KVKK Disclosure Notice

Data Controller

As Korsis Teknoloji A.Ş., acting as data controller within the scope of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), we process your personal data in accordance with the law and the principles of honesty, accurately and up-to-date, for specific, explicit and legitimate purposes, in a manner connected, limited and proportionate to the processing purpose. Company Name: Korsis Teknoloji A.Ş. Address: Ankara, Turkey Email: info@korsisteknoloji.com

Personal Data Processed and Categories

• Identity Information: First name, last name
• Contact Information: Email address, phone number
• Transaction Security Information: IP address, browser information, access date and time, session data
• Usage Data: Pages visited, click behavior, interactions on the site
• Communication Content: Message content submitted through the contact form

Purposes of Processing Personal Data

• Conducting communication activities and responding to your requests
• Ensuring and improving the operation of the website
• Conducting information security processes
• Fulfilling legal obligations (including Law No. 5651)
• Providing information about our services (with your explicit consent)
• Conducting statistical analyses (with anonymized data)

Method and Legal Basis for Collection

Your personal data is collected automatically through cookies and server logs during your website visits, and partially automatically through the contact form. Legal bases: • KVKK Art. 5/2(a): Explicitly stipulated by law (Law No. 5651 obligations) • KVKK Art. 5/2(c): Directly related to the establishment or performance of a contract • KVKK Art. 5/2(ç): Necessary for the data controller to fulfill its legal obligation • KVKK Art. 5/2(f): Necessary for the legitimate interests of the data controller • KVKK Art. 5/1: Explicit consent of the data subject (for marketing communications)

Transfer of Personal Data

• To competent public authorities within the scope of legal obligations
• To business partners and suppliers from whom we receive services (server hosting, email services)
• To lawyers and legal advisors for the conduct of legal proceedings
• Transfer of data abroad is carried out in compliance with Article 9 of the KVKK and with the necessary security measures in place

Retention Period

Your personal data is retained for as long as the processing purpose requires. Contact form data is retained for a maximum of 2 years, server logs for a minimum of 2 years (as required by Law No. 5651), and cookie data for the session duration or a maximum of 13 months depending on the cookie type. Upon expiration of the retention period, personal data is deleted, destroyed, or anonymized.

Data Subject Rights (KVKK Art. 11)

• Request information on whether your personal data has been processed
• Request information about the processing if it has been processed
• Learn the purpose of processing and whether data is used in accordance with its purpose
• Know the third parties to whom your personal data has been transferred domestically or abroad
• Request correction of incomplete or inaccurate personal data
• Request deletion or destruction of personal data under the conditions of KVKK Art. 7
• Request notification of correction and deletion operations to third parties to whom data has been transferred
• Object to any adverse result arising from the analysis of processed data exclusively through automated systems
• Claim compensation for damages arising from the unlawful processing of personal data

How to Submit a Request

To exercise the above-mentioned rights, you may submit your petition containing your identifying information and request to info@korsisteknoloji.com with a secure electronic signature or in wet-ink form to our company address, or through other methods determined by the Personal Data Protection Board. Your request will be concluded free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request. If the process requires additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.