Data Protection Notice

This notice explains, for an international reader, how Kulular Bilişim Teknolojileri Limited Şirketi (the Company) processes personal data through this website. It is governed by Turkish law, specifically Law No. 6698 on the Protection of Personal Data (KVKK), and by the Communiqué on Procedures and Principles to be Complied with in Fulfilment of the Obligation to Inform. It is not a translation of the Turkish notice word for word, and it does not assert equivalence with the UK GDPR or the EU GDPR. The Turkish text is the legally operative version; where the two differ, the Turkish text governs.

One document covers two duties. For data subjects in Türkiye, the disclosure duty under Article 10 of Law No. 6698. For data subjects in the European Union, the information duty under Article 13 of Regulation 2016/679 (GDPR). For the rights and remedies that arise only under European Union law, see section 10.

1. Identity of the controller

Under Law No. 6698, Kulular Bilişim Teknolojileri Limited Şirketi acts as the data controller for personal data collected through this website.

• Trade name: Kulular Bilişim Teknolojileri Limited Şirketi
• MERSİS number: 0591095454600001
• Trade registry number: 550123, Ankara Ticaret Sicili Müdürlüğü
• Address: Kızılırmak Mah. 1450 Sk. Hayat Plaza No: 16 Çankaya / Ankara
• Email: [email protected]

2. Categories of personal data processed

The Company processes personal data only through the channels below and only for the stated purposes.

2.1. Contact form

• Identity data: first name and last name
• Contact data: email address
• Professional data: organisation name, where given
• Transaction-security data: an IP address kept temporarily to prevent misuse
• Any other information the data subject includes in the message

2.2. The free-text field on the working-protocol screen

The home page’s working-protocol screen includes a free-text field where a visitor may describe their own institutional problem. Text entered there is transferred to service providers based abroad and processed automatically, as explained in section 5 below.

Visitors are asked not to enter personal data, client information, trade secrets or other confidential material into that field. This is also shown as a warning next to the field itself.

2.3. Visitor statistics (Google Analytics)

The site uses Google Analytics to measure visitor statistics. This processing only starts if the visitor gives explicit consent in the cookie banner at the bottom of the page; unless consent is given, or if it is declined, no data is processed.

• Processing-security and usage data: the page visited, the referring site
• Location data: an approximate location derived from the IP address; the IP address itself is not stored in full
• Processing-security data: an approximate device and browser type

Consent can always be withdrawn through "Cookie preferences" in the footer. See the Cookie Policy for detail.

2.4. Email correspondence and KAI, our AI team member

Emails sent to the Company are also read by KAI, the Company’s AI team member. KAI answers routine messages itself and schedules meetings. Every message sent by KAI carries a signature stating that it was written by an artificial intelligence system. For messages outside the routine, KAI only prepares a draft and the Company’s team decides whether it is sent.

• Identity data: first name and surname
• Contact data: email address and, if included in the message, telephone number
• Professional experience data: organisation and job title, if included in the message
• Date, time and participant details shared for scheduling a meeting
• Any other information the data subject shares in the content of the message

Please do not send special categories of personal data, confidential information belonging to third parties or trade secrets by email.

3. Purposes of processing

• Carrying out communication with visitors
• Following up requests and complaints
• Conducting pre-contractual discussions
• Running information-security processes and preventing misuse
• Carrying out the Company’s activities in compliance with the law
• Measuring visitor statistics, where consent is given
• Conducting email correspondence and scheduling meetings

Personal data is not processed for direct marketing, profiling or advertising, and is not sold or transferred to third parties for such purposes.

4. Legal grounds for processing

Personal data is processed on the following grounds under Article 5(2) of Law No. 6698.

• Sub-paragraph (c): processing is necessary provided that it is directly related to the establishment or performance of a contract, for the parties to that contract
• Sub-paragraph (ç): processing is mandatory for the controller to fulfil its legal obligation
• Sub-paragraph (f): processing is mandatory for the controller’s legitimate interest, provided this does not harm the data subject’s fundamental rights and freedoms

Visitor-statistics measurement with Google Analytics, however, does not rest on the grounds listed above. It is based on the data subject’s explicit consent under Article 5(1) of Law No. 6698. That consent is obtained through the cookie banner at the bottom of the page and can always be withdrawn through "Cookie preferences" in the footer.

The Company does not anticipate processing special-category personal data, so no processing takes place under Article 6 of Law No. 6698.

Email correspondence and meeting scheduling carried out by KAI rely on sub-paragraphs (c) and (f) above.

5. Transfer of personal data

5.1. Domestic transfer

Messages submitted through the contact form are delivered to the Company’s corporate email account through an email service provider.

5.2. Transfer abroad

Text entered into the working-protocol screen’s free-text field is transferred, through the Company’s server, to large language model providers based abroad, for the purpose of analysis. The recipient group consists of the intermediary service that provides access to the model and the provider that operates the model. The Company may change its service provider from time to time; the current provider’s trade name is disclosed to a data subject on request.

This transfer is made under Article 9 of Law No. 6698, and only where the data subject enters text into that field and submits it of their own accord. The text is not retained or stored by the Company once a result has been produced.

A data subject can prevent this transfer simply by not using that field. Every other function of the site works fully without it.

Emails sent to the Company are also transferred to large language model service providers established abroad for the processing described in section 2.4. The recipient group consists of the intermediary service provider that gives access to the model and the provider that operates the model. The trade names of the current providers are disclosed to the data subject on request. This transfer is carried out in accordance with the conditions set out in Article 9 of the Law.

