Data controller
Your personal data is processed by KARAT Bilişim Teknolojileri San. ve Tic. A.Ş. (“KARAT”) as data controller, in accordance with the Turkish Personal Data Protection Law No. 6698 (the “Law”) and related legislation.
- Legal name: KARAT Bilişim Teknolojileri San. ve Tic. A.Ş.
- Address: Arel Üniversitesi Teknoloji Merkezi, La Quinta by Wyndham Istanbul Gunesli, 15 Temmuz Mah. Bahar Cd. No:61, 34212 Bağcılar / İstanbul, Türkiye
- Email: [email protected]
- Phone: +90 535 795 49 41
This notice covers people who visit karat-as.com, fill in the contact form, or contact us by email, phone or WhatsApp.
Personal data we process
- Identity data: your first and last name.
- Contact data: your email address, phone number and the name of the company you work for.
- Enquiry data: the topic you select and the information you choose to share in your message.
- Transaction security data: server records such as IP address, date and time of visit, and browser and device information.
Please do not include special categories of personal data, such as health, religion or political opinion, in your message. We do not need such data.
Purposes of processing
- Receiving, assessing and responding to the questions, requests and proposals you send us.
- Conducting quotation, cooperation and pre-contract discussions.
- Managing relationships with clients and business partners.
- Keeping the website secure and preventing misuse and unsolicited submissions.
- Fulfilling our legal obligations and protecting our rights in potential disputes.
We do not use your personal data for any other purpose. We do not send you promotional or marketing messages unless you have given your consent.
Collection method and legal grounds
Your personal data is collected directly from you through the contact form on our website, by email, by phone and via WhatsApp. Server records are created automatically by electronic means during your visit.
This data is processed on the following legal grounds set out in Article 5(2) of the Law:
- Processing is directly related to the establishment or performance of a contract (Art. 5/2-c).
- Processing is necessary for the data controller to fulfil a legal obligation (Art. 5/2-ç).
- Processing is necessary for the establishment, exercise or protection of a right (Art. 5/2-e).
- Processing is necessary for the legitimate interests of the data controller, provided that your fundamental rights and freedoms are not harmed (Art. 5/2-f).
Transfers of personal data
Limited to the purposes above and in accordance with Articles 8 and 9 of the Law, your personal data may be transferred to:
- Suppliers that provide us with website hosting, email and information technology services.
- To the extent relevant to your enquiry, our group company KARAT Technology Ltd, established in the United Kingdom, and the business partners we work with to deliver the service.
- Authorised public institutions and judicial authorities, within the scope of our legal obligations.
Where a transfer abroad is required, it is carried out in accordance with the conditions set out in Article 9 of the Law. If you contact us via WhatsApp, your messages are also subject to WhatsApp’s own terms and privacy policy.
We do not sell your personal data to third parties or share it for advertising purposes.
Retention period
We keep your personal data for as long as the purpose of processing requires:
- Contact form and correspondence records: 2 years from the conclusion of your enquiry.
- Where a contractual relationship is established: for the retention periods set out in the relevant legislation. For commercial books and records this period is 10 years.
- Server records: up to 2 years.
At the end of the period your data is erased, destroyed or anonymised.
Cookies
Our website uses only one session cookie, which is strictly necessary for the contact form to work securely. This cookie is created only on the contact page, is not used to identify you, and is deleted when you close your browser.
We do not use analytics, advertising or tracking cookies. All site files, including fonts, are loaded from our own server; no data is sent to third-party servers.
Your rights
Under Article 11 of the Law, you may contact us to exercise the following rights:
- To learn whether your personal data is processed.
- To request information if your personal data has been processed.
- To learn the purpose of processing and whether the data is used in line with that purpose.
- To know the third parties, in Türkiye or abroad, to whom your personal data is transferred.
- To request correction of your personal data if it is incomplete or inaccurate.
- To request erasure or destruction of your personal data under the conditions set out in Article 7 of the Law.
- To request that correction, erasure and destruction be notified to the third parties to whom your data was transferred.
- To object to a result against you arising from the analysis of your data exclusively by automated systems.
- To claim compensation if you suffer damage because your personal data was processed unlawfully.
How to apply
You may submit requests regarding your rights by the following means, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- In writing: to Arel Üniversitesi Teknoloji Merkezi, La Quinta by Wyndham Istanbul Gunesli, 15 Temmuz Mah. Bahar Cd. No:61, 34212 Bağcılar / İstanbul, Türkiye, in person or through a notary, together with documents verifying your identity.
- By email: to [email protected], using a secure electronic signature or mobile signature, or from the email address you previously provided to us and which is held in our records.
Your application must include your first and last name, your Turkish identity number (nationality and passport number for foreign nationals), your address for notifications, your email address and phone number if any, and the subject of your request. Written applications must also be signed.
We conclude your request free of charge as soon as possible and within 30 days at the latest, depending on its nature. If the process requires an additional cost, the fee set by the Personal Data Protection Board may be charged.
If your application is rejected, you find the response insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning the response and in any case within 60 days of the application date.
Changes
This notice may be updated in line with changes in legislation and in our practices. The current version is always published on this page. In case of any discrepancy between the Turkish and English versions, the Turkish version prevails.