Data subject requests

This English translation is provided for convenience. The Turkish text is the governing version.

Who can apply

This page explains how to apply to the following company regarding your personal data:

Firmanet Yazılım ve Teknoloji A.Ş. (“Firmanet”), Büyükkayacık OSB Mahallesi, 101. Cadde, InnoPark Konya TGB, B Blok, No:4/105, 42160 Selçuklu / Konya. Phone: +90 (312) 439 3940. Email: [email protected]

On this page, Firmanet refers to itself as “we”.

Law No. 6698 on the Protection of Personal Data (KVKK) grants every natural person whose personal data is processed the right to apply to the data controller. You can apply to us through the methods on this page to exercise any of your rights under the KVKK, including the right to learn whether we process your data.

• The right to apply belongs to natural persons. An employee of a company applies in their own name for their own data.
• To apply on behalf of another person, you must document your authority to represent them (see “How we verify your identity”).
• Applications must be made in Turkish.

You can see which of your data we process, and for what purposes, in the privacy notice that applies to you:

• KVKK Privacy Notice: website and request forms: site visitors, people who fill in the demo or quote request form, and people who contact us by phone or email.
• Privacy Notice: customers, product users, business partners, and suppliers: representatives of customers, business partners, and suppliers, and IWB users.
• Privacy Notice: job candidates: people who apply to us for a job.

If your data is in the IWB workspace of one of our customers, that company is the data controller; see “Data in workspaces”.

Your rights

Under Article 11 of the KVKK, you have the following rights:

1. To learn whether your personal data is processed.
2. If it has been processed, to request information about the processing.
3. To learn the purpose of the processing and whether the data is used in line with that purpose.
4. To know the third parties to whom your data is transferred in Turkey or abroad.
5. To request the correction of your data if it has been processed incompletely or inaccurately.
6. To request the deletion or destruction of your data if the reasons requiring its processing no longer exist.
7. To request that the correction, deletion, or destruction be notified to the third parties to whom the data has been transferred.
8. To object to a result against you arising from the analysis of your data exclusively by automated systems.
9. To claim compensation if you have suffered damage because your data was processed unlawfully.

When you request deletion, if all of the reasons requiring the processing of the data no longer exist, we delete, destroy, or anonymize the data within 30 days without waiting for the periodic destruction, and we notify you. If the data has been transferred to another party, we notify that party as well. If the reasons still exist (for example, if a statutory retention period has not yet expired), we reject your request and state our reasons. Retention periods are set out in the Personal Data Retention and Destruction Policy.

How to apply

You can apply in one of the following three ways:

1. Written application with a wet-ink signature: you can deliver it by hand to our head office address, or send it by mail or through a notary public. Address: Büyükkayacık OSB Mahallesi, 101. Cadde, InnoPark Konya TGB, B Blok, No:4/105, 42160 Selçuklu / Konya.
2. Email signed with a secure electronic signature or a mobile signature: to [email protected].
3. Email from your email address on record: to [email protected], from the email address that you have previously provided to us and that is in our records.

Writing “Kişisel veri başvurusu” (personal data request) on the envelope or in the email subject line helps your application reach the relevant department quickly.

Phone calls and in-person meetings do not count as an application. Through these channels, we can only provide information about the process.

What your application must include

Your application must include the following information:

• Your first name, last name, and, for a written application, your signature.
• If you are a Turkish citizen, your Turkish national ID number; if you are a foreign national, your nationality and your passport number or, if you have one, your identity number.
• Your residential or workplace address for notification purposes.
• If you have them, your email address and phone number for notifications.
• The subject of your request.
• Information and documents relating to your request.

Your application must be in Turkish. Stating clearly which right you are exercising, for which data, and for which period speeds up our response.

Application form

You can use the table below as a template when preparing your application. Using the form is not mandatory; we accept any application that contains the information above.

Field	Description
Full name	Required.
Turkish national ID number	Required for Turkish citizens.
Nationality and passport number	Required for foreign nationals; an identity number, if you have one, may be given instead of the passport number.
Address for notifications	Residential or workplace address. Required.
Email	If you have one. Needed if you want to receive the response by email.
Phone	If you have one. To contact you if additional information is needed.
Your relationship with Firmanet	Visitor, requester, customer representative, IWB user, job candidate, supplier, or other. If you are an IWB user, the name of the company you work for.
Your request	Which right you are exercising (from the list in “Your rights”) and what you are requesting.
Attachments	Documents relating to your request. If you are applying on behalf of another person, the document showing your authority to represent them.
How you want to receive the response	Mail or email.
Date and signature	For a written application, a wet-ink signature. For an electronic application, a secure electronic signature or a mobile signature, or an email sent from your email address on record.

