Zenigma Teknoloji A.Ş. processes your personal data under Türkiye's Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR). This notice explains which personal data we process when you visit our site, write to us, apply for a job or work with us as part of your company, why we process it, how long we keep it and what rights you have.
We prepared it under article 10 of KVKK and the Turkish Communiqué on the Duty to Inform. It also contains the information article 13 of the GDPR requires for visitors who live in the European Union.
Data controller
The data controller for your personal data is Zenigma Teknoloji A.Ş.
- Registered name: Zenigma Teknoloji A.Ş.
- Trade registry number: 326792-5
- MERSIS number: 0997165047000001
- Tax office and number: Kozyatağı Tax Office, 9971650470
- Address: Barbaros Mah. Begonya Sk. Nidakule Ataşehir Batı No: 1/2, 34746 Ataşehir / İstanbul, Türkiye
- Email: [email protected]
- Phone: +90 539 551 44 66
Summary
The table summarises our processing; the sections after it give the detail for each activity.
| Whose data | Which data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Site visitors | IP address, browser and device information, time of request, address visited, error records | Running the site, keeping it secure and fixing errors | KVKK art. 5/2-ç and 5/2-f; GDPR art. 6(1)(c) and 6(1)(f) | Security logs 30 days, application logs 14 days, error records up to 90 days |
| People who write to us | Name, email address, company, service of interest, message, page the form was sent from, campaign link information | Answering the request, running the conversation, keeping a record of the request | KVKK art. 5/2-c and 5/2-f; GDPR art. 6(1)(b) and 6(1)(f) | 12 months after the request is closed; 10 years if it becomes an engagement |
| Job applicants | Name, contact details, CV and information shared in the application, interview notes | Assessing the application and telling you the result | KVKK art. 5/2-c; for the talent pool art. 5/1 (explicit consent); GDPR art. 6(1)(b) and 6(1)(a) | 6 months after the process ends; 12 months in the talent pool |
| Representatives of customers, partners and suppliers | Name, job title, company, business contact details, correspondence, contract and invoice records | Entering into and performing contracts, invoicing, legal obligations | KVKK art. 5/2-c, 5/2-ç and 5/2-f; GDPR art. 6(1)(b), 6(1)(c) and 6(1)(f) | Up to 10 years after the relationship ends |
When you visit our site
For every request to our site, our servers and content delivery network record your IP address, browser and device information, the time of the request and the address requested. We use these records to keep the site running and secure, to block automated attacks and to fix errors. We keep security logs for 30 days and application logs for 14 days.
If an error occurs on the site, the browser type, the page address and the technical error details are sent to Sentry, our error tracking service, so that we can find the cause. We keep these records for up to 90 days.
We keep visit statistics with Plausible. Plausible sets no cookies, does not store your IP address and does not follow you across sites. What we see are aggregate numbers, such as how many times a page was viewed, which cannot be linked to anyone.
The office map on the contact page loads from OpenStreetMap's servers, which receive your IP address as it loads. OpenStreetMap processes that data under its own privacy policy.
When you write to us
Through the contact form we collect your name, email address, your company if you enter one, the service you are interested in and your message. We also record the page you sent the form from and, if you reached us through a campaign link, the information in that link. We send an automatic email confirming that we received your request, and then we get back to you. We process the same information when you email us directly.
To answer your request and run a conversation that is heading towards an engagement, we rely on the processing being directly related to entering into a contract (KVKK art. 5/2-c, GDPR art. 6(1)(b)); to keep a record of the request, we rely on our legitimate interest (KVKK art. 5/2-f, GDPR art. 6(1)(f)). We keep the record for 12 months after your request is closed. If the conversation becomes an engagement, article 82 of the Turkish Commercial Code requires us to keep commercial correspondence for 10 years. We delete messages we mark as spam within 30 days.
When you apply for a job
We receive applications by email or through the application system the job posting points to. We process your name, contact details, CV and anything else you share in your application, together with the notes we take in interviews. We use them to assess your application and to tell you the result. The legal basis is that the processing is directly related to entering into a contract (KVKK art. 5/2-c, GDPR art. 6(1)(b)).
