1Introduction

This Privacy Policy explains how GitSec Ltd ("GitSec") collects, uses, stores, shares, and protects personal data in connection with the Services.

GitSec is committed to protecting personal data and complying with applicable data protection laws, including the UK GDPR, EU GDPR, and, where applicable, the Turkish Law on the Protection of Personal Data No. 6698 ("KVKK").

By accessing or using the Services, Customers acknowledge that their personal data may be processed as described in this Privacy Policy.

2Information We Collect

GitSec may collect the following categories of information:

• Account Information : Personal data such as name, email address, company name, account credentials, and billing information.
• Repository and Service Data: Information required to provide the Services, which may include repository data, backup data, commit history, repository metadata, configuration settings, audit logs, and other information associated with Customer repositories.
• Usage Information: Information relating to use of the Services, including login activity, API usage, feature interactions, support requests, and service activity logs.
• Technical Information: Technical data such as IP address, browser type, operating system, device information, and diagnostic information.
• Payment Information: Payment information necessary to process subscriptions and invoices. Payment transactions are processed by third-party payment providers. GitSec does not store full payment card details.

3How We Use Your Information

GitSec may use personal data and other information collected through the Services for the following purposes:

• Service Delivery: To provide, operate, maintain, secure, and support the Services, including performing backups, restorations, storage operations, account administration, and service-related functionality.
• Account Management and Customer Support: To create and manage Accounts, authenticate users, respond to enquiries, provide technical support, and communicate with Customers regarding the Services.
• Billing and Subscription Management: To process payments, manage subscriptions, generate invoices, prevent fraudulent transactions, and comply with financial and accounting obligations.
• Security and Service Protection: To monitor, investigate, prevent, and address security incidents, unauthorized access, abuse, fraud, or other activities that may affect the Services or their users.
• Service Improvement and Analytics: To analyze website usage, monitor service performance, troubleshoot issues, and improve the functionality, reliability, and user experience of the Services.
• Legal and Regulatory Compliance: To comply with applicable laws, regulations, court orders, governmental requests, and other legal obligations.

4Legal Bases for Processing

Where required by applicable data protection laws, including the UK GDPR and EU GDPR, GitSec processes personal data on one or more of the following legal bases:

• Performance of a Contract: Processing necessary to provide the Services, manage Accounts, perform backups and restorations, process payments, and otherwise fulfil contractual obligations to Customers.
• Legitimate Interests: Processing necessary to operate, maintain, secure, improve, and protect the Services, prevent fraud and abuse, provide customer support, and ensure the reliability and performance of the Services.
• Compliance with Legal Obligations: Processing necessary to comply with applicable laws, regulations, court orders, governmental requests, accounting requirements, and other legal obligations.
• Consent: Where required by applicable law, processing based on the Customer's consent, including for certain cookies, analytics technologies, or marketing communications. Customers may withdraw consent at any time, although this will not affect the lawfulness of processing carried out before such withdrawal.

5Data Sharing

GitSec does not sell personal data.

GitSec may share personal data with trusted third-party service providers and subprocessors where necessary to provide, operate, support, secure, and improve the Services. Such third parties may include:

• Payment Providers: Third-party payment processors responsible for processing subscription payments, invoices, and related financial transactions.
• Cloud Hosting and Storage Providers: Third-party infrastructure, hosting, backup, and cloud storage providers used to host, store, process, and protect Customer data.
• Customer Support and Communication Providers: Third-party providers used to deliver customer support, service notifications, account communications, and operational messages.
• Analytics and Service Providers: Third-party providers used to analyze service usage, monitor performance, improve functionality, and maintain the reliability and security of the Services.
• Legal Requirements: GitSec may disclose information where required to comply with applicable laws, regulations, court orders, governmental requests, or to protect the rights, property, security, or legitimate interests of GitSec, its Customers, or third parties.

A current list of GitSec's subprocessors is available at [URL]. GitSec may update this list from time to time in accordance with applicable agreements and data protection laws.

6International Data Transfers

GitSec operates globally and, as a result, personal data may be transferred to, stored in, or accessed from countries other than the country in which the Customer is located.

Where personal data is transferred internationally, GitSec will implement appropriate safeguards required by applicable data protection laws, including the UK GDPR, EU GDPR, and, where applicable, KVKK.

Such safeguards may include adequacy decisions, standard contractual clauses, data transfer agreements, or other lawful transfer mechanisms recognized under applicable law.

Where available, Customers may be permitted to select a preferred data residency region for certain Services. However, limited cross-border processing may still occur for operational, support, security, legal, or administrative purposes.

7Data Storage and Security

GitSec stores and processes data using secure infrastructure and cloud service providers selected to support the delivery of the Services.

Where available, Customers may be permitted to select a preferred data residency region for certain Services. Depending on the selected configuration, Customer data may be stored in Türkiye, the European Union, the United Kingdom, the United States, or other locations made available by GitSec from time to time.

GitSec implements appropriate technical and organisational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, misuse, or destruction. Such measures may include encryption, access controls, authentication mechanisms, monitoring tools, and other security safeguards appropriate to the nature of the Services and the information processed.

Where Customers choose to use third-party storage environments, GitSec processes Customer Content in accordance with the Services. The availability and operation of Customer-selected storage environments remain the responsibility of the applicable third-party provider.

8Data Retention

GitSec retains personal data only for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and protect the legitimate interests of GitSec and its Customers.

Customer Content and related service data are generally retained for the duration of the applicable Subscription. Following cancellation or termination of a Subscription, Customer Content may be retained for up to thirty (30) days to facilitate retrieval or recovery, after which it may be permanently deleted in accordance with GitSec's data retention practices.

Certain information, including billing records, transaction records, security logs, audit logs, support records, records evidencing acceptance of legal terms and policies, and other information required for legal, regulatory, security, or operational purposes, may be retained for longer periods where necessary or required by applicable law.

9User Rights

Subject to applicable data protection laws, including the UK GDPR, EU GDPR, and, where applicable, KVKK, Customers may have the right to:

• Access: Request access to the personal data processed by GitSec.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of personal data in certain circumstances.
• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to certain processing activities carried out by GitSec.
• Portability: Request a copy of personal data in a structured, commonly used, and machine-readable format.
• Withdrawal of Consent: Withdraw consent where processing is based on consent.

GitSec will respond to requests relating to personal data in accordance with applicable legal requirements.

To exercise any of these rights, please contact GitSec at info@gitsec.io.

Customers may also have the right to lodge a complaint with the relevant data protection authority in their jurisdiction.

10Cookies

For detailed information regarding cookies, please refer to the GitSec Cookie Policy.

11Data Breach Notification

In the event of a personal data breach, GitSec will take appropriate steps to investigate, contain, and mitigate the impact of the incident.

Where required by applicable law, GitSec will notify the relevant supervisory authorities and affected individuals within the timeframes prescribed by such laws.

12Contact Us

For general questions about this policy, contact info@gitsec.io. For technical support, contact support@gitsec.io. For billing, service credits, or refund-related requests, contact sales@gitsec.io.