KVKK Privacy Notice

This notice has been prepared to inform you about the personal data we process through our website and communication channels, in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. This notice is not a consent form; for processing based on explicit consent, your consent is requested separately.

1. Data controller

Deyls Bilişim Teknolojileri ve Danışmanlık Hizmetleri Limited Şirketi ("Deyls")
MERSİS: 0295115430200001
Address: Acarlar Mah. Acarkent Sitesi 9. Cadde 1/30 Coliseum 5. Kat, Beykoz / İstanbul
KEP (registered electronic mail): deyls@hs01.kep.tr · Email: bilgi@deyls.com · Phone: +90 216 203 01 21

2. Personal data processed

• Identity and contact: full name, email address, phone number (optional).
• Professional information: the company you work for.
• Request content: the topic you select and the information you share in your message; your correspondence with us.
• Consent records: the record that you confirmed reading this privacy notice, the date of the notice and your consent to transfer abroad.
• Transaction security: an irreversible hash value generated from your IP address to prevent misuse of the form; if you give consent, your IP address, browser and connection information as part of the security verification.
• Visit statistics (only if you give cookie consent): online identifiers (cookie ID), device and browser information, pages visited and interactions.

Please do not share passwords, access credentials or special categories of personal data (such as health or biometric data) in your message.

3. Purposes of processing and legal grounds

Submitting the form does not mean that you agree to receive marketing messages; we have no newsletter or marketing list.

4. Method of collection

Your personal data is collected partly by automated means (the contact form on the website, form security and, if you give consent, analytics cookies) and partly by non-automated means (email, phone, KEP and written applications).

5. Transfers

Your personal data may be transferred to the following groups of recipients, only for the purposes above and only to the extent necessary:

• Email and collaboration service provider: Google (Google Workspace). Purpose: receiving and storing form messages and correspondence in our corporate email accounts.
• Form security verification service provider: Cloudflare, Inc. (Turnstile). Purpose: distinguishing automated submissions. Only with your consent.
• Analytics service provider: Google (Google Analytics). Purpose: visit statistics. Only with your cookie consent.
• Hosting service provider (Türkiye): Purpose: publishing the website. The hosting provider retains traffic logs under its own obligation pursuant to Law No. 5651 on the Regulation of Internet Publications.
• Certified public accountant and legal advisors: If a contract is concluded or a dispute arises, for the purposes of legal obligations and the protection of rights.
• Authorized public institutions and organizations and judicial authorities: Where required by law and limited to the scope requested.

6. Transfers abroad

Our website is hosted by a hosting provider in Türkiye. Our corporate email infrastructure (Google Workspace) and form security verification (Cloudflare Turnstile), as well as our analytics service (Google Analytics), may, however, use servers abroad. The Personal Data Protection Board has not yet issued an adequacy decision for any country. These transfers are therefore based on your explicit consent under KVKK Art. 9(6)(a), and your consent is requested separately before any transfer takes place:

• Contact form: Through the transfer consent checkbox in the form. This consent covers the delivery of the form message to us through our email infrastructure and the security verification of the form.
• Google Analytics: Through the cookie preference window.
• Direct email: When you email us, your message is processed on the same email infrastructure. If you do not want this, you can reach us by phone or KEP.

What you should know before giving consent: The countries to which data is transferred may not offer a level of protection equivalent to that in Türkiye; the competent authorities of those countries may access this data, and it may be more difficult for you to exercise your rights there. If you do not give consent, the form cannot be submitted and Google Analytics is not loaded; you can reach us by phone or KEP. You can withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

7. Retention period

• Requests that do not result in a contract: 2 years from the date of the last correspondence.
• If a contract is concluded: information recorded in commercial books and records is kept for 10 years under Article 82 of Turkish Commercial Code No. 6102, and documents within the scope of tax legislation for 5 years under Article 253 of Tax Procedure Law No. 213; for potential disputes, the general limitation period (10 years) under Turkish Code of Obligations No. 6098 is taken into account.
• IP hash generated for form security: up to 24 hours.
• Turnstile verification data: subject to Cloudflare's own retention policy; Deyls does not store this data.
• Visit statistics (Google Analytics): user-level and event-level data for up to 14 months; aggregated (non-identifying) reports are not subject to this period.

At the end of the retention period, the data is deleted, destroyed or anonymized.

8. Your rights

Under Article 11 of KVKK, you have the right to learn whether your personal data is processed; to request information about it if it has been processed; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to request its correction if it is incomplete or inaccurate; to request its deletion or destruction under the conditions set out in KVKK; to request that these actions be notified to the third parties to whom it has been transferred; to object to an outcome against you that arises from analysis exclusively by automated systems; and to claim compensation if you suffer damage as a result of unlawful processing.

9. Applications

You can submit requests regarding your rights in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by one of the following means:

• in writing and signed, to our address above,
• to our KEP address deyls@hs01.kep.tr,
• to bilgi@deyls.com, with a secure electronic signature or mobile signature,
• to bilgi@deyls.com, from an email address you have previously notified to us and that is registered in our system.

Your application should include your full name, your signature (for written applications), your Turkish ID number (for foreign nationals, your nationality and passport number), your address for notifications, your email address and phone number if available, and the subject of your request. You do not need to use a specific form. If the application is made on behalf of another person, a power of attorney must be attached; we may ask to verify your identity so that the response does not reach the wrong person.

Your application is concluded free of charge as soon as possible, depending on its nature, and within 30 days at the latest. If the response exceeds 10 pages, a fee may be charged for each additional page, and if the response is provided on a recording medium such as a CD or flash drive, a fee equal to the cost of the medium may be charged, as set out in the Communiqué.