ID;
Home address;
School address;
Financial information.

If a parent or guardian believes that a child has provided personal information to us that should not have been provided, the parent or guardian may contact us using the privacy contact information above.

We will evaluate the request and take appropriate action where required by applicable law.

46. Parents and Guardians

Parents and guardians are encouraged to supervise children's use of online services.

Children should be instructed not to enter:

Passwords;
Home addresses;
Telephone numbers;
Government identification numbers;
Financial information;
Private family information;
Other sensitive personal information

into search fields or online services unless specifically required and appropriate.

47. Data Minimization

We follow a data-minimization approach.

We do not seek to collect personal information merely because it may be technically available.

Where information is not necessary for the purpose for which it was collected, we seek to avoid collecting or retaining it.

This approach is particularly relevant to the child-oriented nature of ReKid™.

48. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

Changes in applicable law;
Regulatory requirements;
New Services;
Changes in technical infrastructure;
Changes in payment providers;
Changes in data processing;
Security improvements;
Changes in our business practices.

The updated Privacy Policy will be published with a revised effective date.

Where legally required, we will provide additional notice or obtain consent before implementing material changes.

49. Conflict Between Laws

This Privacy Policy is intended to operate globally.

If a mandatory provision of the law applicable to you provides greater privacy protection or additional rights than those described in this Privacy Policy, the mandatory legal requirement will prevail to the extent applicable.

Nothing in this Privacy Policy is intended to waive or limit a legal right that cannot lawfully be waived or limited.

50. Contact Information

For privacy questions, data protection requests, or concerns regarding the processing of personal information, please contact:

ARI BULUT DEPOLAMA BİLİŞİM TİCARET ANONİM ŞİRKETİ

Privacy Contact: [PRIVACY EMAIL]

KVKK Contact: [KVKK EMAIL]

Postal Address: [COMPANY ADDRESS]

Website: ReKid™ / getrekid.com

51. Summary of Our Privacy Approach

In summary:

We minimize personal data collection.

We do not require children to provide identity information to use the basic ReKid™ information service.

We do not intentionally create identity-based child profiles.

Purchase-related personal information belongs to the person making the purchase.

A purchase requires an email address. A name is collected only where an invoice needs one, and Turkish identity information only from customers invoiced in Türkiye. A bank transfer needs nothing but an email address.

Complete payment card information is not intended to be stored on our own systems when payment is processed by a third-party payment provider.

We do not intend to permanently store users' readable IP addresses.

A salted hash derived from an IP address may be retained for security and abuse-prevention purposes.

We do not sell personal information for monetary consideration.

We do not intentionally use children's personal information for behavioral advertising.

We provide privacy rights according to the laws applicable to the individual user.

52. Effective Date

Effective Date: August 22, 2026

ARI BULUT DEPOLAMA BİLİŞİM TİCARET ANONİM ŞİRKETİ

ReKid™