Personal Data Protection Notice

1. Data controller

HIZDAN BİLGİ TEKNOLOJİLERİ VE DANIŞMANLIK HİZMETLERİ LTD. ŞTİ. — MERSİS 0463157613300001

KURTKÖY MAH. ANKARA CAD. YELKEN PLAZA NO: 289 İÇ KAPI NO: 21 PENDİK / İSTANBUL — info@hizdan.com

Website: https://hizdan.com

2. Scope

This notice covers visitors to hizdan.com and people who contact HIZDAN through the website form or corporate email. It does not purport to cover every employee, supplier, customer, industrial IoT product, or future platform activity.

3. Categories of personal data

• Name, company or organisation, email address, and optional telephone number supplied in the form.
• Selected business area, target timeline, message, and inquiry details.
• IP address, access time, request data, and security logs only to the extent actually produced by the hosting or security service.
• Cookie-consent record stored in localStorage under hizdan_cookie_consent_v1, including categories, version, creation time, and expiry.

4. Purposes and legal grounds

Data is processed to receive and answer inquiries, discuss requested services, manage business correspondence, maintain site security, prevent misuse, comply with applicable legal duties, protect legal rights, and remember cookie choices. Depending on the activity, the relevant grounds under KVKK Article 5 may be steps related to a contract, legal obligation, establishment or protection of a right, or legitimate interests balanced against individual rights. Explicit consent applies only where legally required, including future optional tracking technologies. No current marketing processing is represented.

5. Collection methods

Data is collected electronically through contact forms, email correspondence, website requests, technical security systems, and the cookie-preference interface. Form data is revalidated on the server.

6. Recipients

Contact messages are intended to pass through Gmail SMTP to HIZDAN’s hizdantech@gmail.com mailbox using Google infrastructure. Data may also be disclosed, strictly as necessary, to the verified hosting provider, authorised technical providers, competent public authorities, or professional advisers. The production hosting provider remains to be confirmed.

7. International transfers

Microsoft 365, production hosting, and support-access data locations have not yet been verified. Any transfer outside Türkiye must have an applicable mechanism under KVKK Article 9 and the current international-transfer regulation before launch. This notice does not claim that an adequacy decision, standard contract, or other safeguard is already in place.

8. Retention and deletion

Contact inquiries, correspondence, and security logs must be retained only for the period justified by their purpose, legal duties, and applicable limitation periods, then deleted, destroyed, or anonymised. The organisation-specific schedule is awaiting approval.

The browser consent record expires after 365 days unless removed or changed earlier.

9. Cookies and preferences

No analytics or advertising tracker is currently installed. The consent interface records choices in browser localStorage. Optional technologies will remain inactive unless enabled following a valid choice.

10. Your rights

• Learn whether personal data is processed and request information about it.
• Learn the processing purpose and whether data is used consistently with that purpose.
• Learn the third parties to whom data is transferred in Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction where statutory conditions apply.
• Request notification of correction, deletion, or destruction to recipients.
• Object to an adverse result produced exclusively by automated analysis.
• Claim compensation for damage caused by unlawful processing.

11. How to apply

Applications may be sent with sufficient identity and request information to KURTKÖY MAH. ANKARA CAD. YELKEN PLAZA NO: 289 İÇ KAPI NO: 21 PENDİK / İSTANBUL, or by an email method satisfying the applicable Turkish procedural rules to info@hizdan.com. Requests will be concluded as soon as possible and no later than 30 days, according to their nature.

12. Updates

This draft will be updated when processing activities or law change. An effective publication date must be recorded only after operational and legal verification. No claim is made that this document has been approved by licensed counsel.