Privacy Policy

#1. Who is responsible for your data

This Privacy Policy explains how TAKE OVER ALL LLC, a Wyoming limited liability company with its registered address at 30 N Gould St #40422, Sheridan, WY 82801, USA and operations in Istanbul, Türkiye ("we", "us", "our"), collects, uses, discloses and protects personal data when you visit takeoverall.com (the "Website") or communicate with us.

For the processing described in this policy, we are the controller (under the EU and UK General Data Protection Regulation, "GDPR"), the data controller (veri sorumlusu, under Türkiye's Personal Data Protection Law No. 6698, "KVKK") and the business or controller (under U.S. state privacy laws, where they apply).

When we process personal data on behalf of a client as part of a project — for example in a chatbot, CRM integration or database we build or host for that client — the client is the controller and we act as its processor or service provider. That processing is governed by our agreement with the client and our Data Processing Addendum, not by this policy. If you are a customer of one of our clients, please contact that client about your data.

Questions about this policy can be sent to support@takeoverall.com.

#2. The personal data we collect

We collect only the data described below. We do not ask for, and ask you not to send, sensitive personal data (such as health information, precise geolocation, government identifiers or financial account details).

Category	What it includes	Source
Contact form data	Your name, email address, company (optional), the territories you select, and your message	You
Waitlist data	Your email address and a record of the consent you gave (the consent wording and when you gave it)	You
Correspondence	Emails you exchange with us, including any information you choose to include	You
Technical data	IP address, browser user-agent, date and time of requests, requested URL and response codes; for form submissions we store the IP address and user-agent together with the submission to help prevent abuse	Your browser, automatically
Business contact data	If you become a client: names, job titles and business contact details of your representatives, and records of our communications	You or your organization

We do not use cookies, advertising pixels, analytics services, session-replay tools, fingerprinting or social media plugins on the Website, and we do not buy personal data from third parties. Our fonts and all other website assets are served from our own servers, so loading the Website does not send your IP address to font, analytics or advertising providers. See our Cookie Policy for the single browser-storage item the Website uses.

#3. How and why we use it

Purpose	Data used	Legal basis (GDPR / UK GDPR)	KVKK basis (Art. 5)
Replying to your enquiry and preparing a proposal	Contact form data, correspondence	Steps at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in responding to business enquiries (Art. 6(1)(f))	Necessary for establishing a contract (5/2-c); legitimate interest (5/2-f)
Sending course launch news you asked for	Waitlist data	Your consent (Art. 6(1)(a)), which you can withdraw at any time	Explicit consent (5/1)
Providing services to clients and managing the relationship	Business contact data, correspondence	Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f))	Performance of a contract (5/2-c); legitimate interest (5/2-f)
Keeping the Website and our systems secure, preventing spam and abuse	Technical data	Legitimate interests in security (Art. 6(1)(f))	Legitimate interest (5/2-f)
Complying with law, keeping accounting and tax records, responding to lawful requests	All categories, as necessary	Legal obligation (Art. 6(1)(c))	Legal obligation (5/2-ç)
Establishing, exercising or defending legal claims	All categories, as necessary	Legitimate interests (Art. 6(1)(f))	Establishing, exercising or protecting a right (5/2-e)

Where we rely on legitimate interests, we have balanced them against your rights and expectations; you may ask us for more information about this balancing and you may object (see Section 9).

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, for profiling, for targeted or cross-context behavioral advertising, or to train artificial-intelligence models. If you include personal data in your message, we use it only to deal with your enquiry.

#4. Who we share it with

We do not sell personal data and we do not "share" it for cross-context behavioral advertising (as those terms are defined in California and other U.S. state laws). We disclose personal data only to the following recipients, and only as necessary for the purposes above:

Recipient	Role	Location
Contabo GmbH — virtual server hosting for the Website, its database and our self-hosted tools	Processor / service provider	Data center in the European Union
Google (Google Workspace) — business email	Processor / service provider	Global infrastructure, including the United States
Professional advisers (lawyers, accountants, auditors)	Independent controllers bound by confidentiality	Where they are located
Public authorities, courts and law enforcement	When required by law or to protect rights, safety and property	Where they are located
A successor entity in a merger, acquisition, financing or sale of assets	New controller, bound by this policy for previously collected data	Where it is located

Our service providers may only use personal data to provide services to us and are bound by contractual confidentiality and data-protection obligations.

#5. International transfers

We are a U.S. company with operations in Türkiye, and our hosting is in the European Union. Depending on where you are, your personal data may therefore be processed in a country other than your own, including the United States, the European Union and Türkiye, whose data-protection laws may differ from yours.

Where the law requires a transfer safeguard, we rely on an appropriate mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), the standard contracts adopted under Article 9 of KVKK, or, where permitted, your explicit consent or the necessity of the transfer to take pre-contractual steps you requested. You can ask us for information about the safeguards we use.

