KVKK Privacy Notice: website and request forms
Version 2026-10-v2 · Updated October 20, 2026
This English translation is provided for convenience. The Turkish text is the governing version.
In brief
This notice explains how Firmanet Yazılım ve Teknoloji A.Ş. (“Firmanet”, “we”) processes your personal data when you visit the iwb.com.tr website, fill in the demo or quote request form on the site, or contact us by phone or email. The site does not use cookies or similar browser storage and does not load measurement or advertising tools; during your visit, our server keeps an access log. We process your request and contact details to respond to your request, schedule a demo, and prepare a quote; we send marketing emails only if you give separate consent. Job applications are covered by the Privacy Notice: job candidates, and requests that lead to a contract are covered by the Privacy Notice: customers, product users, business partners, and suppliers.
Data controller
Under Law No. 6698 on the Protection of Personal Data (KVKK), the data controller for the personal data described in this notice is Firmanet:
Firmanet Yazılım ve Teknoloji A.Ş. (“Firmanet”), Büyükkayacık OSB Mahallesi, 101. Cadde, InnoPark Konya TGB, B Blok, No:4/105, 42160 Selçuklu / Konya. Phone: +90 (312) 439 3940. Email: [email protected]
You can use these details to contact us with questions and applications about your personal data.
What data we process
The data we process depends on how you contact us. You can leave the optional fields on the forms blank and still submit a request.
| Source | Category | Data |
|---|---|---|
| When you visit the site (even if you do not fill in a form) | Transaction security | In the server access log: IP address, date and time, requested page URL (including campaign parameters in the URL), referring URL, browser information |
| Demo request form | Identity | Full name (required) |
| Demo request form | Contact | Work email and phone number, with the country code you select (required) |
| Demo request form | Request | Company name and user count range (required); industry, modules you are interested in, and notes (optional) |
| Quote request form | Contact | Work email (required); phone number, with the country code you select (optional) |
| Quote request form | Request | User count range (required); deployment preference and company name (optional) |
| Quote request form | Identity | Full name (optional; required if you give marketing consent) |
| Information added automatically on both forms | Request | Subject (if you were directed to the form for a specific subject, for example migration from IWB Classic), page language, request code, submission time |
| Information added automatically on both forms | Marketing | Campaign parameters (campaign and ad tracking values added to the link); the page on our site viewed before reaching the form; if you came from another website, only that website’s name |
| Information added automatically on both forms | Transaction security | IP address (in memory only, for 10 minutes); signed timestamp |
| Marketing checkbox (only if you check it) | Identity, Contact, Marketing | Full name, email, company name; consent record: time of consent, version of the consent text, form on which consent was given |
| Phone and email | Identity, Contact | Full name, email address, phone number, and other contact details you provide to us |
| Phone and email | Request | The content of your message and files you attach to your email |
iwb.com.tr does not use cookies, local storage, or similar browser storage. No analytics, advertising, map, video, or chat tools are loaded on the site; fonts are also served from our own server. External pages such as the map, LinkedIn, and the system status page open only when you click their links; the site that opens applies its own rules. Details are on the Cookie Policy page.
Purposes and legal bases
We process your data only for the purposes below and on the legal basis stated next to each purpose.
| Purpose | Data categories | Legal basis |
|---|---|---|
| Secure operation of the site and detection of misuse | Transaction security (access log) | KVKK Article 5(2)(f): our legitimate interest in keeping the site secure and detecting misuse |
| Responding to your request, scheduling and conducting a demo, preparing a quote, holding sales meetings | Identity, Contact, Request | If you made the request on your own behalf, KVKK Article 5(2)(c) (processing is directly related to the establishment of a contract). If you made the request on behalf of a company, KVKK Article 5(2)(f): our legitimate interest in meeting that company’s request |
| Answering questions received by phone and email | Identity, Contact, Request (message content) | KVKK Article 5(2)(f): our legitimate interest in answering questions sent to us; if the question is a pre-contractual request, KVKK Article 5(2)(c) |
| Measuring which page and campaign a request came from | Marketing (campaign parameters, referring page and website) | KVKK Article 5(2)(f): our legitimate interest in knowing through which channels our promotional activities bring in requests |
| Preventing misuse of the forms | Transaction security (IP address, signed timestamp) | KVKK Article 5(2)(f): our legitimate interest in protecting the forms against automated and bulk submissions |
| Sending marketing emails | Identity, Contact, company name, consent record | Your explicit consent (KVKK Article 5(1)) and your consent under Article 6 of Electronic Commerce Law No. 6563 (ETK) |
| Retaining consent records and responding to your applications regarding personal data | Consent record, correspondence | KVKK Article 5(2)(ç) (fulfillment of our legal obligation) |
| Protecting our rights in a dispute | Correspondence | KVKK Article 5(2)(e) (establishment, exercise, or protection of a right) |
Where we rely on our legitimate interest, we take care that the processing does not harm your fundamental rights and freedoms, and we keep the data limited to the purpose. We do not process request records with IWB AI.
How we collect data
Site visits. Each request your browser sends to our site creates an access log entry on the server. This collection is carried out entirely by automated means.
