Privacy Notice

1. Data controller

DIGIT Bilişim Teknolojileri Araştırma Geliştirme A.Ş. ("DIGIT" or "the Company"), Üniversiteler Mah. 1606. Cad. Ankara Teknoloji Geliştirme Bölgesi Cyberpark Plaza C Blok No:305 Çankaya/Ankara, Türkiye

E-mail: iletisim@onlock.io · Registered e-mail (KEP): digit@hs01.kep.tr · Phone: +90 312 265 00 23

2. Scope

This notice covers only data processed through our website and the requests you send us. For access records that organisations using the Onlock platform create for their own employees, members or guests, the organisation is the data controller; DIGIT processes that data on its behalf and on its instructions. Please direct requests about such data to the organisation first.

3. Personal data we process

• Identity: first and last name.
• Contact: e-mail address and phone number.
• Request details: company name, the subject you choose and the content of your message.
• Transaction security: server logs such as IP address, browser information and time of access.

4. Purposes and legal grounds

Your personal data is processed for the purposes below, on the legal grounds set out in Article 5(2) of the Law:

• Replying to your request and handling information, quote and demo processes: necessity for entering into or performing a contract (point c).
• Keeping the website secure and preventing misuse: our legitimate interest, provided it does not harm your fundamental rights and freedoms (point f).
• Meeting statutory obligations and responding to requests from competent authorities: necessity for complying with a legal obligation (point ç).

5. How we collect it

Data is collected electronically: directly from you through the contact form, e-mail and phone, and automatically in server logs when you visit the site.

6. Transfers

Your personal data is never sold or shared with third parties for marketing. It may be transferred only as far as the purposes above require, to the following recipients:

• Service providers abroad: DigitalOcean, which hosts the site (data centres in Europe); Yandex 360, the e-mail service that delivers form messages; and Cloudflare, which provides DNS and security services. These transfers are made in line with the conditions set out in Article 9 of the Law.
• Competent public authorities: where there is a legal obligation or a duly made request, and only to that extent.

7. Retention

Information you send by form or e-mail is kept until your request is concluded and for as long as any resulting business relationship lasts; it is then deleted, destroyed or anonymised once the limitation periods under the applicable legislation have expired. Server logs are kept for a limited period for security purposes.

8. Your rights

Under Article 11 of the Law, you may apply to the data controller to:

• learn whether your personal data is processed;
• request information if it has been processed;
• learn the purpose of processing and whether it is used accordingly;
• know the third parties in Turkey or abroad to whom it is transferred;
• request correction if it is incomplete or inaccurate;
• request deletion or destruction under the conditions in Article 7 of the Law;
• request that corrections, deletions or destructions be notified to third parties to whom the data was transferred;
• object to a result against you arising solely from analysis by automated systems;
• claim compensation if you suffer damage from unlawful processing.

9. How to apply

You can send requests in line with the Communiqué on the Procedures and Principles for Applications to the Data Controller: in writing to Üniversiteler Mah. 1606. Cad. Ankara Teknoloji Geliştirme Bölgesi Cyberpark Plaza C Blok No:305 Çankaya/Ankara, Türkiye, by registered electronic mail (KEP) to digit@hs01.kep.tr, or to iletisim@onlock.io from an e-mail address you have previously given us and that is registered with us.

Your application should include your name, Turkish ID number (nationality and passport number for foreign nationals), address for notifications, e-mail address if any, phone number and the subject of your request. Requests are concluded free of charge within 30 days at the latest, depending on their nature; if the action involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the reply insufficient or no reply is given in time, you may file a complaint with the Board.