Back to HomePersonal Data Processing Notice

Personal Data Protection and Privacy Policy

SİBERLOCK SİBER GÜVENLİK VE DANIŞMANLIK HİZMETLERİ LİMİTED ŞİRKETİ

Last updated: 12 October 2026

Turkish reference text

1. INTRODUCTION

As SİBERLOCK SİBER GÜVENLİK VE DANIŞMANLIK HİZMETLERİ LİMİTED ŞİRKETİ (SİBERLOCK), since the date on which the Personal Data Protection Law No. 6698 ("KVKK" or the "Law") entered into force, we have attached great importance to protecting the personal data of all natural persons with whom we come into contact in any way while conducting our commercial activities, and to fully fulfilling the requirements of the KVKK in this respect. This Personal Data Protection and Privacy Policy (the "Policy") has been prepared to inform you about the processes and principles governing the recording, collection, use, sharing and storage of personal data by SİBERLOCK. This Policy sets out the principles governing the processing of data subjects' personal data by SİBERLOCK in the order in which they are regulated in the KVKK, and these explanations cover our SİBERLOCK employees and our active and prospective customers, whether natural or legal persons.

2. PROCEDURES AND PRINCIPLES FOR THE PROTECTION OF PERSONAL DATA

A. DEFINITIONS

The definitions of the terms and abbreviations used in this Privacy Policy are set out below.

Data Subject

This means the natural person whose personal data is processed. Under the KVKK, only the data of natural persons falls within the scope of the Law. The data of legal persons does not fall within the scope of this Law unless it contains information relating to a natural person.

Personal Data

Personal data means any information relating to an identified or identifiable natural person. For information to qualify as personal data, it must relate to a natural person, and that person must be identified or identifiable. The concept of personal data encompasses all information relating to a person, provided that the person is identified or identifiable. In this context, personal data includes not only information that directly reveals an individual's identity, such as their first name, surname, date of birth and place of birth, but also all data that makes a person directly or indirectly identifiable, such as telephone numbers, vehicle registration plates, social security numbers, passport numbers, CVs, photographs, video and audio recordings, fingerprints, genetic information, IP addresses, email addresses, hobbies, preferences, persons with whom they interact, group memberships and family information.

Special Categories of Personal Data

Special categories of personal data are data relating to a person's race, ethnic origin, political opinions, philosophical beliefs, religion, religious denomination or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sex life, criminal convictions and security measures, as well as biometric and genetic data.

Explicit Consent

This means consent that relates to a specific matter, is based on information and is expressed freely. A declaration of explicit consent is not subject to any formal requirement. What matters is that explicit consent contains the elements specified in the Law and can be demonstrated. Accordingly, explicit consent may be obtained orally, in writing, electronically or by similar means. However, where explicit consent is given in writing, the consent texts must be drafted clearly, understandably and simply. Explicit consent must also contain an affirmative expression of will.

Data Controller

This means the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. Such persons may be natural persons or legal persons such as public institutions, companies, associations or foundations. The data controller is the person who determines why and how the processing activity will be carried out.

Data Processor

This means the natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the latter. The activities of the data processor are largely limited to the technical aspects of data processing. What matters here is that the data processor carries out personal data processing activities within this scope in accordance with the instructions received from the data controller.

Obligation to Inform

Under the obligation to inform, the data controller or the person authorised by it must inform the data subject of the identity of the data controller and its representative, if any, the purpose of processing, the persons to whom the processed data may be transferred and the purposes of such transfer, the method and legal grounds for collecting data, and the other rights listed in Article 11 of the Law. Fulfilment of the obligation to inform is not subject to the data subject's approval.

Personal Data Processing (Retention and Destruction) Policy

This means the policy on which data controllers base the determination of the maximum period necessary for the purposes for which personal data is processed, and the procedures for erasure, destruction and anonymisation.

Personal Data Processing Inventory

This means the inventory that data controllers prepare by associating the personal data processing activities they carry out as part of their business processes with the purposes of processing personal data, the data category, the recipient group to which the data is transferred and the group of data subjects concerned, and that they elaborate by specifying the maximum period necessary for the purposes for which personal data is processed, the personal data envisaged to be transferred to foreign countries and the measures taken regarding data security.

Application Form

This is the document that enables data subjects to learn whether their personal data is processed; request information if their personal data has been processed; learn the purpose of processing their personal data and whether it is used in accordance with that purpose; know the third parties to whom their personal data is transferred within the country or abroad; request rectification if their personal data has been processed incompletely or inaccurately; request erasure or destruction of their personal data; request that operations such as rectification, erasure and destruction be notified to the third parties to whom their personal data has been transferred; object to a result arising against them through the analysis of processed data exclusively by automated systems; and request compensation for damage suffered as a result of the unlawful processing of their personal data.

