Privacy Notice

The data controller under Türkiye's Law No. 6698 on the Protection of Personal Data will be [YASAL UNVAN]. The MERSİS number [MERSİS NO], tax number [VERGİ NO], and controller address [VERİ SORUMLUSU ADRESİ] must be verified against official records before this notice can go live.

The KEP address [KEP ADRESİ] and privacy-request email [KVKK BAŞVURU E-POSTASI] will be published only after ownership and monitored access have been confirmed. The ATUGIS brand name does not replace the controller's legal identity.

The contact form may collect a name, business name, email address, optional telephone number, request type, and the request text supplied by the visitor. Visitors must not submit passwords, identity documents, financial information, or special-category personal data in the free-text field.

Limited security signals may include request timing, language, an abuse-prevention signal derived from the IP address, origin/host information, bot-verification outcome, and technical error records. Theme and consent preferences are stored on the visitor's device; optional analytics does not load without an affirmative choice.

Contact data may be used to understand the request, reply to the requester, assess the appropriate service scope, maintain continuity for the same enquiry, and preserve a proportionate communication record if a dispute arises.

Technical and security signals may be used to prevent automated abuse, enforce rate limits, diagnose faults, protect service integrity, and investigate incidents. They will not be used to build an advertising profile or market to a visitor independently of the request.

Data is collected electronically when a visitor submits the form or when the infrastructure creates essential security records. Establishment, exercise, or protection of a right may be relevant to handling an enquiry; legitimate interests that do not override fundamental rights may be relevant to narrowly scoped security logging.

These are controlled preparation assumptions, not blanket conclusions. The legal basis must be verified for each field, purpose, and retention period. Optional analytics that requires consent will remain separate from the notice and require an active choice.

Hosting, security, bot-prevention, and email providers will be described only after [TEDARİKÇİ VE VERİ AKIŞI ENVANTERİ] verifies each provider's role, purpose, data categories, location, retention, and subprocessors. Limited disclosure to competent public authorities may occur where legally required.

If an international transfer is necessary, the current conditions and appropriate safeguards under Article 9 of Law No. 6698 must be assessed before the transfer begins. A broad consent for an undefined future transfer will not be treated as a valid substitute.

Concrete periods will be justified in [SAKLAMA VE İMHA PLANI] by purpose, legal duty, limitation period, and operational need. When the reason for processing ends, data will be deleted, destroyed, or anonymised through an applicable method.

Access will be role-limited; secrets will not be committed to source; form contents will not be copied into logs; and encryption in transit, rate limiting, input validation, and incident records will be applied in layers. No safeguard is presented as an absolute security guarantee.

Article 11 rights include learning whether data is processed; requesting information; learning the purpose, use, and recipients; seeking correction; requesting deletion or destruction where the conditions apply; requesting notice of correction/deletion to recipients; objecting to an adverse result produced solely by automated analysis; and seeking compensation for damage caused by unlawful processing.

The verified request channels and proportionate identity checks will be published on the Data Subject Request page.