Privacy Policy

Last updated: May 2025

1. Data Controller

This Privacy Policy has been prepared by TUGAY Siber Savunma Sistemleri A.S. ("TUGAY", "we", "the company"). Our company acts as a data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).

Address: Sanayi Mahallesi Teknopark Bulvari Teknopark No:1/4C/Z08 Pendik / Istanbul
Email: info@tugay.com.tr
Phone: 0216 606 44 77

2. Personal Data We Collect

The following personal data may be processed when you visit our website or use our services:

• Identity data: First name, last name
• Contact data: Email address, phone number, company name
• Technical data: IP address, browser type, pages visited, session information
• Form data: Information submitted through the contact form and penetration testing request form

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Evaluating and responding to your service requests
• Preparing proposals and managing contractual processes
• Improving service quality
• Fulfilling legal obligations
• Ensuring website security

4. Legal Basis

Your personal data is processed on the basis of the data subject's explicit consent, the establishment or performance of a contract, the legitimate interests of the data controller, and legal obligations.

5. Data Retention Periods

Your personal data is retained for the duration required by the purpose of processing and in accordance with statutory retention obligations. A general retention period of 10 years applies from the termination of the business relationship.

6. Data Security

Technical and administrative measures are taken to protect your personal data. Data is transmitted via encrypted channels and protected against unauthorized access. As a company specializing in cybersecurity, we are committed to maintaining the highest level of data security.

7. Sharing with Third Parties

Your personal data is not shared with third parties for commercial purposes without your explicit consent. Limited transfers may occur only in cases of legal obligation, service providers (such as email infrastructure), or official authority requests.

8. Rights of Data Subjects

Under KVKK Article 11 and GDPR Articles 15–22, you have the following rights:

• To learn whether your personal data is being processed
• To request information about the processing of your data
• To learn the purpose of processing and whether it is being used in accordance with that purpose
• To know the third parties to whom your data is transferred domestically or internationally
• To request the correction of incomplete or inaccurate data
• To request the deletion or destruction of your data
• To request notification of correction, deletion, and destruction to third parties
• To object to analysis conducted through automated systems
• To claim compensation for damages you have suffered

To exercise these rights, you may submit a written request to info@tugay.com.tr.

9. Policy Changes

This policy may be updated from time to time. Significant changes will be announced via the website. We recommend reviewing the current policy regularly.