Personal Data Protection Notice (KVKK)

1. Data controller

Your personal data is processed by [ŞİRKET UNVANI] ("Puki") as data controller, within the scope described below.

Legal name

[ŞİRKET UNVANI]

Address

[AÇIK ADRES]

MERSIS No

[MERSİS NO]

Email

[email protected]

Registered email (KEP)

[KEP ADRESİ]

2. Personal data we process

• Identity: first and last name.
• Contact: email address; any contact details you share if you write to us by email.
• Customer transaction: company name, project type, budget range, preferred start date and the content of your message.
• Transaction security: server logs such as IP address, browser and device information, and date and time of access.

Our form does not ask for special categories of personal data (health, biometric data, religious belief, etc.). Please do not include such information in your message.

3. Purposes of processing

• Responding to your project request and preparing a scope and timeline proposal.
• Conducting pre-contract discussions and communicating with you.
• Keeping the website secure and preventing abuse and spam.
• Fulfilling legal obligations and responding to requests from competent authorities.
• Protecting our legal rights in case of disputes.

4. Collection method and legal bases

Your personal data is collected electronically through the project form on our website, by email and in meetings, and partly by automated means in the case of server logs.

It is processed on the following legal bases under Article 5(2) of the KVKK:

• (c) It is directly related to the establishment or performance of a contract — responding to your request and preparing a proposal.
• (ç) It is necessary for the data controller to comply with a legal obligation.
• (e) It is necessary for the establishment, exercise or protection of a right.
• (f) It is necessary for the legitimate interests of the data controller, provided it does not harm your fundamental rights and freedoms — website security and record keeping.

We do not carry out any processing based on explicit consent. If we ever wish to send you promotional or marketing messages, we will do so only after obtaining your separate approval as required by law.

5. Transfer of personal data

Limited to the purposes above and in line with Articles 8 and 9 of the KVKK, your personal data may be transferred to:

• Providers we use for website hosting and email delivery ([BARINDIRMA SAĞLAYICISI], [E-POSTA HİZMET SAĞLAYICISI]).
• Our legal, financial and technical advisers.
• Competent public authorities and courts, upon request.

Where a provider's servers are located outside Turkey, the transfer is based on an adequacy decision, appropriate safeguards (such as the standard contract published by the Personal Data Protection Board) or another condition set out in Article 9 of the KVKK. Your personal data is never sold or shared with third parties for advertising.

6. Retention period

Your personal data is kept for as long as the purpose of processing requires and for the limitation and retention periods set by applicable law.

• Requests that do not become projects: 2 (two) years from the conclusion of the request.
• Requests that become contracts: for the term of the contract and the retention periods required by law.
• Server logs: for as long as needed for security purposes, subject to statutory periods.

When the period ends, the data is erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

7. Your rights under Article 11 of the KVKK

By applying to the data controller, you have the right to:

• Learn whether your personal data is processed;
• Request information if it has been processed;
• Learn the purpose of processing and whether it is used in line with that purpose;
• Know the third parties in Turkey or abroad to whom it has been transferred;
• Request correction if it is incomplete or inaccurate;
• Request erasure or destruction under the conditions of Article 7 of the KVKK;
• Request that third parties to whom the data was transferred be notified of any correction, erasure or destruction;
• Object to a result against you arising exclusively from automated analysis of the processed data;
• Claim compensation if you suffer damage due to unlawful processing.

8. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request in one of the following ways:

• A signed written petition delivered in person or through a notary to [AÇIK ADRES];
• Registered electronic mail (KEP) to [KEP ADRESİ];
• An email signed with a secure electronic or mobile signature, or sent from an email address you have previously provided to us and that is registered in our systems, to [email protected].

Your application must include your name, surname and signature (if written); Turkish ID number (or nationality and passport number for foreign nationals); residential or business address for notification; email address, phone or fax number if any; and the subject of your request.

We will conclude your application free of charge as soon as possible and within 30 (thirty) days at the latest. If the process requires an additional cost, the fee set by the Personal Data Protection Board may be charged. If your application is rejected, you find the response insufficient, or we do not respond in time, you may file a complaint with the Board under Article 14 of the KVKK.