Privacy Notice (KVKK)

1. Data controller

Under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), the personal data you share through the application form on the LodosApps website is processed by the data controller identified below.

Data controller: [not yet provided]

Address: [not yet provided]

Email for KVKK requests: [not yet provided]

2. Personal data processed

When you send the application form, only the following data is processed:

• Identity: your full name.
• Contact: your phone number and email address.
• Request details: your business name, the services you are interested in and the message describing your needs.
• Transaction security: an irreversible keyed hash derived from your IP address (the IP address itself is not stored), browser information (user agent), the time of the application and a one-time form key that prevents duplicate submissions.
• Source of the application: the address of the page you came from (domain and path only), the first page you opened on the site and, if present in the link, campaign (UTM) parameters.
• Acknowledgement record: the date and time you confirmed reading this notice and the version of the notice and acknowledgement.

3. Purposes of processing

Your personal data is processed for the following purposes:

• To receive and assess your application and to contact you.
• To prepare a proposal and service process that fits your request, and to track your application in the Lodos team's customer records (CRM).
• To prevent misuse of the form, automated or spam submissions and duplicate applications (e.g. at most 5 applications per hour from the same network).
• To evaluate our promotional activities by measuring which page or campaign applications come from.
• To be able to provide the necessary records in legal disputes and upon request by competent authorities.

4. Method of collection

The data is collected electronically when you fill in and send the application form on the website. Transaction security data is transmitted automatically by your browser when the form is sent.

Information about the source of the application is kept only in your browser's session storage (sessionStorage) during your visit and is not sent to us unless you submit the form. No cookies are used for the application form.

Please do not include special categories of personal data (such as health, religion or political opinions) or other people's personal data in the message field.

5. Legal grounds

Request and contact data is processed under KVKK Art. 5/2(c), as it is directly related to establishing a service contract following your application.

Transaction security and application source data is processed under KVKK Art. 5/2(f), on the basis of our legitimate interest in keeping the form secure and evaluating our promotional activities, provided this does not harm your fundamental rights and freedoms.

These processing activities do not rely on your explicit consent; the checkbox on the form only records that you have read this notice.

6. Transfers

Your personal data is not sold and is not shared with third parties for marketing. Only authorised members of the Lodos team can access it.

The data is processed, to the extent the service requires, on the systems of the infrastructure providers we use to run the website and the application records (website hosting and database service, Supabase). The server location of these providers and, where necessary, the legal basis for transfers abroad under KVKK Art. 9 will be clarified in the legal review.

Where a legal obligation arises, the data may be transferred to competent public authorities requesting it, to the extent permitted by law.

7. Retention period

Retention and deletion periods are [not yet provided]. Until they are defined, applications are kept only for the purposes above; automatic deletion is not yet applied.

8. Data security

The main technical and organisational measures taken to protect your data:

• Site and form connections are encrypted (HTTPS).
• Only authenticated and authorised team members can access application records; row-level access rules are enforced in the database.
• All form fields are validated on the server; the IP address is kept only as a keyed hash.
• A submission limit and automated-submission traps are used against misuse.

9. Your rights under KVKK Art. 11

By applying to the data controller, you have the right to:

• Learn whether your personal data is processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether it is used in line with that purpose,
• Know the third parties in Türkiye or abroad to whom it is transferred,
• Request correction if it is incomplete or inaccurate,
• Request deletion or destruction under the conditions set out in KVKK Art. 7,
• Request that third parties to whom the data was transferred be notified of the correction, deletion or destruction,
• Object to a result against you arising exclusively from the analysis of the processed data by automated systems,
• Claim compensation for damages arising from unlawful processing

10. How to apply

You can send requests regarding your rights in writing, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, to [not yet provided] or to [not yet provided].

Your request will be concluded free of charge as soon as possible and within thirty days at the latest, depending on its nature; if the process involves an additional cost, the fee schedule set by the Personal Data Protection Board may apply.

11. Effective date

Effective date: [not yet provided]

This English text is provided for convenience; the Turkish version is the reference text.