INFORMATION NOTICE UNDER TÜRKİYE'S PERSONAL DATA PROTECTION LAW

This English translation is provided for information. If any interpretation differs, the original Turkish text and applicable Turkish law prevail. Applications concerning statutory rights may need to be submitted in Turkish in accordance with the applicable procedure.

1. Purpose and Scope

This information notice has been prepared by İnurdemirel Digital Marketing and Software Services Trade Ltd. Co. to explain the processing of personal data obtained through www.inurdemirel.com, inurdemirel.com and related pages under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) and secondary legislation.

Personal data means information relating to an identified or identifiable natural person. Processing includes obtaining, recording, storing, changing, using, transferring, making available, classifying, restricting, deleting, destroying or anonymizing personal data by automatic means or as part of a data-recording system.

2. Data Controller and Contact Details

Data Controller: İnurdemirel Digital Marketing and Software Services Trade Limited Company
Tax Office / Number: Mithatpaşa / 4781161820
Address: Meşrutiyet District, Konur Street, Özsoy Business Center No: 25/13, Çankaya, Ankara, Türkiye
Telephone: +90 530 683 41 74
Email: kvkk@inurdemirel.com

3. Collection Methods

Personal data may be collected electronically when you visit the website, submit a form, create or use an account, purchase a service, communicate with the company, request support or provide information needed to perform a service. Information may be collected by automatic or non-automatic means where it forms part of a data-recording system.

4. Data Categories, Purposes and Legal Grounds

Data is processed only for specified, explicit and legitimate purposes; it should be relevant, limited and proportionate to those purposes, accurate and kept up to date where necessary. Special-category personal data is not requested through ordinary website forms.

5. Retention and Destruction

Personal data is stored for the period required by the processing purpose, service relationship, legal obligations and applicable limitation periods. When all processing conditions cease to exist, data is deleted, destroyed or anonymized according to the controller’s applicable retention and destruction procedures.

Deletion means making data inaccessible and unusable for relevant users. Destruction means making it inaccessible and irretrievable by anyone. Anonymization means making it impossible to associate data with an identified or identifiable person, even when combined with other information.

Records relating to destruction activities are retained for the period required by secondary legislation unless another law requires a longer period. A valid request is assessed according to current processing conditions and is answered within the legally applicable period.

6. Transfers

Personal data may be disclosed to judicial or administrative authorities where disclosure is expressly required by law. It may be shared with lawyers or professional advisers where necessary to establish, exercise or protect legal rights.

Limited data may also be shared with service providers such as hosting, software, design, payment, communication or technical personnel where necessary to deliver a requested service. Transfers are limited to the relevant purpose and are subject to applicable security and legal requirements. International transfers, if any, are handled according to the conditions in force under the KVKK.

7. Rights of the Data Subject

Under Article 11 of the KVKK and subject to its conditions, you may:

• learn whether your personal data is processed;
• request information if it has been processed;
• learn the purpose of processing and whether data is used consistently with that purpose;
• learn the third parties to whom data is transferred in Türkiye or abroad;
• request correction of incomplete or inaccurate data;
• request deletion or destruction where the statutory conditions are met;
• request notification of correction, deletion or destruction to relevant recipients;
• object to a result against you arising exclusively from automated analysis; and
• claim compensation where unlawful processing causes damage.

8. Application Procedure

Applications should follow the Communiqué on the Procedures and Principles of Application to the Data Controller and other applicable rules. A request may be sent to kvkk@inurdemirel.com from an email address associated with the applicant where appropriate.

The request should clearly state the subject and include the applicant’s name and surname, identification information required by law, nationality and identification number where applicable, a suitable address, contact details and supporting information. Only information necessary to verify identity and evaluate the request should be provided.

Applications are examined and concluded as soon as possible and no later than the legally applicable period, ordinarily thirty days. A request may be accepted or rejected with an explanation. A fee may apply only where permitted by the applicable tariff or law.

9. Security

The controller uses administrative and technical measures designed to prevent unlawful processing and unauthorized access and to support appropriate protection of personal data. Access should be limited according to responsibilities, and relevant personnel and service providers are expected to follow confidentiality and security requirements.

If processed personal data is unlawfully obtained by another party, notifications are made to the affected person and the Personal Data Protection Board where required by applicable law.

10. Effective Date and Updates

This notice takes effect when published on the website. It may be updated to reflect changes in processing practices, legislation or decisions of the Personal Data Protection Board. The current Turkish text published on the website remains the authoritative version.