Privacy Notice (KVKK & GDPR)

1. Data controller

Your personal data is processed by BTS Bilişim Eğitim ve Danışmanlık Hizmetleri Ticaret Ltd. Şti. acting as data controller (GDPR Art. 4) / veri sorumlusu (KVKK).

• Address: Nidakule-Batı, Barbaros Mah. Begonya Sk. No:1/2, 34746 Ataşehir / İstanbul, Türkiye
• E-mail: info@bts-tr.com
• Registered e-mail (KEP): btsbilisimegitim@hs01.kep.tr
• Phone: +90 216 566 00 50

2. Scope of this notice

This notice covers the QMex marketing website only. KVKK applies to visitors connecting from Türkiye and the GDPR applies to visitors connecting from the European Economic Area (EEA); where both apply, the more protective provision prevails.

Data processed while QMex products are used inside your organisation falls outside this notice; it is governed by the agreement and the data processing agreement (DPA) between your organisation and us. In that relationship your organisation is the controller and BTS is the processor.

3. Personal data processed

If you submit the demo/contact form:

• Identity: first name, last name
• Contact: business e-mail address, phone number
• Professional information: company or organisation name, industry
• Enquiry content: the product or service you are interested in and whatever you write in the “request details” field

While you browse the site, limited technical data may be processed in order to deliver the service, maintain information security, detect technical faults and prevent abuse: the IP address, the date and time of access, the page or resource requested, basic technical information about the browser and device, and security and server logs.

The site uses no advertising or behavioural profiling tracking technologies during your visit. See the Cookie Policy and the Privacy Policy for details.

4. Purposes of processing

• Responding to demo requests and getting back to you
• Providing information about products and services and running quotation processes
• Managing communications and tracking enquiries and complaints
• Securing the website and information systems and preventing abuse
• Detecting technical faults and improving service quality

5. Legal basis

Your personal data is processed on the following legal grounds under the Turkish Law No. 6698 on the Protection of Personal Data and under the GDPR:

• Directly related to the conclusion or performance of a contract — KVKK Art. 5/2(c) and GDPR Art. 6(1)(b): your demo request constitutes steps taken prior to entering into a contract between us.
• Legitimate interests — KVKK Art. 5/2(f) and GDPR Art. 6(1)(f): managing demo and enquiry processes, securing the website, preventing abuse and improving our services, provided that your fundamental rights and freedoms are not overridden.

No separate explicit consent is requested for a demo request; processing relies on the legal grounds above. If a processing activity requiring explicit consent arises, that consent will be obtained from you separately and explicitly.

6. Transfers, including international transfers

Your personal data may be shared, only to the extent required by the purposes above, with authorised employees of our company and with third-party service providers we work with. Those providers are:

• Zoho CRM — managing demo requests and prospective customer relationships
• Microsoft 365 — e-mail and corporate communication infrastructure
• Cloudflare Turnstile (Cloudflare, Inc.) — protecting the demo and contact form against automated and malicious use
• Hosting, CDN and IT service providers

Only the minimum data necessary for the purpose is shared with these providers.

International transfers: Because the servers of these providers may be located abroad, your personal data may be transferred outside Türkiye. Such transfers are carried out in accordance with Article 9 of the KVKK, relying on the standard contracts approved by the Turkish Personal Data Protection Board — or on other appropriate safeguards provided by law — where no adequacy decision exists.

Transfers from the EEA: Articles 44 et seq. of the GDPR apply. As Türkiye is not among the countries covered by a European Commission adequacy decision, transfers from the EEA rely on appropriate safeguards under Article 46 of the GDPR, such as the Standard Contractual Clauses (SCCs).

This section will be updated if the service providers we use change.

7. Retention period

Personal data processed in connection with a demo request is retained for a maximum of 5 years from the last meaningful contact with you. If a new demo request, meeting, quotation or product evaluation contact occurs within that period, the retention period is re-assessed.

If the relationship becomes a commercial one, your data becomes subject to the retention rules applicable to customer relationships and to our retention and destruction policy.

Security and server logs are retained only for as long as the security purpose requires.

At the end of the period your personal data is deleted, destroyed or anonymised. Longer retention takes place only where required by applicable legislation and only for the period so required.

8. Your rights under KVKK

Under Article 11 of the KVKK you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties in Türkiye or abroad to whom the data has been transferred; request rectification if the data is incomplete or inaccurate; request erasure or destruction; request that rectification and erasure be notified to the third parties concerned; object to a result produced against you solely by automated analysis; and claim compensation for damage arising from unlawful processing.

9. Your rights under the GDPR

If you are located in the EEA, you have the following rights under Articles 15–22 of the GDPR:

• Right of access (Art. 15) — to obtain a copy of your data
• Right to rectification (Art. 16)
• Right to erasure / right to be forgotten (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20) — to receive your data in a structured, commonly used and machine-readable format
• Right to object (Art. 21) — in particular to processing based on legitimate interests and to direct marketing
• Right not to be subject to automated decision-making (Art. 22)
• Right to withdraw consent — where processing is based on consent, without affecting the lawfulness of processing before withdrawal

You also have the right to lodge a complaint with the data protection supervisory authority of the EU Member State where you live or work.

10. EU representative

Our company is established in Türkiye. Considering our current activities and the way the QMex website is used, we do not envisage any specific and systematic offering of goods or services to individuals in the European Economic Area, nor any monitoring of their behaviour, within the meaning of Article 3(2) of the GDPR.

Accordingly, no EU representative has currently been designated under Article 27 of the GDPR.

Should targeted offerings or marketing activities directed at the EU/EEA begin, this assessment will be revisited and, if required, the details of the designated representative will be published in this section.

11. How to exercise your rights

You may submit requests relating to the rights listed above through any of the following channels:

• Written application: deliver a wet-signed petition in person or by post to Nidakule-Batı, Barbaros Mahallesi, Begonya Sk. No:1/2, 34746 Ataşehir / İstanbul, Türkiye.
• E-mail: send your request from the e-mail address registered in our systems to info@bts-tr.com.
• Registered e-mail (KEP), secure electronic signature or mobile signature to btsbilisimegitim@hs01.kep.tr.
• Any other method accepted under applicable legislation.

Your application should contain the following information:

• Your first and last name, and your signature for written applications
• Turkish ID number for citizens of the Republic of Türkiye; nationality, passport number or, where available, identity number for foreign nationals
• Your residential or business address for notification purposes
• Your e-mail address, telephone and fax number for notification, if any
• The subject of your request

Applications are concluded within 30 days at the latest under the KVKK. Requests under the GDPR are answered within one month at the latest; where necessary because of the complexity or number of requests, this period may be extended by a further two months, and you will be informed of the extension and its reasons within one month.

We may ask you for reasonable additional information in order to verify your identity; no more personal data than necessary will be requested for this purpose.

For general questions you can write to info@bts-tr.com.