Data Protection Notice

This notice explains, for an international reader, how Kulular Bilişim Teknolojileri Limited Şirketi (the Company) processes personal data through this website. It is governed by Turkish law, specifically Law No. 6698 on the Protection of Personal Data (KVKK), and by the Communiqué on Procedures and Principles to be Complied with in Fulfilment of the Obligation to Inform. It is not a translation of the Turkish notice word for word, and it does not assert equivalence with the UK GDPR or the EU GDPR. The Turkish text is the legally operative version; where the two differ, the Turkish text governs.

1. Identity of the controller

Under Law No. 6698, Kulular Bilişim Teknolojileri Limited Şirketi acts as the data controller for personal data collected through this website.

• Trade name: Kulular Bilişim Teknolojileri Limited Şirketi
• MERSİS number: 0591095454600001
• Trade registry number: 550123, Ankara Ticaret Sicili Müdürlüğü
• Address: Kızılırmak Mah. 1450 Sk. Hayat Plaza No: 16 Çankaya / Ankara
• Email: kulularteknoloji@gmail.com

2. Categories of personal data processed

The Company processes personal data only through the channels below and only for the stated purposes.

2.1. Contact form

• Identity data: first name and last name
• Contact data: email address
• Professional data: organisation name, where given
• Transaction-security data: an IP address kept temporarily to prevent misuse
• Any other information the data subject includes in the message

2.2. The free-text field on the working-protocol screen

The home page’s working-protocol screen includes a free-text field where a visitor may describe their own institutional problem. Text entered there is transferred to service providers based abroad and processed automatically, as explained in section 5 below.

Visitors are asked not to enter personal data, client information, trade secrets or other confidential material into that field. This is also shown as a warning next to the field itself.

3. Purposes of processing

• Carrying out communication with visitors
• Following up requests and complaints
• Conducting pre-contractual discussions
• Running information-security processes and preventing misuse
• Carrying out the Company’s activities in compliance with the law

Personal data is not processed for direct marketing, profiling or advertising, and is not sold or transferred to third parties for such purposes.

4. Legal grounds for processing

Personal data is processed on the following grounds under Article 5(2) of Law No. 6698.

• Sub-paragraph (c): processing is necessary provided that it is directly related to the establishment or performance of a contract, for the parties to that contract
• Sub-paragraph (ç): processing is mandatory for the controller to fulfil its legal obligation
• Sub-paragraph (f): processing is mandatory for the controller’s legitimate interest, provided this does not harm the data subject’s fundamental rights and freedoms

The Company does not anticipate processing special-category personal data, so no processing takes place under Article 6 of Law No. 6698.

5. Transfer of personal data

5.1. Domestic transfer

Messages submitted through the contact form are delivered to the Company’s corporate email account through an email service provider.

5.2. Transfer abroad

Text entered into the working-protocol screen’s free-text field is transferred, through the Company’s server, to large language model providers based abroad, for the purpose of analysis. The recipient group consists of the intermediary service that provides access to the model and the provider that operates the model. The Company may change its service provider from time to time; the current provider’s trade name is disclosed to a data subject on request.

This transfer is made under Article 9 of Law No. 6698, and only where the data subject enters text into that field and submits it of their own accord. The text is not retained or stored by the Company once a result has been produced.

A data subject can prevent this transfer simply by not using that field. Every other function of the site works fully without it.

6. Retention periods

• Contact form records: up to two years from the resolution of the enquiry
• IP address kept for transaction security: up to twenty-four hours
• The working-protocol free-text field: not retained on a permanent basis

Once a retention period ends, personal data is deleted, destroyed or anonymised under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

7. Method of collection

Personal data is collected electronically through the website, through the data subject’s own statement, and in part through automated means.

8. The data subject’s rights

Under Article 11 of Law No. 6698, a data subject may apply to the controller to exercise the following rights.

• To learn whether their personal data is being processed
• To request information where it has been processed
• To learn the purpose of processing and whether the data has been used in accordance with that purpose
• To know the third parties to whom their personal data has been transferred, domestically or abroad
• To request correction of personal data that has been processed incompletely or inaccurately
• To request deletion or destruction under the conditions set out in Article 7 of Law No. 6698
• To request that a correction, deletion or destruction be notified to third parties to whom the data was transferred
• To object to a result that is to their detriment, arising solely from analysis by automated systems
• To claim compensation for damage suffered because of unlawful processing

9. How to apply

Under Article 13 of Law No. 6698 and the Communiqué on the Procedures and Principles for Applications to the Data Controller, a data subject may submit a request in writing, or through a registered email address, a secure electronic signature, a mobile signature, or an email address already registered with the Company.

Applications may be sent to kulularteknoloji@gmail.com or to Kızılırmak Mah. 1450 Sk. Hayat Plaza No: 16 Çankaya / Ankara. The Company concludes a request free of charge, as soon as possible and in any case within thirty days. Where the request involves a separate cost, a fee set by the Personal Data Protection Board may apply.

Where an application is refused, the reply is found inadequate, or no reply is given in time, the data subject may complain to the Personal Data Protection Board within thirty days of learning the outcome, and in any case within sixty days of the original application.

10. Changes

The Company reserves the right to update this notice in line with changes in the law and in its own activities. The current text is published on this page, and its effective date is shown at the top.