Privacy Policy & Personal Data Protection Notice

1. Data Controller

The data controller with respect to your personal data under the KVKK and the GDPR is:

• Legal name: Evrenix Bilişim ve Yazılım Teknolojileri Limited Şirketi
• MERSİS (Central Registry) No: 0383101040100001
• Trade registry: İstanbul Ticaret Sicil Müdürlüğü — Registry No: 1149053
• Tax office / Tax ID: Kozyatağı / 3831010401
• Address: Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul C1 Blok No: 2B İç Kapı No: 376, Ataşehir / İstanbul
• Email: mert.evrensel@evrenixtech.com
• KEP (registered e-mail) address: evrenix@hs01.kep.tr
• Phone: +90 507 026 83 52
• Website: https://evrenixtech.com

As the thresholds in Article 37 of the GDPR are not met, the Company has not designated a data protection officer (DPO); for all questions and requests regarding personal data protection, please use the email address above.

Since our processing of personal data relating to data subjects in the European Union is currently occasional and low-risk, no representative in the Union has been designated, in reliance on the exemption in Article 27(2) of the GDPR. Should our EU-facing activities become regular, this will be reassessed and this notice will be updated.

2. Personal Data We Process

The following categories of personal data are processed through the Site:

• Identity data: your first and last name as submitted through the contact form.
• Contact data: your email address and, if provided, your company name.
• Inquiry content: the subject you select and the message you share in the contact form.
• Technical and security data: server logs such as IP address, browser type and version, operating system, pages visited and date/time of visit, as well as similar technical data processed by our hosting and analytics providers.
• Cookie and consent preference data: your language preference and the record of your cookie/analytics consent choice (preference, version and timestamp). See our Cookie Policy for details.

We do not request special categories of personal data (such as health, religion or ethnic origin) through the Site; please do not share such data via the contact form.

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Receiving, assessing and responding to the inquiries you submit through the contact form;
• Carrying out communication activities and establishing potential business relationships;
• Preparing proposals and conducting contract processes for our services upon your request;
• Operating the Site securely, reliably and in compliance with applicable law, and detecting errors and security incidents;
• If you consent, analysing the use of the Site through statistics that do not allow you to be identified, and improving the Site;
• Recording and evidencing your cookie and analytics consent preferences;
• Complying with our legal obligations and protecting our rights in potential disputes.

4. Legal Bases for Processing

Your personal data is processed on the following legal bases set out in Article 5 of the KVKK and Article 6 of the GDPR:

• Processing being directly related to the establishment or performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b) — assessing your requests for proposals and carrying out service processes;
• The legitimate interests of the data controller (KVKK Art. 5/2-f; GDPR Art. 6/1-f) — securing the Site, responding to contact requests and operating strictly necessary cookies;
• Compliance with a legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6/1-c) — retention, disclosure and notification obligations arising from applicable law, and evidencing consent records;
• Explicit consent (KVKK Art. 5/1; GDPR Art. 6/1-a) — running analytics measurement (your choice in the cookie consent banner) and the consent you give via the checkbox in the contact form.

5. How We Collect Personal Data and the Legal Bases

Your personal data is collected electronically, by fully or partly automated means, through the contact form on the Site, email correspondence, server logs, and cookies and similar technologies. Data collected through these methods is processed on the legal bases stated in Section 4: contact form data on the contract and legitimate-interest bases, technical records on the legitimate-interest basis, and analytics measurement data on the basis of your explicit consent. For details on cookies, please see our Cookie Policy.

6. Recipients of Personal Data

Your personal data may be transferred — solely for the purposes stated above and to the extent necessary — to the following categories of recipients:

• Vercel Inc. (USA) — hosting of the Site and, if you consent, cookieless analytics measurement. Data processing agreement: vercel.com/legal/dpa
• Web3Forms (USA) — relaying contact form submissions to us. Privacy notice: web3forms.com/privacy
• Public authorities legally entitled to receive personal data, and private parties authorised under our legal obligations — strictly limited to our obligations arising from applicable law.

We do not sell your personal data and do not share it with third parties for marketing purposes.

7. International Transfers

The servers of the hosting, form delivery and analytics providers listed above are located abroad (in particular in the United States). Data you submit through the contact form and technical data are therefore transferred internationally.