We keep the records for 6 months after the application process ends. Keeping you in our talent pool for future roles needs your explicit consent (KVKK art. 5/1, GDPR art. 6(1)(a)). In that case we keep the records for 12 months, and you can withdraw your consent at any time.
We do not ask for special categories of personal data such as health, religion or association membership. If your CV contains them, we do not use them in the assessment.
When your company works with us
We process the name, job title, company, business contact details and business correspondence of the people at our customers, partners and suppliers who work with us. We use them to enter into and perform contracts, to invoice and to meet our legal obligations (KVKK art. 5/2-c, 5/2-ç and 5/2-f; GDPR art. 6(1)(b), 6(1)(c) and 6(1)(f)). After the relationship ends we keep the records for the periods set by the Turkish Commercial Code and the Tax Procedure Law, up to 10 years.
When our projects for a customer give us access to personal data in their systems, we process that data on the customer's instructions and under the contract between us. That processing is governed by the contract and is outside the scope of this notice.
Who we share data with
We do not sell or rent your personal data, and we do not give it to third parties for marketing. We share it only with the recipients below, and only as far as needed for the activities above:
- Microsoft: the site, the content management system and form records are hosted on Microsoft Azure, and our company email runs on Microsoft 365.
- Cloudflare: carries the site's traffic for security and speed.
- Sentry: records errors that occur on the site.
- Plausible: keeps aggregate visit statistics.
- OpenStreetMap: the office map on the contact page loads from their servers.
- When we receive job applications through an application system, the provider of that system.
- Our legal, financial and tax advisers, limited to the matter they advise on.
- Public authorities entitled by law, when they request it (KVKK art. 8/2-a, GDPR art. 6(1)(c)).
Our service providers process the data on our behalf and on our instructions. We have agreements with each of them that include data processing terms.
International transfers
Our service providers' servers are located outside Türkiye. The data of the site and the content management system is kept in Microsoft Azure data centres in the European Union. We transfer personal data abroad in line with the conditions of article 9 of KVKK. For transfers outside the European Union, the standard contractual clauses (GDPR art. 46) in our providers' data processing agreements apply. If you would like to know which provider operates in which country, write to us.
How we collect data
We collect your data through the contact form on the site, email correspondence, job applications and server logs, electronically, by automated or partly automated means.
Automated decisions
We do not use your personal data to make decisions based solely on automated processing or to build a profile of you.
How we protect your data
The connection between you and the site is encrypted (HTTPS). Only employees who need them for their work can access form records and our mailboxes. When a retention period ends, we delete, destroy or anonymise the data.
Your rights
Under article 11 of KVKK you have the right to:
- learn whether your personal data is processed,
- request information about the processing if it is,
- learn the purpose of the processing and whether the data is used for that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request erasure or destruction under the conditions of article 7 of KVKK,
- request that corrections, erasure and destruction be notified to the third parties the data was transferred to,
- object to a result against you that arises solely from analysis by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
The GDPR adds the rights to request restriction of processing, to receive the data you gave us in a structured, commonly used format and move it to another controller (data portability), to object to processing based on legitimate interest and to withdraw consent at any time. We honour these rights for everyone, wherever you live.
How to exercise your rights
You can send requests about your rights, in line with the Turkish Communiqué on Applications to the Data Controller, in any of these ways:
- by a letter bearing your wet signature, to the address above,
- signed with a secure electronic signature or mobile signature, to [email protected],
- from an email address you have previously given us and that is in our records, to [email protected].
Your application should state your name and surname, your Turkish ID number if you are a Turkish citizen (otherwise your nationality and passport number), your address for notifications, your email address and phone number if you have them, and your request. If we need to verify your identity, we may ask for more information.
We resolve your request free of charge within 30 days at the latest, depending on its nature. If the work involves an additional cost, we may charge the fee set in the tariff of the Turkish Personal Data Protection Board.
If you find our answer unsatisfactory or receive no answer in time, you may complain to the Turkish Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application. If you live in the European Union, you may also lodge a complaint with the data protection authority of the country where you live or work.
Changes to this notice
We update this notice when the law or the way we work changes. The current text is published on this page with its version number and effective date.