Data Protection Notice (KVKK)

1. Identity of the Data Controller

Under the Law, the data controller is Hülagühan Labs Yazılım Teknolojileri Ltd. Şti., whose details are set out below:

• Location: İstanbul / Türkiye
• Email: kvkk@hulaguhanlabs.com.tr

2. Scope and Categories of Data Subjects

This notice covers the following categories of data subjects:

• Website visitors
• Prospective clients and those requesting proposals
• Client representatives and employees
• Supplier and business partner representatives
• Candidates who submit job applications

3. Categories of Personal Data Processed

• Identity: First name, last name
• Contact: Email address, company details
• Customer transaction: Records of requests and complaints, proposal and contract information
• Transaction security: IP address, access logs, browser and device information
• Professional experience: CV, education and work experience details (job applications only)
• Marketing: Cookie preferences and site usage statistics (only where explicit consent exists)

4. Purposes of Processing

Your personal data is processed for the following purposes:

• Conducting communication activities and responding to requests
• Preparing proposals and managing contractual processes
• Managing the sale of goods and services and after-sales support processes
• Carrying out finance, accounting and invoicing operations
• Managing information security processes and preventing abuse
• Providing information to authorised persons, institutions and organisations
• Carrying out retention and archiving activities
• Managing candidate selection and placement processes
• Where you give explicit consent: sending commercial electronic messages and carrying out analytics measurement

5. Legal Bases (KVKK Art. 5)

• Art. 5/2-c: Directly related to the establishment or performance of a contract
• Art. 5/2-ç: Necessary for the data controller to fulfil its legal obligation
• Art. 5/2-e: Processing is necessary for the establishment, exercise or protection of a right
• Art. 5/2-f: Necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject
• Art. 5/1: Your explicit consent (for commercial electronic messages and analytics cookies)

6. Method of Collection

Your personal data is collected by partly automated and non-automated means, through the contact form on our website, email, telephone, contractual processes and automatically operating server logging systems.

7. Transfer of Personal Data

In accordance with the conditions set out in KVKK Arts. 8 and 9, your data may be transferred to our hosting and infrastructure service providers, our email service providers, our accounting and legal advisers, and to authorised public institutions and organisations within the scope of requests arising from legislation.

Where a transfer abroad is involved, it is carried out on the basis of the appropriate safeguards set out in KVKK Art. 9 (a country with adequate protection, standard contractual clauses, or explicit consent). We do not sell or transfer your personal data to third parties for marketing purposes.

8. Retention Periods

Data is retained for as long as the processing purpose requires, taking into account the limitation periods set out in the relevant legislation. At the end of that period it is deleted, destroyed or anonymised in accordance with our Personal Data Retention and Destruction Policy. Category-based periods are set out in detail in section 4 of the Privacy Policy.

9. Rights of the Data Subject (KVKK Art. 11)

As a data subject you have the following rights:

• To learn whether your personal data is being processed
• To request information if it has been processed
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties in Türkiye or abroad to whom the data has been transferred
• To request rectification where the data has been processed incompletely or inaccurately
• To request erasure or destruction within the framework of Article 7 of the Law
• To request that rectification, erasure and destruction be notified to the third parties to whom the data was transferred
• To object to a result to your detriment arising from analysis carried out exclusively by automated systems
• To claim compensation if you suffer damage due to unlawful processing

10. Application Procedure

You can submit requests concerning your rights in the following ways, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• From the email address registered in our system, to kvkk@hulaguhanlabs.com.tr
• By sending an application form signed with a secure electronic signature or mobile signature to the same email address

Your application must clearly state your name and surname, your Turkish ID number (nationality and passport number for foreign nationals), the email address to be used for notification, and the subject of your request.

Depending on its nature, your request is concluded free of charge as soon as possible and within thirty (30) days at the latest. If the process entails an additional cost, the fee set out in the tariff determined by the Board may be charged. If your application is rejected or you find the response inadequate, you can lodge a complaint with the Turkish Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the application date.

11. Data Subjects Covered by the GDPR

Data subjects located in the European Economic Area have the rights of access, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection to processing and withdrawal of consent under the GDPR. These rights can be exercised through the same application channels. The right of data subjects to lodge a complaint with the supervisory authority in their country of residence is reserved.