Clarification Text on the Processing of Personal Data

1. Data controller

Under Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data may be processed by NFK Bilişim ve Danışmanlık Hizmetleri Ltd. Şti. (“NFK Soft” or the “Company”) acting as data controller, within the scope described below.

Contact details: NFK Bilişim ve Danışmanlık Hizmetleri Ltd. Şti., Fatih Sultan Mehmet Mah. Balkan Cad. No:62/A, Ümraniye – İstanbul. Phone: 0 850 309 75 34. E-mail: info@nfksoft.com. Website: https://nfksoft.com

2. Scope of this text

This clarification text covers the personal data processing activities that may take place when the nfksoft.com website is visited and when a visitor, of their own accord, contacts NFK Soft by phone, by e-mail or through the contact and demo request forms on the website.

The website provides contact and demo request forms. There is no user account, no newsletter subscription and no file upload feature.

Different data processing activities that may be carried out within the scope of customer, employee, job applicant, supplier or business partner relationships may, where necessary, be subject to separate clarification texts prepared specifically for the relevant activity.

3. Personal data that may be processed

During the use of the website, the following limited categories of personal data may be processed:

Transaction security and technical log data: internet protocol address (IP address), access date and time, requested page or file, server response code, technical information regarding browser and device type, user agent information and, where transmitted by the browser, referring page information.

Contact details: where the visitor contacts NFK Soft by e-mail or phone; first name, surname, e-mail address, phone number, company or role information, and the message or request content the visitor shares of their own accord.

Form data: where the visitor fills in the contact or demo request form on the website; full name, company information, e-mail address, phone number, the service or topic of interest, the request or project message written by the visitor, the page from which the request was sent, campaign referral information where present (such as UTM parameters and GCLID), and limited technical control data used to prevent spam and abuse.

Usage statistics (only with your explicit consent): if you allow analytics cookies via the cookie notice, statistical data about usage events such as page views and form submissions, together with online identifiers (cookie IDs), may be processed through Google Analytics 4. No personal data such as name, e-mail, phone number or message content is attached to analytics events.

The forms do not request special categories of personal data. We kindly ask that special categories of personal data and sensitive content such as health information, identity documents, passwords or financial account details not be shared through the website or general communication channels.

4. Purposes and legal bases of processing

Technical logs may be processed for the following purposes:

• Ensuring the secure and uninterrupted operation of the website,
• Detecting errors, attacks and unauthorized access attempts,
• Protecting the security and integrity of information systems,
• Investigating technical issues,
• Fulfilling legal obligations,
• Establishing, exercising or protecting a right.

This processing may rely on the legal bases set out in the second paragraph of Article 5 of the KVKK: the data controller's fulfilment of its legal obligations; the establishment, exercise or protection of a right; and processing being necessary for the legitimate interests of the data controller, provided this does not harm the fundamental rights and freedoms of the data subject.

Information conveyed by the visitor via e-mail or phone may be processed for the following purposes:

• Responding to the contact request,
• Providing information about the requested product or service,
• Conducting quotation and pre-contract discussions,
• Managing customer relationships and support requests,
• Fulfilling legal and commercial obligations,
• Protecting rights in disputes or claims.

This processing may rely on the following legal bases: being directly related to the establishment or performance of a contract; the data controller's fulfilment of its legal obligations; the establishment, exercise or protection of a right; and, provided it remains proportionate, the legitimate interests of the data controller.

Information submitted through the contact and demo request forms on the website may be processed for the following purposes:

• Receiving contact and demo requests,
• Evaluating the request and routing it to the relevant expert or team,
• Contacting the visitor about the request,
• Responding to quotation, demo or service requests,
• Ensuring form security and preventing abuse,
• Understanding which page or campaign referral the request came from.

The processing of information submitted through the forms relies on the following legal bases: processing being necessary for the discussions and evaluations preceding the establishment of a contract, depending on the nature of the request; and processing being necessary for the legitimate interests of the data controller, provided this does not harm the fundamental rights and freedoms of the data subject. No separate explicit consent is requested for these processing activities; the checkbox on the form is not a declaration of explicit consent; it is only a record that this clarification text has been read.

Analytics measurement (Google Analytics 4) relies solely on the explicit consent (Article 5/1 of the KVKK) you give via the cookie notice. The analytics option is not pre-ticked; if you do not consent, no analytics data is processed. You can withdraw your consent at any time via the "Cookie Preferences" link at the bottom of the page.

