KVKK Privacy Notice

Section 1Why does this notice exist?

Law No. 6698 on the Protection of Personal Data (in short the KVKK) imposes an obligation on everyone who processes a person's data: before collecting it, to tell that person what is being collected and why. This is called the obligation to inform and is set out in Article 10 of the Law.

This notice was written to fulfil that obligation. Its purpose is less to complete a legal formality than to show you clearly which of your information reaches us when you visit this site or contact us, what we do with that information, and what we do not do.

Section 2Who is the data controller?

In the KVKK's definition, the data controller is the party that decides for what purpose and how personal data will be processed. For the data on this site, that controller is us:

You can send any question, request or application concerning your personal data to the addresses above. The application procedure is in Section 11 and, in more detail, on the Data Subject Application Form page.

Section 3Which of your data do we process?

The personal data processed on this site falls under four headings. Under each heading we list below exactly which fields are processed.

3.1 — Quote and contact form

When you complete the form on our contact page, we process the information you write into it. The full set of fields on the form is:

• Full name — required (identity data)
• Company name — optional
• Email address — required (contact data)
• Telephone number — optional (contact data)
• Service type you are interested in — optional
• Event date — optional
• Message content — required (free text about your request)

The required fields are the minimum information needed for us to get back to you. Leaving the optional fields blank does not invalidate your enquiry.

3.2 — Direct contact

If you email us, telephone us or message us on WhatsApp without using the form, the name and contact details you share and the content of the correspondence are processed. We do not record telephone calls.

When you click the WhatsApp link, the conversation takes place through the WhatsApp application, not on our site. From that point on, WhatsApp's own privacy policy (Meta Platforms Ireland Ltd.) also applies to the messaging data; we have no control over how that application processes data.

3.3 — Server logs

The web server hosting this site technically records every request it receives. This record is created automatically; it is kept whether or not you complete the form and whether or not you decline cookies. The information recorded is:

• IP address — the network address of the device you connect from (transaction security data)
• Date and time — the moment the request reached the server
• Requested address — the path of the page you viewed
• HTTP status code — whether the request succeeded
• Browser and operating system information — the text by which your browser identifies itself
• Referring address — the link you arrived at our site from

We do not use these records for marketing and do not try to match them to your identity. Their purposes are limited: monitoring that the server is running healthily, debugging, and detecting attempted attacks.

3.4 — Cookies and visit statistics

Apart from cookies strictly necessary for the site to work, no cookie is written to your browser without your express permission. If you choose "Accept all" in the cookie banner that appears when the site first opens, Google Analytics is activated and collects the following:

• The pages you visit and the time you spend on them
• The source you came to the site from (search engine, direct address, link)
• Device type, screen resolution, browser and operating system
• Approximate geographic location — at country and city level, not at address level
• A random identifier used to distinguish one visitor from another

The name and duration of each cookie, and what each one does, are listed in a table on our Cookie Policy page.

Section 4How do we collect the data?

We collect your personal data by wholly or partly automated means, electronically. In practice this means:

• You completing and submitting the contact form on the website
• You sending us an email, telephoning us or messaging us on WhatsApp
• The server keeping automatic records while you visit the site
• Cookies being written to your browser if you consent

There is no other mechanism on this site that collects personal data: there is no membership system, user account, comment section, subscription form or payment infrastructure.

Section 5For what purpose and on what legal ground?

The KVKK requires a valid legal ground for processing personal data. These grounds are listed in Article 5 of the Law. The table below shows which data we process for which purpose and which provision we rely on.

Things we do not do

Because what we do not process matters as much as what we do, we state it explicitly. We do not:

• Sell, rent or trade your personal data to third parties
• Share it with advertising networks or use it for targeted advertising
• Use it to send commercial electronic messages (newsletters, campaign SMS) without your consent
• Analyse it with automated systems to build a profile of you, or produce automated decisions
• Process it for any purpose other than those written in this notice

Section 6Who do we share it with?

Your personal data may be transferred to third parties only in the following limited cases, and only to the extent necessary:

Our hosting provider

Provides the infrastructure on which the site files and server logs are kept. Because access to the data is technically possible, it holds the status of data processor within the meaning of the KVKK; it cannot use the data other than on our instructions. The servers are in Türkiye — this transfer takes place domestically and does not appear in the transfer-abroad table in Section 7.

Form delivery service

Because the site is static, an intermediary service is used to turn the form into an email. Your form submissions reach us through that service. This component is not currently active — the form is not yet connected to a service. When it is enabled, this notice will be updated and the identity of the service stated here.

Google (analytics and maps)

Activated only if you consent to the relevant cookie group. For details see Section 7.

Legally authorised authorities

Where courts, public prosecutors and administrative authorities empowered by law make a duly formed request, information is provided to the extent required by the legislation. When such a request arrives, we try to inform you unless we are legally prevented from doing so.

