Personal data protection notice

At KUTBU, we pay the utmost attention to the security of your personal data and carry out all operations relating to personal data in accordance with Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, "KVKK" or the "Law") and related legislation. This notice has been prepared under Article 10 of the Law and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ). It applies to natural persons who visit the www.kutbu.com website, contact us through the contact form or newsletter, request a service quote or use our services, as well as to the representatives and employees of our customers ("data subjects").

Your personal data are processed by KUTBU YAZILIM BİLİŞİM TEKNOLOJİ SANAYİ VE TİCARET A.Ş. ("KUTBU") as the data controller. - Trade name: KUTBU YAZILIM BİLİŞİM TEKNOLOJİ SANAYİ VE TİCARET A.Ş. - Address: Küçükbakkalköy Mahallesi, Sonay Sokak, No: 6, Kat: 4, 34750 Ataşehir, İstanbul, Türkiye - Tax office and number: Kozyatağı Tax Office, 5990830790 - MERSIS number: 0599083079000001 - Trade registry number: 459195-5 - Registered electronic mail (KEP) address: kutbu@hs01.kep.tr - Phone: +90 (212) 812 88 48 – +90 (212) 852 88 48 - Email: merhaba@kutbu.com - Website: https://www.kutbu.com

We process only the personal data necessary for the purpose of processing. Depending on the nature of your relationship with us, the following categories of data may be processed: - Identity: name and surname. - Contact: email address, phone number (optional in the contact form). - Customer transaction: the content of your request and message, the service or topic you are interested in, quote and support correspondence. - Transaction security: IP address, server and hosting logs, the CSRF token (csrf_token) used to secure forms. - Marketing: the email address and consent record relating to your newsletter subscription. - Analytics: online identifiers and usage data on how the website is used, only if you allow analytics cookies in your cookie preferences. - For our customers, also contract, invoice and financial data: trade name or name and surname, tax identification details, billing address, contract and order details, payment and collection records. Our website does not collect or store card details; card payments are made through a payment link provided by a licensed payment institution. We do not knowingly collect special categories of personal data (e.g. health, religion, biometric data) through our website. Please do not include such data in your forms and messages. If you provide such data on your own initiative, it will be processed only where one of the conditions listed in Article 6 of the Law applies; otherwise it will be deleted or destroyed.

We process your personal data for the following purposes and on the legal grounds set out in Article 5 of the Law: - Receiving and answering your contact, feedback and application requests and preparing quotes (identity, contact, customer transaction): processing is directly related to the conclusion of a contract (Art. 5(2)(c)) and is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms (Art. 5(2)(f)). - Concluding and performing the service contract, providing support, invoicing and collecting payments (identity, contact, customer transaction, contract, invoice and financial): conclusion or performance of a contract (Art. 5(2)(c)). - Fulfilling obligations arising from tax, commercial and other legislation and responding to requests from competent authorities (contract, invoice and financial, transaction security): expressly provided for by law (Art. 5(2)(a)) and compliance with a legal obligation (Art. 5(2)(ç)). - Ensuring the security of the website and forms, preventing abuse and excessive requests, detecting errors (transaction security): compliance with a legal obligation (Art. 5(2)(ç)) and legitimate interest (Art. 5(2)(f)). - Establishing, exercising and defending our rights in potential disputes (all relevant categories): establishment, exercise or protection of a right (Art. 5(2)(e)). - Sending the newsletter and commercial electronic messages (marketing): explicit consent (Art. 5(1)) and the approval obtained under Law No. 6563 on the Regulation of Electronic Commerce (Elektronik Ticaretin Düzenlenmesi Hakkında Kanun). - Measuring and improving the use of the website (analytics): the explicit consent you give through your cookie preferences (Art. 5(1)). You may withdraw your explicit consent and your approval for commercial electronic messages at any time: by using the unsubscribe link in the newsletter, by writing to merhaba@kutbu.com or, for analytics cookies, by changing your preference via the "Cookie settings" link in the site footer. Withdrawal does not affect the lawfulness of processing carried out before it.

Your personal data are collected electronically, directly from you when you fill in the contact, feedback, application and newsletter forms on our website, contact us by email or phone, conclude a service contract and manage your account on KUTBU ID (https://id.kutbu.com); and by automated means while you visit the site, in the case of your IP address, server logs and (if you allow it) analytics data. Forms submitted through the site are not stored in a website database; they are delivered to the KUTBU team as emails through an email delivery service.

