GDPR Privacy Notice
Version 2026-10-30.1, effective 31 October 2026.
This notice is for people in the European Economic Area, the United Kingdom and Switzerland. It adds what the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Data Protection Act ask for to our Privacy notice (usespitfire.com/privacy-notice), which lists in full which data we process, from which forms, for how long and with whom. Where this notice says more, it applies to you.
1. Controller
Albiferro Yazılım ve Sistem Limited Şirketi (Albiferro Software & System Limited Company), Atakent Mah. 1472. Sok. Eda Apt. No:5 D:3 Elvankent, Etimesgut, Ankara, Türkiye, MERSİS No 0050147497700001. Contact for privacy questions: contact@usespitfire.com. We are established in Türkiye and have not appointed a representative in the EU or the UK.
2. What we process, in short
- Buyers and account holders: name, e-mail, phone, billing address, company name and VAT ID, order and payment status, the license key's id, sign-in sessions.
- Free key, feedback, quote and other forms: what you write in them.
- Visitors: the requests to our servers (IP address, User-Agent, address requested) in short-lived operation logs; page views and downloads only as counts; visit statistics only with your consent (Cookie policy).
- The Spitfire software you install sends us none of your test data; the optional health summary (off by default) carries no personal data.
Card details are entered on PayTR's payment page and never reach us.
3. Legal bases (GDPR Art. 6)
- Performing the contract and steps before it (Art. 6(1)(b)): orders, license keys, the customer account, the free key, quotes, end reminders, release and security notices about software you use.
- Legal obligation (Art. 6(1)(c)): invoices and tax and accounting records.
- Legitimate interests (Art. 6(1)(f)): security and fraud prevention, operation logs, counts of downloads and page views, the VIES check of a VAT ID, answering feedback. You may object at any time (section 6).
- Consent (Art. 6(1)(a)): visit statistics, publishing your feedback with your name, campaign e-mails and SMS. You may withdraw it at any time without affecting what was done before.
We make no decisions based solely on automated processing that have legal or similarly significant effects on you.
4. Recipients and transfers
The service providers that process data for us are listed with their location and purpose on usespitfire.com/subprocessors. Our servers are hosted by netcup GmbH, Almanya.
Data goes to Türkiye (where we are established and where PayTR, our e-invoicing and SMS providers are) and to the United States (e-mail delivery, the content network, notifications). For transfers from the EEA, the UK or Switzerland to countries without an adequacy decision we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum) included in the providers' data processing terms, or on the EU–US Data Privacy Framework where the provider is certified. Ask us for a copy of the relevant safeguards.
5. Retention
As in section 5 of the Privacy notice: for example, unpaid orders 30 days, paid orders and invoices 10 years (Turkish tax law), free key records 3 years, operation logs rolling by size, backups at most 14 days.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests, and to withdraw consent. You can change or delete most data yourself in the customer account (usespitfire.com/account). Write to contact@usespitfire.com; we answer within one month. You also have the right to lodge a complaint with the data protection supervisory authority of the country where you live or work, or where an alleged infringement took place.
7. Children
The Sites and the software are for professional use and not directed at children under 16.
8. Changes
We update this notice when our processing changes; the version and date above change with it.