Data Protection Policy

1 Data Controller

Under GDPR and KVKK, VECSUS acts as the data controller. Your personal data is processed for the purposes described below.

2 Categories of Personal Data Processed

Vecsus processes the following categories of personal data to deliver its services:

• Identity data: Name, surname, title
• Contact data: Email, phone, organization, address
• Professional data: Company, position, industry
• Transaction data: Site interactions, form submissions, communication history
• Technical data: IP address, browser type, visit dates, device information

3 Purposes of Processing

Your personal data is processed for the following purposes:

• Responding to your inquiries and providing services
• Managing contractual processes and maintaining business relationships
• Meeting legal obligations
• Improving service quality and conducting process improvement analyses
• Sending marketing communications and newsletters, where you have given consent
• Security, fraud prevention, and legal proceedings

4 Legal Basis for Processing

Your data is processed on the following legal bases under GDPR Art. 6 and KVKK Art. 5:

• Consent — For marketing and optional data processing
• Performance of a contract — For service delivery processes
• Legal obligation — For statutory retention periods
• Legitimate interest — For security, fraud prevention, and site improvement

5 Transfer of Personal Data

Vecsus does not share your personal data with third parties without a legal obligation or your explicit consent. Limited transfers may occur in the following situations:

• To authorized public institutions under legal obligations
• To our service providers (email, hosting, analytics) within the scope of the processing basis
• To our business partners, with your explicit consent

For any necessary international data transfers, we apply the safeguards required by GDPR and KVKK, including adequacy decisions or standard contractual clauses.

6 Data Retention Periods

Your personal data is retained for as long as necessary for the purpose of processing and within statutory retention periods. At the end of these periods, data is securely deleted, destroyed, or anonymized.

7 Your Rights as a Data Subject

Under GDPR Art. 15-22 and KVKK Art. 11, you have the following rights:

• To know whether your personal data is being processed
• To request information about the processing if it is
• To know the purpose of processing and whether it is used in line with that purpose
• To know the third parties to whom your data has been transferred, domestically or internationally
• To request correction of incomplete or inaccurate data
• To request deletion or destruction where the conditions are met
• To request that any corrections, deletions, or destruction be notified to third parties to whom data has been transferred
• To object to outcomes resulting from automated analysis that affect you adversely
• To claim compensation if you have suffered damage due to unlawful processing

8 Data Security

We implement technical and organizational measures in line with GDPR and KVKK to protect your personal data against unauthorized access, loss, disclosure, and alteration. These measures include SSL encryption, access controls, regular security audits, and confidentiality obligations for our employees.

9 Policy Updates

This policy may be updated to reflect legal changes and developments in our processing activities. The current version is always published on this page with its effective date.