KVKK (Turkish Data Protection Law) Notice

This notice has been prepared to inform you, as the data controller, about how Carbonaz processes your personal data under the Turkish Personal Data Protection Law No. 6698 ("KVKK").

1. Identity of the Data Controller

Under the KVKK, the data controller is Carbonaz. Contact details:

• Email: [email protected]
• Head Office: Ataşehir, İstanbul
• R&D Office: Zonguldak Teknopark

2. Personal Data Processed

As Carbonaz, we process the following personal data:

2.1 Identity Data

• First and last name
• Position / title
• Company information

2.2 Contact Data

• Email address
• Phone number (optional)

2.3 Message Content Data

• Message content submitted through the contact form
• Subject / request type

2.4 Transaction Security Data

• IP address
• Browser information
• Operating system information
• Browsing information on the site (analytics)

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Evaluating requests submitted through the contact form
• Establishing contact for demos and service offerings
• Customer relationship management
• Providing information about our services
• Fulfilling legal obligations
• Ensuring the operation and security of the website
• Conducting statistical and analytical work

4. Legal Grounds for Processing Personal Data

Your personal data is processed based on the following legal grounds set out in Article 5 of the KVKK:

• Your explicit consent
• Being directly related to the conclusion or performance of a contract
• Being mandatory for the data controller to fulfil its legal obligations
• Being mandatory for the establishment, exercise or protection of a right
• Being mandatory for the legitimate interests of the data controller

5. Method of Collecting Personal Data

Your personal data is collected through the following means:

• Completing the contact form on the website
• Through cookies during your visit to the website
• Establishing contact by email
• Phone calls (where provided by you)
• In-person meetings (where provided by you)

6. Transfer of Personal Data

Your personal data may be transferred to the following parties to fulfil the purposes stated above:

• EU GDPR-compliant cloud infrastructure providers we work with
• Email service providers (solely for communication purposes)
• Customer relationship management (CRM) systems
• Authorized public institutions and organizations where legally required

If your data is transferred abroad, such transfers are carried out with appropriate technical and administrative measures under the KVKK.

7. Retention Period of Personal Data

Your personal data is retained for as long as required by the processing purposes and for the periods stipulated in the relevant legislation. At the end of this period, your personal data is deleted, destroyed or anonymized.

8. Rights of the Data Subject (KVKK Article 11)

Pursuant to Article 11 of the KVKK, you may exercise the following rights by applying to the data controller:

• To learn whether your personal data is processed
• To request information if it has been processed
• To learn the purpose of processing and whether it is used in accordance with that purpose
• To know the third parties to whom it is transferred domestically or abroad
• To request correction if it has been processed incompletely or inaccurately
• To request its deletion or destruction within the conditions stipulated in the KVKK
• To request notification of correction, deletion or destruction to third parties to whom the data was transferred
• To object to a result against you arising from analysis by automated systems
• To request compensation if you suffer damage due to unlawful processing

9. Application Method

To exercise your rights under the KVKK, you may submit a written application to [email protected]. Your application must clearly state your request and include documents identifying you. Your request will be concluded within 30 days at the latest.