Privacy policy

This policy explains which personal data we process when you visit https://northbytra.com, contact us or buy a license, according to the EU General Data Protection Regulation (GDPR) and, for customers in Turkey, the Personal Data Protection Law No. 6698 (KVKK). Last updated: Oct 9, 2026.

1. Controller

FORMAT BİLGİSAYAR

Soğuksu mah. Sümer oral cad. no:152/B16 Alaşehir/Manisa Türkiye

E-mail: sales@northbytra.com

2. Visiting the website

When you open a page, our web server processes technical data (IP address, date and time, requested page, browser type) in order to deliver the page and protect it against attacks. Server logs are deleted after 14 days at the latest. Legal basis: Art. 6(1)(f) GDPR.

We count page views without cookies and without storing IP addresses or any identifier: only the day, the page, the language and the referring website (domain only) are stored as totals. It is not possible to identify you from this.

No third-party services: this website does not load fonts, scripts, maps, videos, analytics or advertising from other companies. No third-party cookies are set. Exception: on the payment page, PayTR's card form may be shown in a frame (see section 5).

3. Contact form and e-mail

If you contact us, we process your name, e-mail address, optional phone number and your message to answer your request (Art. 6(1)(b) and (f) GDPR). E-mail address and phone number are stored encrypted. Messages are deleted when they are no longer needed, at the latest after 24 months.

4. Orders

To process your order we need your name, e-mail address, country and — for invoices — company, address and tax details; for card payments in Turkey the payment provider may require a phone number and ID number. Legal basis: Art. 6(1)(b) GDPR (contract) and 6(1)(c) GDPR (tax law retention). Contact details, address and ID number are stored encrypted. Order and invoice data is kept for the statutory retention period (usually 10 years); after that, the personal data in it is anonymised automatically. Orders that are never paid are anonymised after 12 months. Notices of withdrawal are kept for 3 years.

We send you e-mails about your order: the order and payment details, a single reminder if the order remains unpaid, and the delivery. These e-mails concern only your order and contain no advertising (Art. 6(1)(b) GDPR). If you order installation by us, we process the hosting access you enter on your order page (server, user name, password) only for the installation and delete it after the installation, at the latest after 14 days.

We store your activation key and a personal download link to deliver the software. The download link is valid for 14 days and is removed 30 days after it expires.

License server: each license is valid for one domain only. When the software is activated and afterwards for license validation, your website contacts our license server; we store the key ID, the domain, the software version, the time of the last check and the IP address of the server your website runs on (Art. 6(1)(b) and (f) GDPR — license verification and protection against misuse). The current domain of a key is kept as long as the license exists. Server IP addresses and domains the key is no longer used on are deleted after 12 months without a check; license server events are deleted after 12 months.

5. Payment providers

If you pay by card, you are redirected to the payment page of the provider you choose. Card data is entered only there and never reaches us. With PayTR, this payment page may instead be shown in a frame on our website; card data is still entered only in the PayTR form. Depending on your choice, the following companies process your payment data as independent controllers or processors:

• PayTR (PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş., Turkey)

Please refer to the privacy policy of the respective provider. Transfers to countries outside the EU are based on the applicable safeguards (e.g. adequacy decisions or standard contractual clauses).

6. E-mail delivery and hosting

Our website is hosted by a hosting provider under a data processing agreement; e-mails are sent via our e-mail provider.

Records and security: payment notifications from the payment providers (order number and status — never card data) are kept as long as the order records. For the e-mails we send, we log the masked recipient address, the subject and the delivery status for 12 months. To protect our forms against abuse, your IP address (or a hash of your e-mail address) is stored for at most 24 hours. Actions and sign-ins in our admin panel are logged for administrators only (activity log 2 years, sign-ins 6 months).

Current retention periods (taken automatically from our settings):

• Contact messages: 2 years
• Withdrawal notices: 3 years
• Unpaid orders: 1 year
• Paid orders and invoices: 10 years
• Expired download links: 30 days
• License server: server IPs and old domains: 1 year
• Order steps as proof of the contract (IP address and browser when ordering, accepting the terms, paying, displaying the key and downloading): Like the order (removed when its personal data is anonymised)
• Admin sign-ins: 180 days
• Activity (admin actions): 2 years
• Sent e-mails: 2 years
• Payment notifications: 10 years
• License server events: 2 years
• Application error logs (files): 1 year
• Rate limits (IP address or hashed e-mail, form and login protection): 24 hours
• Password reset links (hash only): 2 days
• Two-step verification codes (hash only): 1 day after expiry
• Trusted browsers of admins (cookie nb_trust, hash only): 30 days

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR; Art. 11 KVKK). Write to sales@northbytra.com. You also have the right to lodge a complaint with a supervisory authority, e.g. .

8. Cookies and local storage

See our cookie policy.