B. GENERAL PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA

SİBERLOCK processes personal data in accordance with the procedures and principles set out in the KVKK and other applicable laws. Accordingly, SİBERLOCK fully complies with the following principles set out in the KVKK when processing personal data.

Compliance with the law and the rules of good faith:

Under this principle, SİBERLOCK's data processing procedures are carried out within the limits required by all applicable legislation, particularly the Constitution of the Republic of Türkiye and the KVKK, and by the principle of good faith.

Accuracy and being up to date where necessary:

The measures necessary to ensure that the personal data processed by SİBERLOCK is accurate and up to date are taken, and data subjects are informed and provided with the necessary opportunities to ensure that the data being processed reflects the actual situation.

Processing for specified, explicit and legitimate purposes:

SİBERLOCK processes personal data solely for legitimate purposes that are clearly and precisely defined, and does not engage in data processing outside those purposes. In this context, SİBERLOCK processes personal data only in connection with the relationship established with data subjects and where necessary.

Being relevant, limited and proportionate to the purposes for which the data is processed:

In accordance with the KVKK and other applicable legislation, SİBERLOCK processes data in a manner that is suitable for achieving the purposes determined according to the data categories, relevant to achieving those purposes and proportionate, and avoids processing personal data that is not needed.

Retention for the period prescribed by applicable legislation or necessary for the purposes for which the data is processed:

Personal data processed by SİBERLOCK is retained only for the period prescribed by applicable legislation or necessary for the purposes for which it is processed. In this context, where applicable legislation prescribes a retention period, SİBERLOCK complies with that period; where no such period exists, it retains data only for as long as necessary for the purposes for which it is processed.

C. CONDITIONS FOR PROCESSING PERSONAL DATA

SİBERLOCK processes personal data in accordance with the conditions specified below: except for the exceptions listed in the KVKK, SİBERLOCK processes personal data only by obtaining the explicit consent of data subjects. Where any of the following circumstances listed in the KVKK exists, personal data may be processed even without the explicit consent of the data subject:

  • It is expressly provided for by law,
  • It is necessary to protect the life or physical integrity of a person who is unable to express consent due to practical impossibility or whose consent is not legally valid, or of another person,
  • It is necessary to process the personal data of the parties to a contract, provided that the processing is directly related to the establishment or performance of that contract,
  • It is necessary for the data controller to fulfil a legal obligation,
  • The data has been made public by the data subject,
  • Data processing is necessary for the establishment, exercise or protection of a right,
  • Data processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.

SİBERLOCK exercises particular care when processing special categories of personal data, the protection of which is considered more critical for data subjects in various respects. In this context, subject to the adoption of adequate measures determined by the Board, such data is not processed without the explicit consent of data subjects. However, special categories of personal data other than data concerning health and sex life may also be processed without the explicit consent of the data subject in the cases provided for by law. Data concerning health and sex life may, however, be processed without obtaining the explicit consent of the data subject, provided that adequate measures are taken, for the purposes listed below and by persons subject to an obligation of confidentiality or by authorised institutions and organisations:

  • Protection of public health,
  • Preventive medicine,
  • Medical diagnosis,
  • Provision of treatment and care services,
  • Planning and management of healthcare services and their financing.

Declarations of explicit consent have been prepared for both employees and customers in respect of the data processing activities and data categories for which the data subject's explicit consent must be obtained in order for SİBERLOCK to carry out its commercial activities. In the declarations of explicit consent prepared for data subjects, in parallel with the European Union regulations on which the KVKK is based, data subjects have been given the choice of whether their personal data may be processed by SİBERLOCK and have been informed of the possible consequences if explicit consent cannot be obtained.

D. PURPOSES OF PROCESSING PERSONAL DATA

Personal data obtained by SİBERLOCK may be processed within the scope set out below:

  • Conducting job candidate application processes,
  • Conducting employee satisfaction and engagement processes,
  • Fulfilling obligations arising from employment contracts and legislation in relation to employees,
  • Conducting employee benefits and entitlements processes,
  • Conducting Information Security Processes
  • Managing Access Authorisations
  • Conducting training activities,
  • Conducting activities in compliance with legislation,
  • Conducting finance and accounting operations,
  • Ensuring the security of physical premises,
  • Conducting assignment processes,
  • Following up and handling legal matters,
  • Conducting internal audit/investigation/intelligence activities,
  • Conducting communication activities,
  • Planning human resources processes,
  • Conducting/supervising business activities,
  • Conducting occupational health/safety activities,
  • Conducting goods/services purchasing processes,
  • Conducting goods/services sales processes,
  • Conducting Risk Management Processes
  • Conducting goods/services production and operational processes,
  • Conducting customer relationship management processes,
  • Conducting advertising/campaign/promotion processes,
  • Conducting retention and archiving activities,
  • Conducting contract processes,
  • Following up requests/complaints,
  • Providing information to authorised persons, institutions and organisations,
  • Performing management activities,
  • Obtaining technical support from companies providing outsourced services,
  • Preparing various reports,
  • Providing cybersecurity consultancy and services, providing instant cybersecurity support through the artificial intelligence assistant (ASİLA), providing data recovery, device analysis and related technical services, conducting device receipt, tracking, return and chain of custody processes, and verifying the integrity and ensuring the secure delivery of recovered data. Personal data is processed solely for these purposes.

