KVKK Privacy Notice

1. Data controller

Your personal data is processed by Sorex as data controller, within the scope described below.

Contact: info@sorexdigital.com

[registered trade name, tax office/number and registered address to be added here]

2. Personal data we process

If you complete the quote or contact form on our site, the following data is processed:

• Identity data: your first and last name
• Contact data: your email address and phone number
• Customer transaction data: your company name, your website address if provided, the subject of your request and anything you write in the form
• Transaction security data: for every visitor, the IP address, the time of the request and the address requested (only in server and security logs, for the period in section 8)

3. Purposes of processing

Your personal data is processed for the following purposes:

• Assessing your request and replying to you
• Preparing and sending a quote for our services
• Establishing and performing a contract if the process moves forward
• Answering questions and requests addressed to us
• Measuring and improving how the site is used (see section 5)
• Protecting the site and its forms against attacks and fake or bulk submissions
• Fulfilling our legal obligations

4. Method of collection and legal basis

Your personal data is collected electronically, only when you complete a form on our site or email us directly. Site usage statistics are collected automatically from records your browser sends while you browse (section 5).

It is processed on the following legal grounds set out in Article 5(2) of the Law:

• 5/2-c: Processing of personal data of parties to a contract is necessary, provided it is directly related to the establishment or performance of that contract
• 5/2-ç: Processing is mandatory for the data controller to fulfil a legal obligation
• 5/2-f: Processing is necessary for the legitimate interests of the data controller, provided it does not harm your fundamental rights and freedoms

5. Site usage statistics

When you browse the site, we keep usage statistics that contain neither your name nor your contact details, so we can see which parts of the site are useful. The system is our own and runs on our own server; no third-party analytics tool is used.

Your IP address is not written to these records. It is held briefly in server memory to prevent abuse; if a request shows signs of abuse (for example many form submissions from the same address in a short time), the IP address is written to a separate security log, kept for at most 30 days and never combined with these statistics. The records are not matched to your identity, not combined with your behaviour on other sites, and not transferred to anyone.

If Do Not Track or Global Privacy Control is switched on in your browser, nothing is sent.

Purpose: measuring and improving how the site is used. Legal basis: Article 5(2)(f) of the Law, legitimate interest. Retention: 12 months, after which the records are deleted automatically.

[legal review: whether legitimate interest is a sufficient basis, and whether explicit consent is required under the Board's cookie guidelines, to be assessed]

What is recorded:

• Pages visited, time spent on each page and how far down the page you scrolled
• Links and buttons clicked; which step of the quote form was reached and which option was picked in multiple-choice questions (anything you type, your name, email and phone are not included)
• The domain of the site you came from (e.g. google.com) and campaign tags in the link
• Device type (desktop, tablet, mobile), browser and operating system type, page language
• A random visit ID tied to your browser tab, so these records can be grouped. It is kept in your browser's session storage and deleted when you close the tab.

6. Transfer of personal data

Your personal data is never sold, rented or transferred to third parties for marketing purposes.

It may be transferred only to the extent necessary to deliver the service, to the following recipient groups:

• Our email delivery provider: so that the content of your form reaches us
• Our hosting provider: so that the site can run
• Authorised public institutions: where a legal obligation arises, limited to what is requested

7. Transfer abroad

The servers of our email delivery provider may be located outside Türkiye. In that case your personal data may be transferred abroad in accordance with Article 9 of the Law.

[provider, server location and the transfer condition relied upon to be stated here]

8. Retention period

Your personal data is kept for as long as necessary for the purpose it was processed for.

If your request does not turn into a contract, your data is deleted or destroyed within 2 years at the latest. If a contract is established, the retention and limitation periods set out in the applicable legislation apply.

Site usage statistics are deleted automatically after 12 months.

Transaction security data (server and security logs) is kept for at most 30 days and then deleted automatically. Legal basis: Article 5(2)(f) of the Law, legitimate interest.

9. Your rights as a data subject

Under Article 11 of the Law, you may apply to us as data controller to exercise the following rights:

• To learn whether your personal data is processed
• To request information if your personal data has been processed
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties in Türkiye or abroad to whom your data has been transferred
• To request correction of incomplete or inaccurate personal data
• To request deletion or destruction of personal data under the conditions in Article 7 of the Law
• To request that correction, deletion and destruction be notified to the third parties to whom the data was transferred
• To object to an outcome against you arising from analysis of the processed data solely by automated systems
• To claim compensation if you suffer loss due to unlawful processing of your personal data

10. How to apply

You can send requests relating to your rights to info@sorexdigital.com, in accordance with the Communiqué on Procedures and Principles of Application to the Data Controller.

Your application should clearly state your name, your contact details for the reply, and the subject of your request.

Your request will be concluded as soon as possible and within thirty days at the latest. If the process incurs a cost, the fee in the tariff set by the Board may be charged.