KVKK Clarification Notice

1. Identity of the data controller

The data controller is Arpanet Bilişim A.Ş., with its registered office at ODTÜ Bilişim İnovasyon Merkezi, Mustafa Kemal Mah. Dumlupınar Bulv. No: 280, Kat: 1, D: 115, Çankaya / Ankara, Türkiye. For questions about this notice or our data-processing activities, you can reach us at info@arpanet.tr or +90 312 486 00 22.

2. Definitions

In this notice, “personal data” means any information relating to an identified or identifiable natural person; “data subject” means the natural person whose data is processed; “processing” means any operation from collection to destruction; “explicit consent” means consent on a specific matter, based on information and freely given; and “Board”/“Authority” refer to the Personal Data Protection Board and Authority.

3. Personal data processed and data categories

This is a brochure site; it has no membership, user account, online form or payment. Only a limited set of personal data is therefore processed: technical records generated automatically when you visit, the contact details you voluntarily send via the e-mail link, and analytics data that depends solely on your explicit consent.

The data processed is summarised by category, example data, purpose and legal basis in the table below. The special categories of personal data listed in Article 6 of the KVKK (health, biometric data, religion, criminal convictions, etc.) are not processed through this site.

4. Purposes of processing

Your personal data is processed to respond to and manage your contact requests, demo requests and other enquiries; to deliver, maintain and secure the website and prevent abuse; and, only where you have given explicit consent, to carry out aggregated usage analysis to improve the site.

5. Method of collection and legal basis

Personal data is collected by wholly or partly automated means in electronic form through this website: the messages you send us via the e-mail link, the server/access logs generated automatically during your visit, and — if you consent — analytics technologies.

The legal bases are in Article 5 of the KVKK: processing of site security and server logs relies on the data controller’s legitimate interest (Art. 5/2-f); handling your contact request relies on its being directly related to the establishment or performance of a contract (Art. 5/2-c) and, where applicable, on our legal obligation (Art. 5/2-ç). Analytics data is processed solely on the basis of your explicit consent (Art. 5/1).

6. Transfer of personal data

Within the scope of Article 8 of the KVKK and limited to the purposes above, your personal data may be transferred to our hosting, email and (where enabled) analytics service providers acting on our instructions, and to competent public authorities where legally required. Your data is not sold or transferred to third parties for marketing.

7. International transfers

Part of our hosting, email or analytics may be provided by providers established abroad. In that case your personal data is transferred under Article 9 of the KVKK, as amended with effect from 1 June 2024: first, whether the Board has issued an adequacy decision for the relevant country or sector is checked; if there is no adequacy decision, appropriate safeguards are relied upon, such as the standard contract published by the Board, binding corporate rules or an undertaking; and, where none of these exist, transfer takes place only on the exceptional grounds listed in the Law (including your explicit consent where required). Any international transfer of analytics data takes place only with your explicit consent.

8. Retention and destruction

Your personal data is kept for the period required by the purpose of processing and the maximum period prescribed by the relevant legislation. Contact and enquiry correspondence is kept for as long as needed to handle the request and for a reasonable record-keeping period afterwards. Server/access logs are kept for a short period for security and diagnostics; where an obligation arises under Law No. 5651, for the period prescribed by that legislation. When the periods expire, the data is erased, destroyed or anonymised in accordance with the relevant legislation.

9. Data security

In line with Article 12 of the KVKK, we take the necessary technical and organisational measures to ensure an appropriate level of security so as to prevent the unlawful processing of and access to personal data and to safeguard it: these include encryption in transit (HTTPS), restricted access rights, data minimisation and keeping our infrastructure up to date.

10. Rights of the data subject (KVKK Art. 11)

Under Article 11 of the KVKK, every data subject has the right to: learn whether their personal data is processed; request information if it is; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred at home or abroad; request rectification of incomplete or inaccurate data; request its erasure or destruction under Article 7 of the Law; request that rectification/erasure be notified to the third parties to whom the data was transferred; object to an adverse result arising from analysis solely by automated systems; and claim compensation for damage suffered due to unlawful processing.

11. How to apply

You can submit requests regarding the rights above, in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller: by a signed written petition delivered in person or via a notary to the address above; or via registered electronic mail (KEP), secure electronic signature, mobile signature, or an email address you have previously notified to us and which is registered in our system, sent to info@arpanet.tr.

Your application must include your name and surname (and signature for a written application), your Turkish ID number (for foreigners, nationality and passport/ID number), your address for notification, any email/telephone for notification, and the subject of your request. Your request is concluded as soon as possible and within thirty (30) days at the latest; it is free of charge unless it additionally entails a cost, in which case a fee from the tariff determined by the Board may be charged. If your application is refused or found insufficient, you may lodge a complaint with the Personal Data Protection Board.

12. Changes and effect

We may update this clarification notice in line with developments in legislation and changes in our processes. The version dated above is the one in effect, and the current text is published on this page.

Annex: summary of the categories of personal data processed