Privacy notice

Data controller

The data controller is the ordinary partnership of Berat Can Kara and Hazar Aliyazıcıoğlu, operating under the MitraBit brand. You can reach us at contact@mitrabit.com.

What personal data do we process?

When you use the contact form:

• Identity: your first name and surname.
• Contact: your email address.
• Customer transaction: your company name (optional), the solutions you are interested in, the information you share in your message, and the language in which you submit the form.

When you visit the site:

• Transaction security: your IP address, the time of your visit, the page address requested and browser information (server access logs).

Please do not share special categories of personal data such as health, religion or ethnic origin, or data about other people that is not relevant to your request, in your message.

For what purposes do we process your personal data?

• To respond to the request you send through the contact form and to get in touch with you.
• To prepare a proposal based on your request and to carry out the preliminary meeting process.
• To keep the site secure, and to prevent and detect abuse, excessive submissions and unwanted submissions.

We do not use your data for any other purpose, for example to send marketing messages.

How and on what legal grounds do we collect your personal data?

Method of collection: Form data is collected electronically and directly from you when you fill in and submit the form. Transaction security data is collected by automated means by our server while you visit the site.

Legal grounds: Your data is processed on the following legal grounds under Article 5(2) of the KVKK:

• Point (c): processing the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract. Your proposal and preliminary meeting requests fall under this ground.
• Point (f): processing is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms. Responding to general questions that are not proposal requests, and keeping the site secure, fall under this ground.

The legal ground for transferring contact form data abroad is explained separately below, under “Transfers abroad”.

To whom and for what purpose do we transfer your personal data?

• Our hosting provider (Türkiye): The site is hosted on a server in Türkiye. Server access logs and form data are processed on this server so that the site can run and stay secure.
• Google (Google Workspace email service): When you submit the form, our server turns the form details into an email message and sends it to contact@mitrabit.com through the Google Workspace email infrastructure (SMTP relay service). Our contact@mitrabit.com mailbox is also on Google Workspace; the message is stored there so that we can reply, and we reply to you from this address. The purpose is to deliver your request to us, store it and get back to you.
• Infrastructure services (Cloudflare, domain name service): We use Cloudflare for the DNS service of the mitrabit.com domain, that is, the service that maps the domain name to our server’s address. When you open the site, this lookup reaches Cloudflare’s name servers through the DNS resolver you use (usually your internet service provider). Site traffic and form data do not pass through Cloudflare; they go directly to our server in Türkiye. If we start using Cloudflare’s proxy service for security or performance in the future, your IP address and request details may pass through Cloudflare; in that case we will update this notice in advance.
• Authorised public institutions and organisations: Only where a legal obligation requires it, upon request by legally authorised institutions, and limited to the scope of that request.

Other than this, your personal data is not shared with third parties, sold or made available for marketing purposes. Google is a service provider that processes the data on our behalf and in line with our instructions.

Transfers abroad

Google is a company established abroad, and the servers of its email infrastructure are located abroad. For this reason, the information you send through the contact form (full name, email address, company name, the solutions you are interested in and your message) is delivered through Google’s servers and stored there. This is a transfer of personal data abroad within the scope of Article 9 of the KVKK. Server access logs are not transferred abroad.

There is no adequacy decision by the Personal Data Protection Board for the countries concerned and, as of the date of this notice, no standard contract has been signed with Google. For this reason, your form data is transferred abroad on the basis of your explicit consent under Article 9(6)(a) of the KVKK, provided that you have been informed of the possible risks. You give your explicit consent through the separate checkbox on the form.

Possible risks: The level of personal data protection in the destination countries may not match that in Türkiye; public authorities in those countries may request access to the data under their own laws; and exercising your rights and seeking legal remedies in those countries may not be as easy as in Türkiye.

You can withdraw your explicit consent at any time by writing to contact@mitrabit.com. Withdrawal does not affect the lawfulness of transfers made before that date. If you do not wish to give consent, you can reach us by phone at the numbers shown on the site instead of using the form; in that case your data is not transferred abroad.

How long do we keep your personal data?

• Form messages and correspondence: At most 2 years after your request is concluded. If your request leads to a contract, the related correspondence is kept together with the contract records for the retention periods set out in the applicable laws.
• Server access logs: 14 days.
• IP address for abuse prevention: To prevent excessive submissions, your IP address is held only in the server’s memory for 10 minutes; it is not stored permanently.

At the end of these periods your data is deleted, destroyed or anonymised.

Cookies and browser storage

The site does not use cookies or similar tools for advertising, analytics or tracking. For its own operation only, the site writes a few small entries that do not identify you to your browser’s storage: your preference for animated visuals being on or paused (local storage), and session information such as scroll position and page transitions (session storage, deleted when you close the browser tab). These entries are not sent to our server and can be deleted in your browser settings.

Your rights

Under Article 11 of the KVKK, you have the right to apply to the data controller to:

• Learn whether your personal data is processed,
• Request information about it if your personal data has been processed,
• Learn the purpose of processing your personal data and whether it is used in line with that purpose,
• Know the third parties in Türkiye or abroad to whom your personal data has been transferred,
• Request correction of your personal data if it is incomplete or inaccurate,
• Request deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
• Request that correction, deletion or destruction be notified to the third parties to whom your personal data has been transferred,
• Object to an outcome against you arising from the analysis of the processed data exclusively by automated systems,
• Claim compensation for damage you suffer as a result of the unlawful processing of your personal data.

Requests

You can send requests about your rights to the email address below, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your request must state your full name, your Turkish ID number if you are a citizen of Türkiye (or, if you are a foreign national, your nationality and passport or ID number), your residential or business address for notification purposes, your email address and telephone number for notification (if any), and the subject of your request. Requests are resolved free of charge as soon as possible and within 30 days at the latest, depending on their nature; if the action involves an additional cost, the fee set in the tariff of the Personal Data Protection Board may be charged. If your request is rejected, if you find the response insufficient or if no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the KVKK.

contact@mitrabit.com