Privacy Policy

1. Data Controller

CyberendX Technology Inc. ("CyberendX", "we") is responsible for the data processing activities described in this policy. CyberendX acts as data controller under both the Turkish Personal Data Protection Law (KVKK No. 6698) and the EU General Data Protection Regulation (GDPR).

Data protection contact: [email protected]

2. Categories of Personal Data

• Identity and contact data (full name, business email, phone, job title)
• Customer account data (user ID, role, session logs)
• Contractual and financial data (billing address, tax ID, payment method metadata)
• Technical data (IP address, device fingerprint, log records, telemetry)
• Marketing preferences (newsletter subscription, event registration, cookie consents)

Security telemetry related to our customers' end-users (process inventory, file hashes, network events) is processed on behalf of the customer; for that data the customer is the controller and CyberendX is the processor. A separate Data Processing Agreement (DPA) governs that relationship.

3. Purposes and Legal Bases

• Performance of a contract: Service delivery, account management, billing, technical support (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)).
• Legitimate interest: Platform security, fraud prevention, service improvement (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)).
• Legal obligation: Tax law, commercial retention, regulatory audit obligations (KVKK Art. 5/2-a, GDPR Art. 6(1)(c)).
• Explicit consent: Marketing communications, optional analytics cookies (KVKK Art. 5/1, GDPR Art. 6(1)(a)).

4. Rights of Data Subjects

Under KVKK Article 11 and GDPR Articles 15-22 you have the following rights: to know whether your data is being processed, to access and obtain a copy, to rectify, to erase or anonymise, to object to processing, to data portability, to opt out of automated decision-making, and to lodge a complaint with the supervisory authority.

To exercise these rights, please contact [email protected]. Our response time is up to 30 days under KVKK and up to 1 month under GDPR.

5. Data Transfers

CyberendX transfers personal data only to sub-processors strictly necessary for service delivery (cloud infrastructure, payment processors, email providers). All sub-processors are bound by data processing agreements (DPA); the current list is available on request. Cross-border transfers rely on the EU Standard Contractual Clauses (SCC) where required by GDPR, and on adequate safeguards under KVKK.

6. Retention Period

Contractual data is retained for the statutory retention period (10 years under the Turkish Commercial Code where applicable), account and usage logs for the account lifecycle plus 12 months, and marketing data until consent is withdrawn. After the retention period data is securely deleted or anonymised.

7. Security Measures

CyberendX applies technical and organisational measures aligned with ISO 27001 and SOC 2 Type II controls: TLS 1.3 for data in transit, AES-256 for data at rest, role-based access control (RBAC), one-way hashed password storage, multi-factor authentication, regular penetration testing and continuous security monitoring. Our incident response process commits to notify supervisory authorities within 72 hours of a confirmed breach.

8. Cookies

CyberendX uses only functional cookies (session, language preference) by default. We do not use analytics or marketing cookies and we do not load third-party tracking scripts. You can change cookie preferences in your browser settings at any time.

9. Policy Updates

This policy may be revised due to regulatory changes or service updates. Material changes will be communicated to account holders by email and the "Last updated" date at the top of this page will be refreshed.

10. Contact

Reach our Data Protection Officer (DPO) at [email protected].