KVKK Privacy Notice

1. Identity of the Data Controller

Article 10 of Law No. 6698 requires the controller and any representative to be identified. This repository does not yet contain a verified company or authority record connecting the Türkiye contact centre to TIREBOT.

The registered name, address, registry details and formal request channel must be added after documentary and legal approval.

2. Data Subjects and Categories

Data subjects are website visitors and individuals who voluntarily use the contact form, telephone, email or WhatsApp. The contact form collects identity, contact, company and enquiry details but accepts no attachment.

• Connection and security data such as IP address, time, URL, user agent and error logs
• The random tirebot_session identifier
• Identity, contact, company and enquiry details voluntarily supplied through a direct channel

3. Collection Method

Technical data may be obtained automatically from HTTP requests and security logs. Direct-contact data is obtained electronically or verbally when the visitor chooses a contact channel.

Notice and explicit consent are separate. A visit is not general marketing consent; any future activity requiring consent must offer a specific, informed and freely given choice.

4. Purposes and Legal Conditions

Visit data may support page delivery, session security, abuse prevention and fault investigation. Direct-contact data may support understanding and answering the enquiry and preparing a requested product discussion.

The controller must map each field to the relevant processing condition in Article 5. This notice does not claim that consent is required for all processing or that one condition applies to every activity.

5. Recipients and Transfers

Hosting, email, security and backup contracts are not verified, so no provider, recipient country or safeguard is asserted. A visitor’s voluntary use of WhatsApp or another external channel may send data to that provider; the Article 9 transfer assessment remains pending.

6. Retention and Security

The session cookie lasts for the browser session. The application stores no local copy of contact-form fields; the session retains only non-personal validation state needed to show an error. Email is handled and deleted under the recipient mailbox owner’s process. No unsupported fixed period is stated.

The application includes HttpOnly, SameSite=Lax, production Secure cookies, security headers, CSRF protection and rate limiting. These controls are not an absolute security guarantee.

7. Rights and Requests

Article 11 rights include access to processing information, purpose and recipients, correction, deletion or destruction where applicable, recipient notification, objection to solely automated adverse results and compensation for unlawful processing.

Until the controller’s formal address is verified, the Contact page is the initial point. Identity should be verified proportionately and valid requests answered as soon as possible and within thirty days.

• Turkish authority guidance on requests ↗