KVKK Disclosure Notice

Turkish Law No. 6698 on the Protection of Personal Data ("the Law") requires a specific disclosure notice, separate from a general privacy policy. This page is the English rendering of that notice.

The Turkish version of this notice is the operative text for the purposes of Turkish law. Where the two differ, the Turkish version prevails.

Under the Law, Incuba is the data controller for personal data obtained through the contrac.tr website.

Data controller

Incuba

Address

To be completed before publication.

Tax office and number

To be completed before publication.

MERSIS number

To be completed before publication.

Email

[email protected]

Personal data is processed only when you send a service request through the site. No visitor account is created.

Identity

Full name.

Contact

Work email address, phone number (optional).

Professional experience and customer transaction

Your organization, the service requested, number of sites, expected start date and the explanations you provide in the free-text field.

Transaction security

Automatically generated server logs such as IP address, request time, requested address and browser information.

Special category personal data as defined in Article 6 of the Law is not requested through this site. Please do not enter health data, patient information or similar special category data in the free-text field.

• Receiving, assessing and responding to the service request submitted
• Determining the scope, timeline and responsibilities of the service
• Conducting pre-contractual discussions and proposal processes
• Carrying out and following up business activities if a contract is concluded
• Carrying out information security processes and keeping the site secure
• Making notifications to authorized persons, institutions and organizations as required by law
• Carrying out storage and archiving activities

Your personal data is collected electronically and automatically when you complete the request form on the site. Server logs are generated automatically by the infrastructure during your visit.

Article 5/2-c

Processing is directly related to the conclusion or performance of a contract: assessing your request and conducting pre-contractual discussions.

Article 5/2-ç

Processing is mandatory for the controller to fulfil its legal obligations: retention and notification obligations under law.

Article 5/2-f

Processing is necessary for the legitimate interests of the controller, provided that it does not harm your fundamental rights and freedoms: information and site security.

Your personal data is transferred only to the extent necessary to achieve the purposes above, to the following parties.

Within Türkiye

To competent public institutions where requested or required by law, and to our lawyers and financial advisers for the conduct of legal processes.

Abroad

To Vercel Inc. for hosting the site and to Resend (Plus Five Five, Inc.) for delivering request form submissions. Both providers are based in the United States.

Transfers abroad are made in accordance with Article 9 of the Law and related secondary legislation, using the required legal mechanisms. You can request detailed information about these transfers using the application route below.

Requests that do not become contracts

Up to 2 years after the assessment is completed.

Requests that become contracts

For the duration of the contractual relationship and, after it ends, for the limitation and retention periods set by law.

Server logs

Short term, per the retention policy of the infrastructure provider.

At the end of the retention period, personal data is deleted, destroyed or anonymized under Article 7 of the Law.

By applying to the data controller, you have the following rights in relation to yourself:

• To learn whether your personal data is processed
• To request information if your personal data has been processed
• To learn the purpose of processing and whether the data is used accordingly
• To know the third parties to whom the data is transferred, in Türkiye or abroad
• To request correction if the data is incomplete or incorrectly processed
• To request erasure or destruction under the conditions in Article 7 of the Law
• To request that correction, erasure and destruction be notified to the third parties to whom the data was transferred
• To object to a result against you arising from analysis carried out solely by automated systems
• To claim compensation if you suffer damage because the data was processed unlawfully

To exercise your rights, send your application to [email protected] or in writing to the address above.

Under the Communiqué on Application Procedures to the Data Controller, your application must include:

• Your name and surname, and your signature if the application is in writing
• Your Turkish ID number if you are a citizen of the Republic of Türkiye; otherwise your nationality, passport number or identification number if any
• Your place of residence or business address for notification
• Your email address, telephone or fax number for notification, if any
• The subject of your request

Your application is concluded free of charge as soon as possible and in any event within thirty days, depending on the nature of the request. Where the process requires additional cost, a fee from the tariff set by the Board may be charged.

If your application is refused, if you find the response inadequate, or if no response is given in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning the response and in any event within sixty days of the application date.