Form data is not used for sending advertisements or unsolicited commercial electronic messages. No personal data is processed through this website for the purposes of advertising, behavioral profiling or automated decision-making.

5. Method of collecting personal data

Technical log data may be obtained automatically through server and security systems while the website is being accessed.

Contact details may be obtained by electronic or physical means when the visitor, of their own accord, contacts NFK Soft by e-mail or phone.

Form data is obtained entirely by electronic means, through the visitor filling in and submitting the contact or demo request forms on the website of their own accord.

Usage statistics are obtained by automated means through cookies, only if you consent to analytics cookies.

Language preference works through the URL. No cookie, local storage or similar browser identifier is used for language selection.

6. Transfer of personal data

Personal data may be transferred, limited to the purpose and in a proportionate manner, to the following recipient groups:

• Authorized Company employees responsible for evaluating and responding to the request,
• Public institutions and organizations authorized by law, and judicial authorities,
• Authorized suppliers providing website hosting, corporate e-mail, information technology and cybersecurity services,
• Service providers bound by confidentiality obligations, such as legal or financial advisors.

Information submitted through the forms is not stored in a database on the website server; it is only delivered as an e-mail to the Company's corporate e-mail address (info@nfksoft.com).

Personal data is not sold, rented or shared with third parties for advertising purposes.

If you consent to analytics cookies, measurement data may be transferred to the service provider Google LLC and processed on Google's servers abroad. This transfer relies on your explicit consent within the framework of the conditions set out in Article 9 of the KVKK; if you do not consent, no such transfer takes place.

In the initial release, website hosting and corporate email services are provided through infrastructure located in Türkiye. If a service requiring the transfer of personal data abroad is used, that service will not be activated unless the transfer conditions and appropriate safeguards under Article 9 of the KVKK are satisfied.

7. Retention periods

Technical server and security logs are retained for a maximum of six months, unless a security incident, legal claim or statutory obligation requires longer retention.

Contact and information requests that do not turn into a commercial relationship are retained for a maximum of two years from the date of the last communication.

Information that turns into a quotation, contract, invoice, support or commercial relationship record is retained for the periods prescribed in the applicable legislation and for the duration of the Company's retention obligations.

When the retention period expires or the reasons for processing cease to exist, personal data is deleted, destroyed or anonymized.

8. Data security

NFK Soft aims to implement appropriate technical and administrative measures to prevent the unlawful processing of and access to personal data and to ensure that data is stored securely.

The website is published on a static architecture; the website has no user account, password storage, payment processing, form database or file upload feature.

Since no method of transmission or storage over the internet provides an absolute security guarantee, it is recommended that special categories of personal data or unnecessary personal data not be sent through general communication channels.

9. Rights of the data subject

Pursuant to Article 11 of the KVKK, by applying to the data controller you have the right to:

• Learn whether your personal data is processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether the data is used in accordance with that purpose,
• Know the third parties, in Turkey or abroad, to whom personal data has been transferred,
• Request the correction of personal data that has been processed incompletely or inaccurately,
• Request the deletion or destruction of personal data where the conditions in the Law are met,
• Request that correction, deletion or destruction operations be notified to the third parties to whom the data has been transferred,
• Object to the emergence of a result to your detriment through the analysis of processed data exclusively by automated systems,
• Request compensation for damages if you suffer damage due to the unlawful processing of personal data.

10. Application method

You may submit your requests under the KVKK, including information sufficient to verify your identity and your request, through the following methods:

• Sending a signed written application in person or by post to NFK Bilişim ve Danışmanlık Hizmetleri Ltd. Şti., Fatih Sultan Mehmet Mah. Balkan Cad. No:62/A, Ümraniye – İstanbul,
• Sending an e-mail to info@nfksoft.com using the e-mail address you have previously notified to NFK Soft and which is registered in the Company's systems,
• Using the registered electronic mail (KEP), secure electronic signature or mobile signature methods recognized in the legislation, to the extent the relevant contact details have been published by the Company.

The application must contain your first name and surname; your signature in written applications; your Turkish ID number if you are a citizen of the Republic of Türkiye, or your passport or identity number if you are not; your address for notification; your e-mail address for notification, if any; and a clear explanation of your request.

Applications are concluded as soon as possible and within thirty days at the latest, depending on the nature of the request. If the operation additionally requires a cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

11. Changes to this text

This text is updated when the personal data processing activities on the website change. The current text is published, together with its last update date, at https://nfksoft.com/aydinlatma-metni/