5.3. Google Analytics transfer

Where a data subject gives explicit consent in the cookie banner described in section 2.3, visitor-statistics data is processed by Google Ireland Limited. The legal basis Google relies on for transfers outside the European Union is explained in Google’s own privacy policy. Without consent, this transfer does not take place.

6. Retention periods

• Contact form records: up to two years from the resolution of the enquiry
• IP address kept for transaction security: up to twenty-four hours
• The working-protocol free-text field: not retained on a permanent basis
• Google Analytics visitor data: the period set in the Google Analytics account settings, up to fourteen months
• Email correspondence: at most two years from the conclusion of the request

Once a retention period ends, personal data is deleted, destroyed or anonymised under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

7. Method of collection

Personal data is collected electronically through the website, through the data subject’s own statement, and in part through automated means.

Data relating to email correspondence is collected through the messages the data subject sends to the Company and, as explained in section 2.4, is processed partly by automated means.

8. The data subject’s rights

Under Article 11 of Law No. 6698, a data subject may apply to the controller to exercise the following rights.

• To learn whether their personal data is being processed
• To request information where it has been processed
• To learn the purpose of processing and whether the data has been used in accordance with that purpose
• To know the third parties to whom their personal data has been transferred, domestically or abroad
• To request correction of personal data that has been processed incompletely or inaccurately
• To request deletion or destruction under the conditions set out in Article 7 of Law No. 6698
• To request that a correction, deletion or destruction be notified to third parties to whom the data was transferred
• To object to a result that is to their detriment, arising solely from analysis by automated systems
• To claim compensation for damage suffered because of unlawful processing

9. How to apply

Under Article 13 of Law No. 6698 and the Communiqué on the Procedures and Principles for Applications to the Data Controller, a data subject may submit a request in writing, or through a registered email address, a secure electronic signature, a mobile signature, or an email address already registered with the Company.

Applications may be sent to [email protected] or to Kızılırmak Mah. 1450 Sk. Hayat Plaza No: 16 Çankaya / Ankara. The Company concludes a request free of charge, as soon as possible and in any case within thirty days. Where the request involves a separate cost, a fee set by the Personal Data Protection Board may apply.

Where an application is refused, the reply is found inadequate, or no reply is given in time, the data subject may complain to the Personal Data Protection Board within thirty days of learning the outcome, and in any case within sixty days of the original application.

10. Additional information for data subjects in the European Union

The Company is established in Türkiye and processes personal data principally under Law No. 6698. Where a data subject is in the European Union, Regulation 2016/679 (GDPR) may also apply. This section supplements the above with the information GDPR requires; where the two differ, whichever is more protective of the data subject applies.

10.1. Legal bases for processing

• Contact form: GDPR Art. 6(1)(b) (steps prior to entering a contract, at the data subject's request) and Art. 6(1)(f) (legitimate interest in answering enquiries received).
• Transaction-security record: GDPR Art. 6(1)(f) (legitimate interest in preventing misuse and automated submissions).
• The free-text field on the working-protocol screen: GDPR Art. 6(1)(a) (consent). Consent is given by submitting the text and can be withdrawn at any time by not using the field; withdrawal does not affect the lawfulness of processing before it.
• Compliance with legal obligations: GDPR Art. 6(1)(c).
• Email correspondence and meeting scheduling: GDPR Art. 6(1)(b) (pre-contractual steps at the data subject’s request) and Art. 6(1)(f) (legitimate interest: answering incoming messages in good time).

10.2. Transfers outside the EEA and safeguards

The transfer described in section 5.2 above may constitute a transfer outside the European Economic Area. The Company makes that transfer on the basis of the data subject's explicit consent within the meaning of GDPR Art. 49(1)(a), and only where the field in question is used. Where applicable, the European Commission's standard contractual clauses are relied on with service providers. A data subject can prevent the transfer entirely by not using that field.

The email transfer described in section 5.2 may also amount to a transfer outside the European Economic Area. It is carried out on the basis of one of the safeguards provided for in Chapter V of the GDPR.

10.3. Rights under the GDPR

In addition to the rights listed in section 8 above, data subjects within the scope of the GDPR have the following rights.

• To request restriction of processing (Art. 18).
• Data portability: to receive their data in a structured, commonly used and machine-readable format (Art. 20).
• To object, on grounds relating to their particular situation, to processing based on legitimate interest (Art. 21).
• To withdraw consent at any time where processing is based on consent (Art. 7(3)).
• To lodge a complaint with a supervisory authority (Art. 77). A data subject may apply to the data protection authority of the member state of their habitual residence, place of work, or the place of the alleged infringement.

10.4. Automated decisions and profiling

The Company does not take decisions based solely on automated processing that produce legal effects concerning a person or similarly significantly affect them within the meaning of GDPR Art. 22. The analysis output on the working-protocol screen is a draft; it does not produce a decision about a person.

KAI’s replies to routine messages and the meetings it schedules are not decisions that produce legal effects concerning the data subject or similarly significantly affect them. The statement in the signature of every message sent by KAI that it was written by an AI is made, for data subjects in the European Union, under the transparency obligation in Article 50 of Regulation (EU) 2024/1689 on Artificial Intelligence.

10.5. Whether providing data is required

Providing personal data is neither a statutory nor a contractual requirement. The fields in the contact form are needed only so that an enquiry can be answered; the sole consequence of not providing them is that the Company cannot reply.

11. Changes

The Company reserves the right to update this notice in line with changes in the law and in its own activities. The current text is published on this page, and its effective date is shown at the top.