How we verify your identity

We verify your identity so that we disclose your data only to you:

• For a written application with a wet-ink signature, we rely on your signature and your identity details.
• For an email signed with a secure electronic signature or a mobile signature, we rely on your signature.
• For an unsigned email, we rely on the email coming from an address that you have previously provided to us and that is in our records.

If this information is not sufficient to verify your identity, we ask you for additional information. We do not disclose, change, or delete your personal data until your identity has been verified.

If you are applying on behalf of another person, attach to your application the power of attorney or the legal representation document showing your authority to represent them.

Our response

• We record your application and conclude it within 30 days at the latest. For a written application, this period starts from the date the application is served on us; for the other methods, it starts from the date the application is received.
• We respond in writing or electronically, by the method you prefer. Information given by phone or in person does not count as a response; through these channels, we can only request additional information or explain the process.
• We either accept your request or reject it with our reasons. In our response, we state clearly which part of your request we have met and the reasons for any part we have not met.
• If we accept your request, we take the action it requires.
• Applying is free of charge. If a written response exceeds 10 pages, a fee of 1 TRY is charged for each page after the 10th page; if the response is provided on a recording medium (for example, a memory stick or a disk), a fee equal to the cost of the medium is charged. If the application arose from an error on our part, the fee charged is refunded.
• We send our response in a way that allows us to prove it has reached you, and we keep a record of it.

Data in workspaces

Companies that use IWB, that is, our customers, keep the data of their own employees, customers, suppliers, and other individuals in their own IWB workspaces. The data controller for this data is that company; we process it only on that company’s behalf and on its instructions. For companies that install IWB on their own servers, the data is stored on that company’s server.

• If you apply to us regarding such data, we forward your application to the relevant company within 5 business days and inform you.
• We forward to the company only your request and your contact details.
• Applying directly to that company will get you a faster result.

If your application concerns both data for which we are the data controller (for example, the sign-in and session security records of your IWB account) and the company’s data, we answer our part ourselves and forward the rest to the company.

Complaints to the Board

If your application is rejected, if you find our response insufficient, or if we do not respond within 30 days, you may file a complaint with the Personal Data Protection Board (the Board).

• The period for filing a complaint is 30 days from the date you learn of our response and, in any event, 60 days from the date of your application.
• To file a complaint with the Board, you must first have applied to us.
• How to file a complaint is explained on the website of the Personal Data Protection Authority (the Authority), at kvkk.gov.tr.

Your data relating to your application

We also process personal data in order to conclude your application. The data controller for this processing is Firmanet, whose details are given at the top of this page.

Topic	Information
Data processed	Identity: full name, Turkish national ID number (for foreign nationals, nationality and passport or identity number), signature for a written application. Contact: address for notifications, email, phone. Request: the content of your application and its attachments.
Purposes	Concluding your application, verifying your identity, proving that we have responded to you.
Legal bases	Concluding the application and verifying identity: our legal obligation (KVKK Article 13 and the Communiqué on the Principles and Procedures for the Request to Data Controller), KVKK Article 5(2)(ç). Proof of the response: establishment, exercise, or protection of a right, KVKK Article 5(2)(e).
Collection method	From the application you send by hand, by mail, through a notary public, or by email; by non-automated means, as part of our record of applications.
Recipients	Microsoft: corporate email service, for applications received by email and our responses. The relevant customer: if the application concerns data in its workspace, only your request and your contact details. The Board: if you file a complaint, the information and documents it requests.
Retention	Your application and our response are kept for 3 years from the date of our response; at the end of this period, they are destroyed.

We use Microsoft for our corporate email service; in doing so, your application received by email, its attachments, and our response are transferred abroad. Since there is no adequacy decision of the Personal Data Protection Board for the country of transfer, the transfer is made by signing the standard contract announced by the Board and notifying the Authority (KVKK Article 9(4)(c) and Article 9(5)).

You can also exercise the rights in “Your rights” for this data through the same methods, and file a complaint with the Board.

Changes

When we change the application methods or the process, we update this page. The original language of this text is Turkish; versions in other languages are for information purposes.

The version and the update date are shown at the top of this page. When we change the text, we publish the new version at this web address; the change applies from the date it is published.