KVKK Privacy Notice

About this translation

This document is an English translation provided for information only. Mindpera's binding legal text is the Turkish version published on this site, and in the event of any discrepancy the Turkish text prevails.

The notice was drafted under Turkish Law no. 6698 on the Protection of Personal Data (KVKK). KVKK and the GDPR do not correspond article for article; references here are to the Turkish statute.

1. Data controller

This notice has been prepared by Mindpera Teknoloji Bilişim Danışmanlık Sanayi ve Dış Ticaret Limited Şirketi (hereinafter Mindpera) in its capacity as data controller under Turkish Law no. 6698 on the Protection of Personal Data (KVKK).

Mindpera processes the personal data it obtains through the corporate website published at www.mindpera.com for the purposes and on the legal grounds set out in this notice.

• Data controller: Mindpera Teknoloji Bilişim Danışmanlık Sanayi ve Dış Ticaret Limited Şirketi
• MERSİS no (Central Registry System number): 0621122069700001
• Trade registry: İstanbul Trade Registry Office, registry no 1098196
• Address: İnönü Mahallesi, Keklik Sokak No: 18 İç Kapı No: 6, Küçükçekmece, İstanbul
• Email: info@mindpera.com
• Web: www.mindpera.com

2. Personal data processed

Through our website we process only the data you submit and the technical records needed for the site to run securely. Our website does not carry out advertising tracking or profiling; page visits are counted in aggregate by a cookieless statistics service. The categories of data processed are as follows.

• Identity data: first name and surname.
• Contact data: email address and, if you provide it, telephone number.
• Professional experience data: your company name, your role, sector and number of branches.
• Request and complaint data: the message, the product of interest and the template you request through the contact, demo or template request form; the record confirming that you read this notice (the version of the notice and the server's time of receipt).
• Transaction security data: a keyed one-way hash of your IP address, used to prevent misuse of the form; technical records created on our hosting provider's servers for every request to the site, consisting of IP address, browser information, requested address and time.
• Site usage data: the page you visit, the address that referred you to the site, browser and device type and approximate location (country and city). This data is sent to our cookieless statistics service OpenPanel; your IP address is not stored, and a one-way value that changes daily is used to tell visits apart.

3. Purposes of processing

• Responding to your contact, demo and template requests (including giving you access to the Excel template you request) and getting back to you.
• Answering your questions about our products and services and running proposal and presentation processes.
• Establishing and conducting pre-contractual discussions and the commercial relationship.
• Operating the website, ensuring information security and preventing misuse of the form (automated submissions, unsolicited messages).
• Measuring, through aggregate statistics, which pages of the site attract interest and where visitors arrive from.
• Proving that the duty to inform has been fulfilled.
• Fulfilling our legal obligations and establishing, exercising and protecting rights in any dispute.

4. Method of collection

Your personal data is collected electronically, wholly or partly by automated means, through the following channels.

• Contact, demo request and template request forms on the website.
• Emails you send us directly.
• Technical records created automatically on servers when requests are made to the site.
• Page visit information sent to the cookieless statistics service (OpenPanel) when a page opens.

5. Legal grounds for processing

Your personal data is processed on the following legal grounds under KVKK art. 5.

The checkbox on the contact form is not explicit consent; it confirms that you have read this notice. Your explicit consent is not required for us to answer your request.

• KVKK art. 5/2-c: processing of personal data of the parties to a contract is necessary, provided it is directly related to the establishment or performance of that contract. Responding to contact, demo and proposal requests falls here.
• KVKK art. 5/2-ç: processing is mandatory for the data controller to fulfil a legal obligation.
• KVKK art. 5/2-e: processing is mandatory for the establishment, exercise or protection of a right. Keeping the confirmation record and correspondence as evidence in a possible dispute falls here.
• KVKK art. 5/2-f: processing is mandatory for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject. Site and form security, preventing misuse, keeping records of requests and producing aggregate site usage statistics fall here.

6. Transfer of personal data

Your personal data is not sold and is not transferred to third parties for marketing purposes. It is transferred only to the recipient groups listed below, for the stated purpose and to the extent required.

• To our hosting provider in Türkiye: for publishing the website, keeping server technical records and delivering the form notification when the email server cannot be reached.
• To our corporate email provider (Google, Google Workspace): for delivering your form submissions to us by email and storing them in our corporate mailboxes.
• To our cookieless statistics provider (OpenPanel): for producing aggregate site usage statistics. This service writes nothing to your browser and does not store your IP address.
• To authorised public institutions: within the scope of requests and obligations arising from legislation.
• To our legal advisers and financial adviser: for fulfilling legal obligations and establishing rights.

7. International transfer

Your form submissions and the emails you send us are processed and stored on the servers abroad of Google (Google Workspace), which provides our corporate email service. That data is therefore transferred abroad.

The servers of OpenPanel, used for aggregate page visit statistics, are located in the European Union, in Germany. Page visit information is sent to this service without your IP address being stored, using a one-way value that changes daily.

Apart from these, no service on our website transfers data abroad: there is no advertising tracking, third-party font, script or embedded content.

8. Retention periods

When the period expires or the purpose of processing no longer applies, your personal data is deleted, destroyed or anonymised.

• Contact and demo form data and the confirmation record: at most 3 years from the conclusion of your request. Where a commercial relationship is established, for the statutory limitation periods following its end.
• Email correspondence: at most 3 years, depending on the nature of the correspondence.
• IP hash kept for form security: for the one-hour rate-limit window; an expired record is deleted automatically on the next form submission.
• Hosting provider server records: for the period set by the provider under legislation and its own policy.

9. Data security measures

Technical and administrative measures are applied to prevent unlawful processing of and unlawful access to personal data.

• Website traffic is encrypted with HTTPS; browsers are told to reach the site over encrypted connections only.
• The form endpoint accepts requests only from the site's own pages; request size, submission frequency and automated submissions are limited.
• Form data is not held in a persistent database on the site; it is delivered by email over an encrypted connection.
• Two-step verification is used on our corporate email accounts.
• No externally loaded scripts run on the site; a content security policy (CSP) blocks scripts that are not allowed.
• Access to personal data is limited to employees who need it for their role.
• Software components in use are kept current and monitored against known vulnerabilities.

10. Rights of the data subject (KVKK art. 11)

Under KVKK art. 11 you have the following rights, exercisable by applying to the data controller.

• To learn whether your personal data is being processed.
• To request information if your personal data has been processed.
• To learn the purpose of processing and whether the data is used in line with that purpose.
• To know the third parties to whom the data is transferred, domestically or abroad.
• To request correction of incomplete or incorrectly processed data.
• To request deletion or destruction of the data under KVKK art. 7.
• To request that correction, deletion and destruction be notified to the third parties to whom the data was transferred.
• To object to a result against you arising from analysis of the processed data exclusively by automated systems.
• To claim compensation where you suffer loss because your data was processed unlawfully.

11. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send requests relating to your rights in writing to our postal address, or to our email address either signed with a secure electronic signature or mobile signature, or from an email address you have previously given us and that is registered in our systems.

Your application must clearly state your name, your contact details and the subject of your request. Depending on its nature, your request is concluded free of charge within 30 days at the latest. Where the process requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

If your application is rejected or you find the response insufficient, you may file a complaint with the Personal Data Protection Board within 30 days of learning the response and in any case within 60 days of the application date.

• Email: info@mindpera.com
• Post: İnönü Mahallesi, Keklik Sokak No: 18 İç Kapı No: 6, Küçükçekmece, İstanbul