KVKK Clarification Text.

1. Data Controller

Under Law No. 6698 on the Protection of Personal Data (KVKK), the data controller is Hydroport Mühendislik A.Ş., whose contact details are given below.

• Trade name: Hydroport Mühendislik Sanayi ve Ticaret A.Ş.
• Address: Çerkeşli OSB Mah. İmes 1 Bulvarı No 2/6, 41455 Dilovası / Kocaeli
• E-mail: info@hydroport.com.tr
• Telephone: +90 262 502 06 13 · +90 538 983 1290
• Registered e-mail (KEP): hydroport@hs03.kep.tr

2. Personal Data Processed

At Hydroport we process the following categories of personal data:

• Identity data: first name, surname, company name
• Contact data: e-mail address, telephone number, postal address
• Customer transaction data: quotation requests, order history, invoice details
• Transaction security data: IP address, cookie data, session records, error and diagnostic (log) records
• Marketing data: communication preferences, within the scope of explicit consent

3. Methods of Collecting Personal Data

We collect your personal data through the following channels:

• The contact form on our website
• Correspondence by e-mail or telephone
• Business cards and documents shared at trade fairs, industry events and B2B meetings
• Customer commercial contracts and quotation requests
• Cookies and analytics tools used on our site (see the Cookie Policy for details)

Your data is processed both physically and digitally, by automated or partly automated means.

4. Purposes of Processing Personal Data

Within the scope of Articles 5 and 6 of the KVKK, we process your personal data for the following purposes:

• Evaluating and responding to your quotation requests
• Formation and performance of the contract — order, shipment and technical support processes
• Management of customer relations, after-sales service and warranty processes
• Fulfilment of legal obligations — invoicing, ETBİS notification, tax legislation
• Security of the website and statistical analysis
• Marketing and announcements within the scope of explicit consent (newsletter)

5. Transfer of Personal Data

We share your personal data with third parties only in the following limited cases:

• Authorised public institutions and organisations — due to legal obligations (courts, tax office, the Personal Data Protection Board)
• Cloud infrastructure providers — fly.io Inc. (a US company; servers in the Frankfurt/fra region) for site hosting, Supabase Inc. (USA) for the database. The transfer is carried out within the scope of Article 9 of the KVKK, under standard contractual clauses and with adequate technical and administrative safeguards.
• Bot and spam protection providers — the Turnstile service of Cloudflare Inc. (USA)
• Analytics and advertising provider — Google Ireland Ltd. / Google LLC (USA), anonymous traffic and usage analytics via Google Analytics 4 and advertising measurement via Google Ads; acting as a data processor — analytics and advertising are separate consent categories. Unless consent is given, no cookie is placed on your device and your visits are not linked to one another; only a cookieless, non-identifying measurement signal (covering page views as well as interaction events such as form submissions, product views and clicks on contact links) is sent. That signal contains the technically necessary connection information (including your IP address) and is turned into aggregate statistics by Google. The transfer is carried out within the scope of Article 9 of the KVKK, under Standard Contractual Clauses (SCC).
• Error monitoring provider — Sentry (Functional Software, Inc., a US company; servers in the Germany/EU region), which processes technical data (error message, browser and device information, IP address) in order to monitor and resolve application errors. The transfer is carried out with adequate safeguards within the scope of Article 9 of the KVKK.
• E-mail delivery provider — Resend (Resend, Inc., a US company), used to deliver contact form notifications by e-mail. The transfer is carried out with adequate safeguards within the scope of Article 9 of the KVKK.
• Independent auditors and advisers — under a non-disclosure agreement (NDA)

When your data is transferred abroad, adequate security measures are taken within the scope of Article 9 of the KVKK.

6. Retention Periods

Your personal data is retained for as long as the processing purpose requires, or for the period stipulated in the relevant legislation:

• Contact form records: 3 years (KVKK + ETBİS obligation)
• Contract and invoice data: 10 years (Article 82 of the Turkish Commercial Code)
• Cookie data: maximum 3 years (details in the Cookie Policy)
• Marketing consents: until consent is withdrawn

At the end of the period, your personal data is anonymised or erased.

7. Rights of the Data Subject (KVKK Art. 11)

Under Article 11 of Law No. 6698 you have the following rights:

• To learn whether your personal data is being processed
• To request information if it has been processed
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties to whom the data is transferred in Turkey or abroad
• To request rectification if the data has been processed incompletely or incorrectly
• To request erasure or destruction within the conditions of the Law
• To request that rectification, erasure and destruction requests be notified to third parties
• To object to a result to your detriment arising from analysis carried out exclusively by automated systems
• To request compensation for the damage if you suffer loss due to unlawful processing

8. Application Channels

You may submit applications under Article 13 of the KVKK through the following channels:

• E-mail: kvkk@hydroport.com.tr (please send from your registered e-mail address)
• KEP: hydroport@hs03.kep.tr
• Post: Çerkeşli OSB Mah. İmes 1 Bulvarı No 2/6, 41455 Dilovası / Kocaeli — with the note "Personal Data Application" on the envelope
• In person: at the same address, with identity verification

Under Article 13/2 of the KVKK, your applications are answered free of charge within 30 days at the latest. If your application is rejected, your right to complain to the Personal Data Protection Board is reserved.

9. Updates

This clarification text may be updated due to changes in legislation or in our business processes. The effective date is stated at the top of the page.