KVKK Privacy Notice

1. Identity of the Data Controller

Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), CyberendX Technology Inc. ("CyberendX") is the data controller. This notice has been prepared in accordance with KVKK Article 10 and the Communiqué on Principles and Procedures Regarding the Fulfilment of the Disclosure Obligation.

2. Categories of Personal Data Processed

• Identity: full name, job title.
• Contact: business email, phone, address.
• Customer Transaction: subscription details, request and complaint records, invoice data.
• Transaction Security: user ID, IP address, log records, cookie preferences.
• Marketing: newsletter and event preferences, message content submitted via forms.

3. Processing Purposes

• Establishing, maintaining and terminating the contractual relationship.
• Delivering products and services and operating customer support.
• Conducting finance and accounting activities, issuing invoices.
• Operating information-security processes, preventing fraud and abuse.
• Providing information to authorised public bodies as required by KVKK and applicable law.
• Sending marketing communications where explicit consent has been given.

4. Legal Bases

Your personal data is processed under KVKK Article 5/2 based on the following grounds:

• Necessity for the establishment or performance of a contract (Art. 5/2-c).
• Compliance with a legal obligation (Art. 5/2-a).
• Legitimate interest of the data controller (Art. 5/2-f).
• Explicit consent (Art. 5/1) — only for marketing communications and optional analytics.

5. Collection Method

We collect your personal data through forms on our website, email correspondence, phone calls, usage records in the customer portal and contractual channels — provided directly by you or your authorised representatives, by automated and non-automated means.

6. Transfers

Your personal data may be transferred only to the extent required by the processing purposes and in accordance with KVKK Articles 8 and 9 to the following parties:

• Authorised public bodies, courts and regulators.
• Sub-processors strictly required for service delivery (cloud infrastructure, payment and email providers).
• Professional firms providing independent audit, legal and advisory services.

Cross-border transfers are based on explicit consent or adequate safeguards under KVKK Article 9; the current sub-processor list is available on request.

7. Retention Period

Personal data is retained for the duration required by statutory retention obligations (Turkish Commercial Code, tax law), contractual evidence obligations, and the relevant processing purposes. After this period it is deleted, destroyed or anonymised in accordance with KVKK Article 7.

8. Data Subject Rights (KVKK Article 11)

As a data subject you have the following rights:

• To learn whether your personal data is being processed.
• To request information on processed data.
• To learn the purpose of processing and whether the data is used accordingly.
• To know the third parties to whom data is transferred domestically or abroad.
• To request rectification of incomplete or inaccurate data.
• To request erasure or destruction under KVKK Article 7.
• To request that any rectification or erasure be notified to third parties to whom data was transferred.
• To object to outcomes resulting solely from automated analysis.
• To claim damages arising from unlawful processing.

9. How to Apply

You may exercise the above rights in accordance with the Communiqué on Application Procedures to the Data Controller by writing to [email protected]. We respond to your application free of charge within 30 (thirty) days under KVKK Article 13; if processing requires additional cost, the tariff set by the Personal Data Protection Authority applies.

If your application is rejected or you find the response insufficient, you may lodge a complaint with the Personal Data Protection Authority (www.kvkk.gov.tr).

10. Contact

For all KVKK-related questions and requests, contact [email protected].