Privacy policy

Online Server Telekomünikasyon Limited Şirketi ("Online Server", "we") runs onlineserver.co and the client area at onlineserver.co/my, and is the data controller for the personal data described here. Address: Yeşilköy Mah., Atatürk Cad., EGS Business Center Park B2 Blok No:1, 34149 Bakırköy, İstanbul, Türkiye. MERSIS 0643067495100001.

This policy explains what personal data we process, why, on what legal basis, who receives it and what rights you have. It applies under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for visitors and customers in the European Economic Area and the United Kingdom, the GDPR and the UK GDPR.

To ask about your data or use your rights, open a ticket at onlineserver.co/my/submitticket.php.

Account and billing data: your name, company name, email address, phone number, postal address, tax number and VAT details, which you enter when you register or order in the client area.

Service data: the products you order, their configuration, invoices, payment status, IP addresses assigned to your services, and the technical data needed to run them.

Payment data: payments are made on the pages of our payment providers (PayTR, Nestpay 3D Secure card payments, and a cryptocurrency gateway). We receive the payment result and a reference, not your full card number.

Identity documents: for Iran dedicated servers and Iran Legend VPS we ask for identity verification (KYC). The documents you send are used only for that check and kept as long as the law requires.

Domain registration data: the registrant contact details required by the registry and the registrar (name, organisation, address, email, phone).

Support data: the content of your tickets and chat conversations, and any files you attach.

Website usage data: your IP address, browser and device details and the pages you request, recorded in our server and security logs; and, only if you accept cookies, analytics and advertising measurements (see section 5).

To create your account, deliver and support the services you order, and invoice them: performance of a contract (KVKK Article 5(2)(c); GDPR Article 6(1)(b)).

To keep invoices and accounting records, verify identity where required, and answer requests from public authorities: legal obligations (KVKK Article 5(2)(ç); GDPR Article 6(1)(c)).

To keep our network and services secure, prevent fraud and abuse, and handle disputes: our legitimate interests (KVKK Article 5(2)(f); GDPR Article 6(1)(f)).

To measure how the site is used and how our ads perform: your consent, given in the cookie banner (KVKK Article 5(1); GDPR Article 6(1)(a)). You can withdraw it at any time.

To send you service notices and, where you agreed, newsletters: performance of the contract for service notices; your consent for newsletters.

The chat window on our pages runs on our own Chatwoot server at chat.onlineserver.co. It stores your conversation and a browser identifier so the conversation continues across pages.

Our team answers chats, helped by an AI assistant that drafts replies from our product information. To draft a reply, the text of your message is sent to an external AI model provider. Please do not write passwords, card numbers or other secrets in the chat.

Necessary: your cookie choice (stored in your browser), the client area session cookies set by WHMCS when you sign in, and the chat identifier. These are needed for the site to work and do not require consent.

Analytics and advertising: Google Analytics and Google Ads tags. They run in Google Consent Mode and stay switched off (no analytics or advertising cookies) until you press Accept in the cookie banner. If you press Reject, they stay off.

To change your choice, clear this site's data in your browser; the banner will ask again on your next visit.

Infrastructure: the datacenters our services run in (Hetzner, OVHcloud, Radore, ColoCrossing, Nocix and Iranian datacenters), and Cloudflare, which delivers and protects this website.

Payments: PayTR, our bank's Nestpay card system and the cryptocurrency payment gateway, for the payments you make.

Domains: the domain registrar and the registry of the extension you register, as required to register and keep the domain.

Support tools: our Chatwoot server and the AI model provider used to draft chat replies (section 4).

Measurement: Google, if you accept analytics and advertising cookies.

Authorities: courts and public authorities when the law requires us to share data.

We do not sell your personal data.

Some of these recipients process data outside Turkey: our website and client area are hosted in France, our services run in the countries you choose, and Google, Cloudflare and AI model providers may process data in the United States and other countries. Where KVKK or the GDPR requires it, we rely on the safeguards those laws provide, such as standard contractual clauses, or on your explicit consent.

Account, service and billing records: for as long as you are a customer, and afterwards for the periods required by Turkish commercial and tax law.

Support tickets and chat conversations: for as long as needed to support you and handle any dispute.

Server and security logs: for a limited period, for security and abuse handling.

Identity documents: only as long as the law requires for the service they were collected for.

Under KVKK Article 11 you may ask whether we process your data and for what purpose, ask for information about it and about who receives it in Turkey or abroad, ask us to correct incomplete or wrong data, ask us to delete or anonymise it under the conditions of Article 7, object to a result that is against you and comes only from automated processing, and claim compensation for damage caused by unlawful processing.

If the GDPR or the UK GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection, the right to withdraw consent at any time, and the right to complain to your data protection authority.

Send your request through a ticket at onlineserver.co/my/submitticket.php. We answer within 30 days, as KVKK requires. You may also apply to the Turkish Personal Data Protection Authority (KVKK).

We protect personal data with access controls, encrypted connections (HTTPS) and limited staff access. No system is completely secure; if a breach affects your data, we will inform you and the authorities as the law requires.

We may update this policy when our services or the law change. The date at the top shows the latest version.