#6. How long we keep it

Data	Retention
Contact form data and correspondence that does not lead to a business relationship	Up to 24 months after our last communication, then deleted
Data relating to clients and contracts	For the duration of the relationship and then for as long as required by tax, accounting and other legal obligations or limitation periods (generally up to 7 years after the end of the relevant financial year)
Waitlist data	Until you unsubscribe or ask us to delete it, or until 24 months after you joined if we have not launched courses by then; we keep a minimal record of an unsubscribe request so we can honor it
IP address and user-agent stored with a form submission	Deleted together with the submission
Server and security logs	A short period, typically no longer than 90 days, unless needed to investigate a security incident

When data is no longer needed, we delete or anonymize it.

#7. How we protect it

We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS/TLS) for the Website and its forms, key-only administrative access to servers, firewalls and intrusion-prevention tools, least-privilege access, regular updates, and limiting access to personal data to people who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal-data breach occurs that is likely to affect you, we will notify you and the competent authorities where the law requires it.

#8. Children

The Website is intended for businesses and adults. It is not directed to children, and we do not knowingly collect personal data from children under 16 (or under 13 in the United States, as defined by the Children's Online Privacy Protection Act). If you believe a child has sent us personal data, contact us and we will delete it.

#9. Your rights

You can exercise any of the rights below by emailing support@takeoverall.com. We will respond within the time required by applicable law — generally within one month (GDPR), 30 days (KVKK) or 45 days (U.S. state laws), extendable where the law allows. We may need to verify your identity before acting on a request, and we will not ask for more information than necessary. Exercising your rights is free unless a request is manifestly unfounded or excessive.

9.1 Everyone

Regardless of where you live, you may ask us to tell you what personal data we hold about you, to correct it, or to delete it, and you may unsubscribe from the waitlist at any time.

9.2 European Economic Area, United Kingdom and Switzerland

Under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection you have the right to: access your personal data; rectify inaccurate data; erase it; restrict its processing; receive it in a portable format; object to processing based on legitimate interests; and withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where an alleged infringement occurred.

9.3 Türkiye (KVKK)

Under Article 11 of KVKK you have the right to: learn whether your personal data is processed; request information about the processing; learn the purpose of processing and whether data is used for that purpose; know the third parties in Türkiye or abroad to whom data is transferred; request correction of incomplete or inaccurate data; request deletion or destruction of data under Article 7; request that third parties to whom data was transferred be notified of corrections or deletions; object to a result against you arising exclusively from automated analysis; and claim compensation for damage arising from unlawful processing. You may submit your request in writing or by email to support@takeoverall.com, and if your request is refused or not answered you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

9.4 United States

Depending on your state of residence (for example California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws), you may have the right to: know or access the personal information we have collected about you and how we use and disclose it; correct inaccurate personal information; delete personal information; obtain a portable copy; and opt out of the sale or sharing of personal information, targeted advertising and certain profiling. We do not sell or share personal information, engage in targeted advertising or conduct such profiling, and we do not use or disclose sensitive personal information, so there is nothing to opt out of; we nevertheless honor these requests, and we treat browser opt-out signals such as Global Privacy Control as a valid opt-out request.

We apply these rights regardless of whether the law technically applies to a business of our size. You may use an authorized agent to submit a request; we may ask the agent for proof of authorization and ask you to verify your identity directly. We will not discriminate against you for exercising any of your rights. If we decline your request, you may appeal by replying to our decision with the subject "Privacy Appeal"; we will respond to appeals within the period required by law, and if you are not satisfied you may contact your state attorney general.

California notices. In the preceding 12 months we collected the following categories of personal information, as described in Section 2: identifiers (name, email address, IP address); professional information (company); internet or other electronic network activity information (technical data); and inferences only to the extent contained in your messages. Sources, purposes, recipients and retention are described in Sections 2 to 6. We have not sold or shared personal information. Shine the Light: we do not disclose personal information to third parties for their direct marketing purposes. Do Not Track: because we do not track you across websites or over time, the Website does not change its behavior in response to "Do Not Track" signals, but it does honor Global Privacy Control as described above.

Nevada. We do not sell covered information as defined in Nevada law.

#10. Marketing communications

We send marketing emails only to people who asked for them (for example by joining the course waitlist with the consent box ticked). Every such email identifies us, includes our postal address and contains a working unsubscribe link, in line with the U.S. CAN-SPAM Act and applicable international rules. We process unsubscribe requests promptly and in any case within 10 business days.

#11. Links to other websites

The Website links to third-party websites, such as the websites of businesses we have worked with and course platforms. This policy does not apply to them; please read their privacy policies. If you buy one of our courses on a third-party platform, that platform processes your purchase under its own privacy policy.

#12. Changes to this policy

We may update this policy to reflect changes in our practices or the law. We will post the updated version on this page with a new effective date and, if the changes are material, we will take reasonable steps to inform you, for example by email if we hold your address for an ongoing purpose. If a change requires your consent under applicable law, we will ask for it.

#13. Contact

TAKE OVER ALL LLC
Registered address: 30 N Gould St #40422, Sheridan, WY 82801, USA
Operations: Istanbul, Türkiye
Email: support@takeoverall.com — please include "Privacy" in the subject line.