Request forms. You fill in the form. The subject, page language, referring page, referring website name, and campaign parameters are filled in automatically in your browser while the form is open; the request code and submission time are added on the server. This collection is carried out electronically, by partly automated means. The form you submit reaches the request service on our website’s server; the request service transfers the request to the customer relationship management module in Firmanet’s own IWB workspace. If the request cannot be saved to this module at that moment, it waits in a temporary file on the server; the temporary file is deleted after the transfer and, in any case, no later than 7 days after it is created. The request service’s own operational logs do not contain names, email addresses, or phone numbers.
Anti-abuse measures. To distinguish automated submissions, we use the following on the forms: an invisible field, a signed timestamp that is obtained when you first use the form and is not stored in your browser, and a submission limit per IP address. The IP address kept for the submission limit is held in memory only and is deleted automatically after 10 minutes.
Notice version. The version label of this notice, which is linked next to the form, is also written to the request record. This makes it clear which notice was published at the time you submitted your request.
Phone and email. What you send us by email is collected electronically in our corporate email system. What you tell us by phone is entered into the request record by the employee who handles the call; this is collection by non-automated means as part of a data filing system. Our sales team responds to your request by phone or email.
The information line on the forms links to this notice. This notice is provided for information; reading it does not require your consent, and we do not ask you to consent to it.
Who we share data with
Within Firmanet, request records are used by the sales team that responds to your request. We transfer your data to the recipients below only for the purpose stated next to each recipient and only to the extent that purpose requires.
| Recipient | Data transferred | Purpose |
|---|---|---|
| Server hosting provider in Turkey | Access log, form data, request records | Hosting the servers on which the site, the request service, and our IWB workspace run |
| Microsoft (corporate email service) | What you send us by email and what we write to you; the identity, contact, and request information they contain | Responding to your request by email and corresponding with you |
| Message Management System (İYS) | Only if you gave marketing consent: your email address, your consent or opt-out, and its date | Recording consents and opt-outs under the ETK |
| Personal Data Protection Board (the Board), courts, enforcement offices, and other competent public authorities | Data they request or that the law requires | Fulfilling our legal obligations, and in connection with disputes |
| Legal advisers whose services we use | Correspondence and records relating to a dispute | Protecting our rights |
Transfers abroad
We use Microsoft for our corporate email service; in doing so, the messages you send us by email and the messages we write to you, together with the identity, contact, and request information they contain, are transferred abroad. As the Personal Data Protection Board has not issued an adequacy decision for the destination country, the transfer is made by signing the standard contract announced by the Board and notifying the Authority (KVKK Article 9(4)(c) and Article 9(5)). Here, “the Authority” means the Personal Data Protection Authority.
The servers hosting the site, the request service, and the request records are located with the hosting provider in Turkey.
How long we keep data
| Record | Period | Period starts from |
|---|---|---|
| Site access log | 6 months | Time of recording |
| IP address for the form submission limit | 10 minutes, in memory only | Time of request |
| Temporary file of the request service (a request that could not be saved to the customer relationship management module at that moment) | Deleted after the transfer; in any case, 7 days at the latest | Creation of the file |
| Requests that do not lead to a contract, questions you ask by phone or email, and related correspondence | 24 months; deleted or anonymized at the end of the period | Last contact |
| Marketing consent record | 3 years | End of consent (withdrawal) |
| Name, email, and company on the marketing mailing list | While consent remains in effect; your opt-out is applied within 3 business days | Opt-out |
| Records of commercial messages sent | 3 years | Time of recording |
Records whose period has expired, unless they are deleted automatically, are deleted, destroyed, or anonymized in the first periodic destruction following the end of the period. We carry out periodic destruction every six months, in January and July, and document it in a written record. If no reason remains that requires us to keep the data, we complete your deletion request within 30 days at the latest, without waiting for the periodic destruction. If your request leads to a contract, the records are kept for the periods stated on the Privacy Notice: customers, product users, business partners, and suppliers page. Our full retention and destruction rules are on the Personal Data Retention and Destruction Policy page.
Marketing emails
The marketing checkbox on the forms is unchecked by default and is not a condition of your request; if you do not check the box, we do not send you marketing emails. The scope of the consent, how to withdraw it, and how long records are kept are explained separately on the Commercial electronic message consent and explicit consent text page.
Your rights and how to apply
Under Article 11 of the KVKK, you have the right to learn whether your data is processed; to request information; to learn the purpose of processing and whether the data is used in line with that purpose; to know the persons to whom it is transferred; to request its correction, deletion, or destruction and the notification of this to the persons to whom it was transferred; to object to a result against you arising from analysis carried out exclusively by automated systems; and to request compensation for damage you have suffered. How to apply and the response period are explained on the Data subject requests page.
You can apply in three ways. The first is a written application bearing your wet-ink signature, which you can deliver to our head office address by hand, by mail, or through a notary public. The second is an email signed with a secure electronic signature or a mobile signature. The third is an email sent from an email address that you have previously provided to Firmanet and that is in our records. For the last two methods, you send the email to [email protected]. We record your application and respond in writing or electronically within 30 days at the latest. If your application is rejected, if you find our response insufficient, or if we do not respond in time, you may file a complaint with the Board within 30 days from the date you learn of the response and, in any event, within 60 days from the date of your application.
Changes
Before processing your data for a new purpose not stated in this notice, we update this notice; processing for the new purpose does not begin before the updated notice is published. Our general approach to personal data and our other documents are on the Privacy Policy page.
The version and the date of the last update are shown at the top of the page. When we change this notice, we publish the new version at this address; the change applies from the date it is published.