E. RETENTION OF PERSONAL DATA

Personal data obtained is securely stored in physical or electronic form for an appropriate period to enable SİBERLOCK to carry out its commercial activities. In the course of these activities, SİBERLOCK acts in accordance with the obligations concerning personal data protection set out in all applicable legislation, particularly the KVKK. Except where applicable legislation permits or requires personal data to be retained for longer, when the purposes of processing personal data cease to exist, the data will be erased, destroyed or anonymised under the SİBERLOCK Personal Data Retention and Destruction Policy prepared by SİBERLOCK in accordance with this Policy, either on its own initiative or at the request of data subjects submitted through the attached data subject application form. Where personal data is destroyed by various methods, it will be destroyed in such a way that it cannot be used again or recovered in any manner. However, where the data controller has a legitimate interest, personal data may be retained until the expiry of the general limitation period set out in the Turkish Code of Obligations, even after the purpose of processing and the periods specified in the applicable laws have ended, provided that the fundamental rights and freedoms of data subjects are not harmed. Following the expiry of that limitation period, personal data will be erased, destroyed or anonymised in accordance with the procedure described above.

F. TRANSFER OF PERSONAL DATA TO PERSONS WITHIN THE COUNTRY

SİBERLOCK carefully complies with the conditions set out in the KVKK when sharing personal data with third parties, without prejudice to the provisions of other laws. In this context, SİBERLOCK does not transfer personal data to third parties without obtaining the explicit consent of the data subject. However, personal data may also be transferred without obtaining the explicit consent of the data subject where any of the following conditions set out in the KVKK exists:

  • It is expressly provided for by law,
  • It is necessary to protect the life or physical integrity of a person who is unable to express consent due to practical impossibility or whose consent is not legally valid, or of another person,
  • It is necessary to process the personal data of the parties to a contract, provided that the processing is directly related to the establishment or performance of that contract,
  • It is necessary for the data controller to fulfil a legal obligation,
  • The data has been made public by the data subject,
  • Data processing is necessary for the establishment, exercise or protection of a right,
  • Data processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.

Provided that adequate measures are taken, personal data may be transferred without obtaining explicit consent where provided for by law in respect of special categories of personal data other than data concerning health and sex life, and, in respect of special categories of personal data concerning health and sex life, for purposes such as:

  • Protection of public health,
  • Preventive medicine,
  • Medical diagnosis,
  • Provision of treatment and care services,
  • Planning and management of healthcare services and their financing. Your personal data may be transferred for such purposes without obtaining explicit consent.

When transferring special categories of personal data, the requirements specified in the conditions for processing such data are also observed.

G. TRANSFER OF PERSONAL DATA ABROAD

In accordance with Article 9 of the KVKK, the explicit consent of the data subject is required for the transfer of personal data abroad. However, where the conditions permitting the processing of personal data, including special categories of personal data, without the data subject's explicit consent exist, SİBERLOCK may also transfer personal data abroad without seeking the explicit consent of the data subject, provided that adequate protection is available in the foreign country to which the personal data will be transferred. If the country to which the transfer will be made is not among the countries with adequate protection to be determined by the Board, SİBERLOCK and the data controller/data processor in the relevant country will undertake in writing to provide adequate protection.

H. OBLIGATION TO INFORM

Under Article 10 of the KVKK, data subjects must be informed before personal data is obtained or, at the latest, at the time it is obtained. The information that must be provided to data subjects under this obligation to inform is as follows:

  • The identity of the data controller and its representative, if any,
  • The purposes for which personal data will be processed,
  • The persons to whom processed personal data may be transferred and the purposes of such transfer,
  • The method and legal grounds for collecting personal data,
  • The other rights listed in Article 11 of the KVKK.

To fulfil its obligation to inform, SİBERLOCK has prepared and implemented information statements on the basis of each process and category of data subject.

On the other hand, under Article 28/2 of the KVKK, SİBERLOCK will have no obligation to inform in the following cases:

  • Where processing personal data is necessary for the prevention of crime or a criminal investigation,
  • Where personal data made public by the data subject is processed,
  • Where processing personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigations or proceedings, by responsible and authorised public institutions and organisations and professional organisations having the status of public institutions, on the basis of the authority granted by law,
  • Where processing personal data is necessary for the protection of the State's economic and financial interests in relation to budgetary, tax and financial matters.