International transfers are carried out in accordance with the conditions set out in Article 9 of the KVKK (as amended by Law No. 7499): on the basis of an adequacy decision where one exists for the destination country and, in its absence, subject to appropriate safeguards including the standard contract published by the Turkish Personal Data Protection Authority, or in reliance on the exceptional circumstances provided for in that Article.

Transfers subject to the GDPR are carried out under Chapter V of the GDPR, subject to appropriate safeguards such as the European Commission's standard contractual clauses (SCCs). You may request a copy of the safeguards applied via the email address above.

8. Retention Periods

Your personal data is retained for the periods set out in the table below; at the end of the period it is deleted, destroyed or anonymised:

9. Your Rights as a Data Subject

Under Article 11 of the KVKK, you may apply to the data controller to exercise the following rights:

• To learn whether your personal data is being processed;
• To request information about the processing, if any;
• To learn the purpose of processing and whether the data is used in line with that purpose;
• To know the third parties to whom your data is transferred, in Turkey or abroad;
• To request rectification of incomplete or inaccurate data;
• To request erasure or destruction of your data under the conditions set out in Article 7 of the KVKK;
• To request that rectification, erasure or destruction be notified to third parties to whom the data has been transferred;
• To object to a result arising to your detriment from the analysis of your data exclusively by automated systems;
• To claim compensation for damages arising from unlawful processing.

Where the GDPR applies, you additionally have the rights of access (Art. 15), rectification (Art. 16), erasure — the right to be forgotten (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal; you can withdraw your analytics consent via the "Cookie Preferences" link at the bottom of the page.

10. How to Exercise Your Rights

In accordance with the Turkish Communiqué on the Principles and Procedures for Application to the Data Controller, you may submit requests regarding the rights listed above through the following channels:

• In writing (with a wet-ink signature), delivered by hand or by post to our address stated above;
• To our registered e-mail (KEP) address: evrenix@hs01.kep.tr;
• Signed with a secure electronic signature or mobile signature;
• From the email address you have previously notified to us and which is registered in our systems, to mert.evrensel@evrenixtech.com.

Your application must include your name and surname; if you are a citizen of the Republic of Türkiye, your Turkish ID number (if you are a foreign national, your nationality and passport number or, if available, your national ID number); your residential or workplace address for notification purposes; your email address and telephone number for notifications, if available; and the subject of your request. Written applications must also bear your signature. Applications submitted in Turkish are taken into consideration.

Your application will be concluded free of charge as soon as possible and within thirty (30) days at the latest, depending on its nature; if the process requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

11. Automated Decision-Making and Profiling

No decision producing legal effects concerning you, or similarly significantly affecting you, is made based solely on automated processing of the personal data collected through the Site, and no profiling is carried out (GDPR Art. 22).

12. Voluntary Nature of Providing Personal Data

Providing personal data through the contact form is not a statutory or contractual requirement; it is entirely voluntary. However, if you do not fill in the required fields, we cannot receive your inquiry or respond to you. Not consenting to analytics measurement does not affect your use of the Site in any way.

13. Data Security

Pursuant to Article 12 of the KVKK and Article 32 of the GDPR, Evrenix takes the necessary technical and organisational measures to ensure an appropriate level of security, to prevent unlawful processing of and unlawful access to personal data, and to safeguard its retention. Data transmission on the Site is encrypted via TLS/SSL; access to data is limited on a need-to-know basis and the principle of data minimisation is observed.

14. Your Right to Lodge a Complaint

If your application under Article 13 of the KVKK is rejected, if you find the response insufficient, or if no response is given in due time, you may lodge a complaint with the Turkish Personal Data Protection Board within thirty days of learning of the response and, in any event, within sixty days of the application date (KVKK Art. 14). A complaint to the Board cannot be lodged before the application remedy to the data controller has been exhausted. Further information: kvkk.gov.tr

For processing subject to the GDPR, you also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence or place of work (GDPR Art. 77). A list of supervisory authorities is available at: edpb.europa.eu

15. Changes to This Notice

This notice may be revised from time to time to reflect changes in legislation or in our data processing activities. The current version is always published on this page, and the update date above is revised for material changes.