Document Owner: KARACATEK YAZILIM VE ELEKTRONİK ANONİM ŞİRKETİ

Version: 1.0

Effective Date: 10 July 2026

​

1. Purpose

​

This Personal Data Protection and Processing Policy (the “Policy”) has been prepared to set out the fundamental principles governing the protection and processing of personal data by KARACATEK YAZILIM VE ELEKTRONİK ANONİM ŞİRKETİ (the “Company” or “Karacatek”) in accordance with the Law No. 6698 on the Protection of Personal Data (the “Law” or “KVKK”) and the applicable legislation. The Company attaches importance to processing personal data lawfully, securely and transparently, for specified purposes and in a limited and proportionate manner, and regards the protection of personal data as part of its corporate responsibility.

​

2. Scope

 

This Policy sets out the general principles applicable to the processing of personal data relating to natural persons who interact with the Company in the following capacities: online users of the Karacatek website, persons who contact the Company through the contact form on the website or by e-mail, customers and prospective customers, and their representatives and employees, suppliers and business partners, and their representatives and employees, candidates applying for employment or internships, other natural persons who communicate with the Company in connection with any legal or commercial relationship. This Policy does not apply to information relating to legal entities. However, information relating to identified or identifiable natural persons acting on behalf of legal entities may constitute personal data under the KVKK.

​

3. Legal Basis

 

This Policy has been prepared within the scope of the Law No. 6698 on the Protection of Personal Data.

 

4. Definitions

 

Explicit Consent: Consent relating to a specific matter, based on information and expressed by free will.

Data Subject: The natural person whose personal data is processed.

Personal Data: Any information relating to an identified or identifiable natural person.

Processing of Personal Data: Any operation performed on personal data, including collection, recording, storage, retention, alteration, disclosure, transfer, classification, restriction of use or deletion.

Special Categories of Personal Data: The categories exhaustively listed in Article 6 of the Law, namely data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by the data controller.

Data Controller: A natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system. For the purposes of this Policy, Karacatek is the data controller.

​

5. Fundamental Principles for Processing Personal Data

 

When processing personal data, the Company complies with the following principles set out in Article 4 of the Law: lawfulness and compliance with the principles of good faith, accuracy and, where necessary, keeping data up to date, processing for specified, explicit and legitimate purposes, being relevant, limited and proportionate to the purposes for which the data is processed, retention for the period prescribed by applicable legislation or required for the purpose of processing.

 

6. Personal Data Processed and Relevant Processing Activities The Company processes only the personal data necessary in view of the nature of its activities and the data subject’s relationship with the Company. The principal processing activities are set out below.

​

6.1. Use of the Website

 

For the secure and technical operation of the website, the IP address, date and time of connection, browser and device information, traffic and transaction logs, and technical information relating to strictly necessary cookies may be processed by automated means. Such data is processed to ensure information security, operate systems, detect errors and misuse, comply with legal obligations and, where necessary, establish, exercise or protect legal rights.

6.2. Contact Form and Communication Channels

The contact form on the Karacatek website requests the individual’s first name, surname, e-mail address, telephone number, service of interest and message content. Information submitted by e-mail or through other communication channels may also be processed. Such data is processed to respond to requests and enquiries, provide information about products and services, establish or manage business and customer relationships, manage quotation and meeting processes, conduct communications and protect legal rights.

6.3. Employment and Internship Applications

Applications for employment or internships may be submitted by sending a CV to info@karacatek.com, using online application links shared by the Company or through career platforms. In this context, identity and contact details, educational information, professional experience, competencies, certificates and references included in the candidate’s CV and application documents, together with any other information voluntarily provided by the candidate, may be processed. Candidates are requested not to include special categories of personal data that are not necessary for evaluating the application in their CVs or attachments. Special categories of personal data submitted unnecessarily or disproportionately will not be taken into consideration and may be deleted where no lawful processing condition applies. Candidate data is processed to evaluate the application, communicate with the candidate, identify suitable positions, conduct interview and recruitment processes and protect legal rights.

6.4. Commercial and Corporate Communications

The names and surnames, positions/titles, corporate contact details, correspondence, requests and quotation information relating to representatives or employees of customers, prospective customers, suppliers and business partners may be processed to conduct pre-contractual discussions, establish and manage commercial relationships and administer communications, contracts and legal processes.

​

7. Methods and Legal Grounds for Collecting Personal Data

Personal data may be collected through the website and cookies, contact forms, e-mail, telephone, written applications, online application links, career platforms, contract and quotation processes, and documents submitted directly by the data subject or by the organisation that the data subject is authorised to represent, by automated, partially automated or non-automated means provided that the data forms part of a data filing system. Depending on the relevant processing activity, personal data is processed on the basis of one or more of the following legal grounds set out in Article 5 of the Law: processing is expressly provided for by law, processing is directly related to the establishment or performance of a contract, processing is necessary for the Company to comply with its legal obligations, the data has been made public by the data subject and is processed in accordance with the intention of making it public, processing is necessary for the establishment, exercise or protection of a right, processing is necessary for the legitimate interests of the Company, provided that the fundamental rights and freedoms of the data subject are not adversely affected, the data subject has given explicit consent where no other processing condition applies. Compliance with the obligation to inform is not conditional upon obtaining explicit consent. Explicit consent is obtained freely and only for processing activities for which no other processing condition is available under the Law.