I. RIGHTS OF THE DATA SUBJECT

The measures necessary to enable data subjects to exercise the rights granted to them under Article 11 of the KVKK have been taken in respect of personal data processed by SİBERLOCK in accordance with the principles set out in this Policy. These rights are as follows:

  • a) To learn whether personal data is processed,
  • b) To request information if their personal data has been processed,
  • c) To learn the purpose of processing their personal data and whether it is used in accordance with that purpose,
  • d) To know the third parties to whom personal data is transferred within the country or abroad,
  • e) To request rectification of personal data if it has been processed incompletely or inaccurately,
  • f) To request erasure or destruction of personal data under the conditions set out in Article 7 of the Law,
  • g) To request that the operations carried out pursuant to paragraphs (e) and (f) above be notified to the third parties to whom the personal data has been transferred,
  • h) To object to a result arising against them through the analysis of processed data exclusively by automated systems,
  • i) To request compensation for damage suffered as a result of the unlawful processing of personal data.

Data subjects may exercise the rights listed above by sending a copy of the data subject application form in Annex 1 to this Policy, bearing an original handwritten signature and accompanied by a photocopy of their identity document, to SİBERLOCK's address by registered mail with acknowledgement of receipt. Detailed information about completing the form and sending it to SİBERLOCK is provided in the application form in Annex 1. SİBERLOCK will deliver its response to the relevant applications to the data subject in physical or electronic form. Depending on the nature of the request, SİBERLOCK will conclude it free of charge as soon as possible and no later than thirty (30) days. However, if the procedure entails an additional cost, SİBERLOCK will charge the persons concerned the fee set out in the tariff determined by the Board. SİBERLOCK may also request additional information or documents from applicants during the process of resolving data subjects' requests.

J. MEASURES TAKEN FOR DATA SECURITY

SİBERLOCK takes all necessary technical and administrative measures to ensure the appropriate level of security required for the protection of personal data under Article 12(1) of the KVKK. The measures taken by SİBERLOCK in this context are listed below:

ADMINISTRATIVE MEASURES:

As part of its administrative measures, SİBERLOCK:

  • Has provided Company employees with the training necessary under the KVKK and raised their awareness.
  • Has established the corporate policies necessary under the KVKK.
  • Has prepared a personal data processing inventory.
  • Has prepared confidentiality undertakings.
  • Will notify the data subject and the Board as soon as possible if the personal data being processed is obtained unlawfully by others.

TECHNICAL MEASURES:

As part of SİBERLOCK's technical measures:

  • Network security and application security are ensured.
  • A closed system network is used for transfers of personal data over a network.
  • Up-to-date anti-virus systems are used.
  • Firewalls are used.
  • The security of environments containing personal data is ensured.
  • Personal data is backed up, and the security of the backed-up personal data is ensured.
  • Intrusion detection and prevention software is used.
  • Data masking measures are applied where necessary.
  • Personal data security policies and procedures are established.
  • Personal data is minimised as far as possible.
  • Protocols and procedures for the security of special categories of personal data have been established and implemented.
  • Physical environments containing personal data are secured against external risks.
  • The relevant access rights of employees who change roles or leave their employment are revoked.
  • Security measures are taken in connection with the procurement, development and maintenance of information technology systems.

K. PROCESSING OF VIDEO RECORDINGS

SİBERLOCK records images of visitors, employees and other relevant persons in accordance with the fundamental principles set out in the KVKK and this Policy for purposes such as ensuring the general and commercial security of the Company's facilities and businesses, monitoring personnel entries and exits, and conducting our Company's operational activities, and securely stores these recordings in physical or electronic form for a period appropriate to the purposes of processing. In locations where video recordings are made, a warning indicating that recording is taking place is displayed visibly to inform data subjects. In the course of these activities, SİBERLOCK acts in accordance with the obligations concerning personal data protection set out in all applicable legislation, particularly the KVKK. No recording is carried out in areas with a high expectation of privacy.

LIST OF GROUPS OF PERSONS AND INSTITUTIONS WITH WHICH PERSONAL DATA IS SHARED

  • Authorised public institutions and organisations
  • Software Companies
  • Banks
  • Revenue Administration
  • Tax Inspection Board
  • Trade Registry Directorate and Trade Registry Gazette
  • Notary Public
  • Social Security Institution
  • İşkur
  • Legal Department
  • Courts and Enforcement Offices
  • Financial Adviser and Accountant
  • Auditor
  • Google LLC (Analytics and advertising services),
  • Cloudflare Inc (bot protection and security verification services (Turnstile), content delivery network services, and derivation of country/city-level location information from visitor IP addresses),
  • FingerprintJS Inc (device fingerprinting and security services),
  • Hosting providers (website infrastructure and database services),
  • Multi-engine security scanning service providers,
  • NetGSM (SMS service provider),