We do not sell your personal data. Your data may be shared only with the following groups of recipients, limited to the purposes above and in accordance with Articles 8 and 9 of the Law: - Our service providers: website hosting (cloud hosting service), delivery of form submissions as emails (Postmark, ActiveCampaign, Inc.) and, if you allow it, website usage analytics (Google Analytics, Google LLC / Google Ireland Ltd.). These providers process data on our behalf and in line with our instructions. - Payment services: a licensed payment institution, to carry out the payment where card payment is chosen. - Our business partners: only to the extent necessary to provide the service you request and limited to the data required. - Competent public institutions and organisations and judicial authorities: upon request, in the cases provided for by law and within the scope of our legal obligations.

The servers of some of the service providers we use are located outside Türkiye. Accordingly, form submissions may be transferred abroad through the email delivery service (Postmark); analytics data, only if you allow analytics cookies, through Google Analytics; and transaction security data relating to the website through cloud hosting infrastructure that may be located outside Türkiye. Transfers abroad are made in accordance with the conditions set out in Article 9 of the KVKK as amended by Law No. 7499. Accordingly, where there is no adequacy decision for the destination country, we rely on one of the appropriate safeguards, such as standard contracts notified to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), or on the other transfer grounds listed in Article 9 of the Law.

We retain your personal data for the period prescribed by the relevant legislation or required by the purpose of processing. For example, requests and correspondence are kept for as long as needed to conclude the request and for potential disputes; contract and invoice records for the periods prescribed by legislation such as the Turkish Commercial Code (Türk Ticaret Kanunu) and the Tax Procedure Law (Vergi Usul Kanunu); server logs for the period required by the relevant legislation, including Law No. 5651 (on the regulation of internet publications); and newsletter data until you withdraw your consent. Personal data whose retention period has expired, or for which the reasons requiring processing no longer exist, are deleted, destroyed or anonymised in accordance with Article 7 of the Law.

In accordance with Article 12 of the Law, we take the technical and administrative measures necessary to ensure an appropriate level of security in order to prevent the unlawful processing of and access to personal data and to safeguard the data. These measures include encrypted connections (HTTPS), form security (CSRF protection), rate limiting, authorisation-based access and collecting only the data that are necessary. If, despite these measures, processed personal data are obtained by others through unlawful means, we will notify the data subjects concerned and the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) as soon as possible, in accordance with Article 12 of the Law.

Under Article 11 of the Law, you may apply to the data controller to exercise the following rights: - a) to learn whether your personal data are processed, - b) to request information if your personal data have been processed, - c) to learn the purpose of processing your personal data and whether they are used in accordance with that purpose, - ç) to know the third parties, in Türkiye or abroad, to whom your personal data are transferred, - d) to request the correction of your personal data if they have been processed incompletely or inaccurately, - e) to request the deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the Law, - f) to request that the operations carried out under sub-paragraphs (d) and (e) be notified to the third parties to whom your personal data have been transferred, - g) to object to a result against you arising from the analysis of the processed data exclusively through automated systems, - ğ) to request compensation for damage if you suffer damage due to the unlawful processing of your personal data.

Under the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), you may send your requests concerning your rights to KUTBU by one of the following methods: - in writing, with a wet-signed petition, delivered by hand or by post to Küçükbakkalköy Mahallesi, Sonay Sokak, No: 6, Kat: 4, 34750 Ataşehir, İstanbul, Türkiye, - from your registered electronic mail (KEP) address to kutbu@hs01.kep.tr, - signed with a secure electronic signature or mobile signature, to merhaba@kutbu.com, - from an email address that you have previously provided to KUTBU and that is registered in our systems, to merhaba@kutbu.com. Your application must include your name, surname and, if the application is in writing, your signature; for Turkish citizens, your Turkish ID number, and for foreign nationals, your nationality and passport number or ID number, if any; your residential or business address for notification; your email address, phone number for notification, if any; and the subject of your request. We may need to verify your identity in order to respond to your request. We will conclude your application as soon as possible depending on the nature of the request and within thirty days at the latest, free of charge, in accordance with Article 13 of the Law. If the operation requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged. If your application is rejected, you find the response insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 of the Law within thirty days of learning of the response and, in any case, within sixty days of the application date.

We may update this notice to reflect changes in our processing activities or in the relevant legislation. The current version is always published on this page. For detailed information on cookies, see our "Cookie policy" page; for our general privacy principles, see our "Privacy policy" page.