Our legal counsel

In the event of a dispute, data may be shared with our lawyer to the extent necessary to defend our rights. Lawyers are also under their own obligation of professional secrecy.

Beyond these, your data is not transferred to any third party. In particular, we do not transfer visitor data to our business partners, suppliers or reference companies.

Section 7Transfer abroad

Some of your data is deemed to be transferred abroad because the servers of the services we use are located outside Türkiye. This is a matter that must be addressed separately under Article 9 of the KVKK. Below we show which data goes abroad and under what condition.

The most important item falling outside the table is the server logs: because the servers hosting the site are in Türkiye, the connection records created when you open the site are processed and stored domestically. All of the transfers below, by contrast, depend on your choice — if you do not consent, none of them takes place.

Legal basis for the transfer

For the analytics and map components, the transfer takes place on the basis of your explicit consent under the sixth paragraph of Article 9 of the KVKK. If you do not consent in the cookie banner, none of these transfers occurs — the services are not loaded, so no data is sent.

Article 9 of the Law, as amended in 2024, provides in order for an adequacy decision by the Board; failing that, appropriate safeguards such as standard contractual clauses or an undertaking; and failing those, the exceptions applicable to incidental cases. Because the transfers on this site depend on the visitor's own choice and are not continuous in nature, they are based on explicit consent.

Section 8How long do we keep it?

We do not keep personal data longer than the period required for the purpose for which it is processed, or than the limitation periods laid down in legislation. When the periods expire, the data is deleted, destroyed or anonymised.

For details of how the periods are determined, the methods of destruction used and the periodic destruction cycles, see our Data Retention and Destruction Policy.

Section 9How do we protect your data?

Article 12 of the KVKK places an obligation on the data controller to ensure an appropriate level of security. The principal measures we take to that end are:

Technical measures

• All traffic between the site and your browser is encrypted with HTTPS; your form data does not travel across the network in plain text
• Access to the server is limited to authorised persons only and is made using an encrypted key
• Browser security headers are enabled; embedding the site in another page and content-type confusion attacks are prevented
• Server and software updates are applied regularly
• There is no user account, database or payment infrastructure on the site — the attack surface is deliberately kept narrow

Administrative measures

• Access to personal data is limited to those who genuinely need it to do their job
• Employees with access are under an obligation of confidentiality
• Contracts are made with service providers acting as data processors, requiring that data be processed only on our instructions
• The volume of data processed is kept to the minimum needed for the purpose

Section 10Your rights under the Law

Article 11 of the KVKK grants you the following rights. You can exercise all of them by applying to us:

1. To learn whether your personal data is being processed
2. To request information about it if it has been processed
3. To learn the purpose of processing and whether the data is used in accordance with that purpose
4. To know the third parties in Türkiye or abroad to whom the data has been transferred
5. To request correction if it has been processed incompletely or inaccurately
6. To request deletion or destruction within the conditions set out in the Law
7. To request that correction, deletion and destruction operations be notified to the third parties to whom the data has been transferred
8. To object to a conclusion reached against you as a result of the data being analysed exclusively by automated systems
9. To claim compensation for damage you suffer as a result of unlawful processing

In addition, where the processing activity is based on your explicit consent (such as analytics cookies and the map), you can withdraw your consent at any time. Withdrawal does not invalidate processing carried out up to that point but stops processing thereafter. To withdraw your cookie consent it is enough to use the Cookie Settings link at the bottom of the page — there is no need to make an application.

Section 11How do you exercise your rights?

You can submit your application, together with information enabling us to verify your identity, by one of the following routes:

• In writing: you can bring your wet-signed petition in person to 19 Mayıs Mah. Halaskargazi Cad. Çiftkurt Apt. No: 226 Interior No: 24, 34363 Şişli / İstanbul, or send it through a notary.
• By email: you can write to info@h2o-organizasyon.com from the email address you previously notified to us and which is registered in our system.
• With a secure electronic signature or mobile signature: you can send your signed application to the same email address.

Stating clearly in your application what your request is, and attaching any relevant information and documents, will speed up the process. For convenience you may use the Data Subject Application Form we have prepared.

Response time and fees

We conclude your application free of charge as soon as possible and in any event within thirty days, depending on its nature. Where the operation additionally entails a cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

If your application is rejected, if you find our response insufficient, or if you do not receive a response within the period, you may complain to the Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the date of application. Under the Law, you must have applied to us first before applying to the Board.

Section 12If this notice changes

We update this notice when the legislation changes, when we start using a new service or when our data processing operations change. The current version is always published on this page and the last updated date and version number at the top change accordingly.

If a change materially affects processing based on your explicit consent (for example the addition of a new analytics tool), the cookie banner is shown again and your preference is requested afresh. Consent you have given previously is not automatically extended to the new situation.