Terms of service and data processing

These Terms of Service (“Terms”) govern the use of the Secure Mail email security service (the “Service”) provided by Atria Madencilik Turizm Yatırım Sanayi ve Ticaret Limited Şirketi (“Oxisec” or the “Company”). An organisation that creates an account in the panel, uses a free or paid plan, or enables the Service through the Plesk extension (the “Customer”) is deemed to accept these Terms. Where a signed contract or an accepted offer exists, that document prevails on conflicting points.

1. Parties and scope

The Service is offered only to merchants, companies, public bodies and professionals for business purposes; it is not a consumer transaction. The person opening the account declares that they are authorised to accept these Terms on behalf of the Customer.

2. The Service

The Service is an email security gateway that inspects email sent to and from the Customer’s domains before the Customer’s mail server. Depending on the plan it may include virus and malicious attachment scanning, spam and phishing detection, link protection (Link Guard), impersonation and payment fraud detection, sensitive data (DLP) checks, quarantine, archive, eDiscovery, reporting and an administrator security assistant. The current scope of each plan is on the Plans page and in the panel.

3. Account and security

The Customer is responsible for the accuracy of its account details, for keeping its users’ passwords confidential and for actions taken by its users in the panel. Two-step verification is recommended for administrator accounts. The Customer notifies the Company without delay on noticing unauthorised access.

4. Customer obligations

Use the Service only for domains it controls and is entitled to use.
Configure MX, SPF, DKIM and DMARC records according to the setup instructions; the Customer is responsible for delivery problems caused by misconfiguration.
Not use the outbound service for unsolicited bulk email (spam), phishing, malware distribution or unlawful content.
Not attempt to bypass the Service’s security measures, gain unauthorised access or overload the Service.
Inform its staff and correspondents, under its own legal obligations, that their email is scanned and archived for security purposes.

5. Limits of filtering

No email security system can guarantee that it will catch every malicious message or never quarantine a legitimate one. The Company operates the Service with care using recognised industry methods, but, except in case of its gross negligence, is not liable for the consequences of a missed malicious message or of a legitimate message noticed late in quarantine. The Customer is responsible for regularly checking quarantine notices and the quarantine. Security decisions (quarantine, rejection, link blocking) can be changed through the Customer’s policy settings.

6. Fees and payment

Prices for paid plans are shown on the Plans page, in the panel or in the offer sent to the Customer; unless stated otherwise they exclude VAT and other taxes. Prices in foreign currency may be invoiced in Turkish lira at the rate stated in the offer or invoice. Plans are charged in advance for the chosen period (monthly or yearly) and renew for the same period unless the Customer cancels. The Company announces price changes at least 30 days in advance; changes apply from the next period.

If payment is not made when due, the Company may suspend the Service 7 days after written notice. Since mail flow may be interrupted during suspension, the Customer is responsible for pointing its MX records back to its own server.

7. Free plan

The free plan is provided without any service level commitment. The Company may change its scope and limits, or end it with reasonable prior notice.

8. Term, cancellation and refunds

The Customer may cancel its subscription at any time by written notice (including email). Cancellation takes effect at the end of the paid period, and the Service can be used until then. No partial or full refund is made for a paid period. The Company may immediately suspend the account or terminate the contract if the Customer materially breaches these Terms (in particular use contrary to Section 4).

When the contract ends, the Customer may export its archive and quarantine data from the panel within 30 days of the end date. After that period Customer data is deleted, subject to statutory retention obligations.

9. Service continuity

The Company makes reasonable efforts to provide the Service without interruption. Planned maintenance is announced in advance where possible and carried out at off-peak hours. During temporary outages inbound email is held by sending servers and retried under standard SMTP behaviour. Unless a written service level agreement (SLA) is made, no specific availability rate is committed.

10. Processing of personal data

For personal data in the Customer’s email traffic, the Customer is the data controller and the Company is the data processor. The Company:

processes such data only to provide the Service and in line with the Customer’s panel settings and instructions;
protects it against unauthorised access with appropriate technical and organisational measures (encryption in transit, encrypted archive storage, access authorisation and audit logs);
gives access only to personnel who need it for the Service and are bound by confidentiality;
may use sub-processors for hosting (Amazon Web Services (Frankfurt, Germany)) and security lookups (Google Safe Browsing, abuse.ch) and notifies the Customer of changes to sub-processors;
notifies the Customer without delay of any data breach it becomes aware of and provides the information the Customer needs to notify the Personal Data Protection Board;
deletes the data when the contract ends in accordance with Section 8.

The Customer is responsible for having a legal basis for the processing and for informing data subjects. For processing where the Company is the controller, the Privacy Notice applies.

11. Confidentiality

The parties do not disclose trade secrets and confidential information learned under the contract to third parties, during the contract and after it ends, subject to legal requirements.

12. Intellectual property

All rights in the Service, software, panel interface and documentation belong to the Company. The Customer receives a non-transferable, non-exclusive right to use the Service for its internal business during the contract. The Customer’s emails and data belong to the Customer.

13. Limitation of liability

The Company’s total liability under this contract is limited to the fees actually paid by the Customer for the Service in the 12 months before the event giving rise to the claim. The Company is not liable for loss of profit, business interruption, reputational harm, data loss or other indirect damage. These limits do not apply to intent or gross negligence or to liability that cannot be limited by law.

14. Changes

The Company may change these Terms. Material changes to the Customer’s detriment are announced in the panel or by email at least 30 days in advance. If the Customer does not accept a change it may cancel before the effective date, in which case Section 8 applies.

15. Notices and evidence

Notices between the parties are sent to the Customer’s email address registered in the panel and to the Company at destek@kbgyazilim.com. In disputes, the Company’s system records, electronic correspondence and audit logs constitute conclusive evidence under Article 193 of the Turkish Code of Civil Procedure, without prejudice to the Customer’s right to submit counter-evidence.

16. Governing law and jurisdiction

These Terms are governed by the laws of the Republic of Türkiye. The courts and enforcement offices of Antalya have jurisdiction over disputes.

Last updated: 22 October 2026

This is a translation; the Turkish version prevails.