Personal Data Protection Notice
Issued under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. This is a courtesy translation; in case of conflict the Turkish version prevails. Last updated: 2026-09-05
1. Data controller
Your personal data is processed by Aydinfo ("Aydinfo", "we") as data controller within the meaning of KVKK, as described below.
- Legal name
- Aydinfo
- Address
- İstanbul, Türkiye
- info@aydinfo.com
2. Who this notice covers
- Website visitors: anyone visiting www.aydinfo.com.
- Contact form users and prospects: people who reach us through the contact form, e-mail or social media, and representatives of the organisations they act for.
- Customers and partners: staff and signatories of organisations we have a service agreement with.
- Training participants and parents: participants in our software training programmes and the parents or guardians of participants under 18.
3. What data we collect and how
| Category | Examples | Collection method |
|---|---|---|
| Identity | Name, surname | Contact form, e-mail, meeting notes |
| Contact | E-mail address, phone number, company name and title | Contact form, e-mail, business card, social media message |
| Request and message content | Selected topic, message text, project need, budget and timing | Contact form, e-mail, meetings |
| Transaction security | IP address, country, browser and device information, access time, bot-verification result | Server and security logs (Cloudflare), automatically |
| Training information | Age group, level, goals, lesson schedule, progress notes, assignments and project outputs | Introductory lesson, lessons, e-mail |
| Parent information | Parent's name, contact details, relationship to the participant | Conversations and correspondence with the parent |
| Financial | Invoicing details, payment record (card data is never stored) | Contracting and invoicing |
The website has no accounts, newsletter, comments or live chat. We do not request special categories of data (health, religion, biometrics etc.); please do not include such data in forms or messages.
4. Purposes and legal bases
Your data is processed only for the purposes below, on the legal bases in Article 5(2) of KVKK stated next to each. No processing relies on explicit consent; if a situation requiring explicit consent arises, it will be requested separately and freely.
| Purpose | Legal basis (KVKK Art. 5/2) |
|---|---|
| Responding to your enquiries; scheduling quotes, demos and preliminary analysis calls | (c) necessary for establishing or performing a contract; (f) legitimate interest |
| Concluding, performing and invoicing service and training agreements | (c) contract; (ç) legal obligation (tax and commercial law) |
| Planning a personalised training programme, tracking progress, informing parents | (c) performance of a contract |
| Securing the website, preventing abuse and bot traffic | (f) legitimate interest; (ç) obligations under Law No. 5651 |
| Measuring site usage with cookieless, aggregated statistics | (f) legitimate interest; no identifying data is stored |
| Responding to legal requests, establishing evidence in disputes | (ç) legal obligation; (e) establishing, exercising or protecting a right |
5. Transfers
We do not sell, rent or share your data for marketing. Data may be transferred only to the following recipients for the stated purposes:
- Infrastructure and hosting providers: the website runs on Cloudflare, Inc. infrastructure; contact form messages are converted to e-mail via Cloudflare and delivered to our business mailbox provided by Google LLC (Google Workspace). These providers' servers may be located abroad.
- Online lesson and meeting tools: video-call and messaging tools used for training and meetings (e.g. Google Meet, Microsoft Teams, Zoom), chosen together with you.
- Accountant and public authorities: invoicing, bookkeeping and tax obligations; lawful requests from courts, prosecutors or regulators.
International transfers: because of the providers above, your data may be transferred outside Türkiye. Such transfers are made under Article 9 of KVKK, based on the standard contract published by the Personal Data Protection Board and data processing agreements with the providers, with appropriate technical and organisational safeguards.
6. Retention
- Contact form and e-mail correspondence: up to 2 years after last contact; longer if it becomes part of a contract record.
- Contracts, invoices and accounting records: 10 years under the Turkish Commercial Code and Tax Procedure Law.
- Training records (programme, progress notes, project outputs): up to 2 years after the programme ends; certificate records 10 years.
- Server and security logs: up to 30 days; traffic records required by Law No. 5651 for their statutory period.
At the end of these periods data is deleted, destroyed or anonymised in line with Article 7 of KVKK and the related regulation.
7. Children
Participants under 18 are accepted to training programmes only through a parent's application and consent. Information about them is collected through the parent, to the extent needed to deliver the training. Parents may exercise the rights in section 9 on their child's behalf. We do not knowingly collect data from children through the website.
8. Security
Data is transmitted over TLS-encrypted connections; server access is restricted with authorisation and multi-factor authentication; the contact form is protected against bots; only people who need the data for their role can access it. We take the technical and organisational measures required by Article 12 of KVKK and, in the event of a breach, notify the Board and affected persons within the statutory period.
9. Your rights under Article 11 of KVKK
By applying to us, you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether the data is used in line with it,
- know the third parties to whom the data is transferred, in Türkiye or abroad,
- request correction of incomplete or inaccurate data,
- request deletion or destruction of the data under the conditions in Article 7 of KVKK,
- request that corrections, deletions and destructions be notified to the third parties the data was transferred to,
- object to a result against you produced exclusively by automated analysis,
- claim compensation for damage caused by unlawful processing
as set out in Article 11 of KVKK.
10. How to apply
Submit applications in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, together with information identifying you:
- by e-mail to info@aydinfo.com with the subject "KVKK Application", or
- in writing to the postal address above (via notary or registered mail)
Applications are answered free of charge within 30 days at the latest; a fee from the Board's tariff may apply where a cost is incurred. If your application is rejected, answered insufficiently or not answered in time, you may lodge a complaint with the Personal Data Protection Board.
11. Changes
This notice may be updated as legislation or our services change; the current version is always published here with its date. See the Privacy & Cookie Policy for cookies and site usage details.