​

​

8. Processing of Special Categories of Personal Data

 

The Company does not request special categories of personal data through the website contact form. Such data is processed only where one of the processing conditions set out in Article 6 of the Law applies and the adequate safeguards determined by the Personal Data Protection Board have been implemented.

 

9. Transfer of Personal Data

9.1. Domestic Transfers The Company does not sell personal data or disclose it to third parties for advertising or marketing purposes. Personal data may be transferred, only to the extent necessary for the performance of a specific business process and in accordance with the conditions set out in Article 8 of the Law, to information technology and infrastructure service providers subject to confidentiality and data security obligations, legal and financial advisers, parties to a contract, or public authorities and institutions authorised by law. The Company does not currently carry out regular or general transfers of personal data to group companies, subsidiaries, factoring companies, virtual point-of-sale providers, travel agencies or similar recipient groups. If such a process is introduced, this Policy and the relevant privacy notices will be updated.

9.2. Cross-Border Transfers In connection with the use of website, e-mail, hosting, cloud or technical infrastructure services, personal data may be processed by service providers located abroad or accessed from outside Türkiye. Cross-border transfers of personal data are carried out in accordance with Article 9 of the Law and the applicable legislation, on the basis of an adequacy decision, an appropriate safeguard, or, where applicable, one of the exceptional circumstances specified by law. The Company limits cross-border transfers to the data, purposes and duration necessary for the provision of the relevant service and reviews its service providers and transfer arrangements in light of changes in legislation and technical infrastructure.

​

10. Cookies

Strictly necessary cookies may be used to enable the website’s core functions, ensure its security and remember user preferences. If non-essential analytical, functional or advertising/marketing cookies are used, data subjects will be provided with clear and intelligible information about those cookies and active consent will be obtained where required under the Law. Details of the types, purposes, providers and retention periods of cookies will be explained in a separate Cookie Notice/Cookie Policy. Users may change their preferences regarding non-essential cookies through the cookie panel available on the website.

 

11. Security of Personal Data

 

Pursuant to Article 12 of the Law, the Company implements technical and administrative measures proportionate to the nature of its activities and the data processed in order to prevent unlawful processing of and access to personal data and to ensure its secure retention. Such measures may include restricting access rights, using strong passwords and account security controls, maintaining up-to-date software, backups, logging and incident monitoring, employee awareness, confidentiality obligations, and assessing the security and confidentiality terms applicable to service providers. If the Company determines that processed personal data has been unlawfully obtained by third parties, it will carry out the necessary notification and response procedures in accordance with the applicable legislation.

 

12. Retention and Disposal of Personal Data The Company retains personal data for the periods prescribed by applicable legislation. Where no specific retention period is prescribed, personal data is retained only for as long as necessary to fulfil the purposes of processing and to establish, exercise or protect legal rights. When the grounds requiring the processing of personal data cease to exist, the data is deleted, destroyed or anonymised by the Company ex officio or at the request of the data subject, in accordance with the applicable legislation.

​

13. Rights of the Data Subject

 

Under Article 11 of the Law, data subjects may apply to the Company to:

learn whether their personal data is processed, request information if their personal data has been processed, learn the purpose of processing and whether their personal data is used in accordance with that purpose, know the third parties to whom their personal data has been transferred in Türkiye or abroad, request correction of incomplete or inaccurate personal data, request deletion or destruction of personal data under the conditions set out in Article 7 of the Law, request that correction, deletion or destruction operations be notified to third parties to whom the data has been transferred, object to any result arising to their detriment through the analysis of processed data exclusively by automated systems, claim compensation for damages suffered as a result of the unlawful processing of personal data and exercise the related rights provided under the Law.

​

14. Application Procedure and Contact Details

 

Requests under the KVKK may be submitted to the Company by one of the following methods, in a manner that clearly establishes the applicant’s identity and request:

 

Written application: Ankara Teknopark TGB Yerleşkesi, İvedik OSB Mahallesi, 2224. Cadde, No: 1/116 (15/B), B Blok, Üst Zemin Kat, Yenimahalle/Ankara/Türkiye

 

Registered electronic mail (KEP): karacatek.yazilim@hs01.kep.tr

 

Application from an e-mail address previously registered in the Company’s systems: info@karacatek.com

 

Electronic application using a secure electronic signature or mobile signature in accordance with the applicable legislation. The application must include the applicant’s full name, signature for written applications, Turkish national identity number for citizens of the Republic of Türkiye, passport or identity number for foreign nationals, address or e-mail address for notification, the details of the request, and any information and documents supporting the request. The Company will respond to applications free of charge as soon as possible and no later than thirty days, depending on the nature of the request. If responding to the request incurs an additional cost, the fees set out in the tariff determined by the Personal Data Protection Board may be charged. 15. Amendments and Entry into Force This Policy enters into force on the date it is published by the Company. It may be amended to reflect changes in legislation, the Company’s activities, or the information technologies and service providers used. The current version of the Policy will be published on the website.

 

Data Controller: KARACATEK YAZILIM VE ELEKTRONİK ANONİM ŞİRKETİ

 

Website: www.karacatek.com

 

E-mail: info@karacatek.com

 

Address: Ankara Teknopark TGB Yerleşkesi, İvedik OSB Mahallesi, 2224. Cadde, No: 1/116 (15/B), B Blok, Üst Zemin Kat, Yenimahalle/Ankara/Türkiye

​

​

​

​