STRINGS
KVKK Privacy Notice
Last updated: October 25, 2026This privacy notice has been prepared by Strings as data controller pursuant to Article 10 of Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. Its purpose is to inform you about which personal data we process, for what purpose and on what legal basis, to whom we may transfer it, and your rights in this regard.
1. Identity of the Data Controller
2. Categories of Personal Data Processed
| Data category | Data processed |
|---|---|
| Identity | First name, last name |
| Contact | Email address, phone number (if you share it), the name of your organization/company |
| Customer transaction | Request and complaint records, correspondence relating to quotes and contracts |
| Transaction security | IP address, browser and device information, access date and time, server logs, cookie records |
| Professional experience (job applications only) | Education, work experience and skills included in your CV |
| Finance (only for customers with a contract) | Invoice and payment information, tax/trade registry information |
No special categories of personal data are collected through our site. Please do not include special category information such as health, biometric data, religion or union membership in the contact form or your emails.
3. Purposes of Processing Personal Data
- Responding to requests, questions and quote requests you send via the contact form, email or phone,
- Providing information about our products and services, preparing quotes and conducting negotiations,
- Concluding and performing contracts, managing project and support processes,
- Carrying out finance and accounting operations, invoicing and collection processes,
- Evaluating job applications for open positions and conducting recruitment processes,
- Keeping the website running and secure, preventing unauthorized access and misuse,
- Fulfilling obligations arising from legislation and responding to requests from competent authorities.
4. Collection Method and Legal Grounds
Your personal data is collected through the contact form on our website, email correspondence, phone calls, contract and quote documents, and the web server and cookies — by fully or partially automated means, or by non-automated means as part of a data filing system.
| Legal ground (Law Art. 5) | Related processing activity |
|---|---|
| Art. 5/2-c — Directly related to the conclusion or performance of a contract | Quotes, contracts, project execution, support and job application processes |
| Art. 5/2-ç — Fulfilment of the data controller's legal obligation | Invoicing, retention of ledgers and documents, responses to competent authorities |
| Art. 5/2-f — Legitimate interest, provided it does not harm the data subject's fundamental rights and freedoms | Responding to contact requests, site security and keeping log records |
| Art. 5/2-e — Necessary for the establishment, exercise or protection of a right | Retaining correspondence and records that may be used as evidence in case of a dispute |
| Art. 5/1 — Explicit consent | Non-essential cookies and retaining your application for future positions |
5. Transfer of Personal Data
Your personal data may be transferred to the following parties in accordance with the conditions in Article 8 of the Law and limited to the purpose:
- Suppliers and service providers: companies providing us with hosting, email and infrastructure services (as data processors),
- Professional advisors: accountants, legal counsel and independent auditors,
- Business partners: only where we need to work together to perform the contract with you, and with your knowledge,
- Competent public authorities: where there is a request or obligation arising from legislation.
Your personal data is not sold, rented or transferred to third parties for marketing purposes.
6. International Transfers
The servers of some technical service providers we use may be located abroad. In addition, due to our European operations in Zurich and our products for the DACH market, data may need to be shared with partners based abroad in certain projects. Such transfers are carried out in accordance with the conditions in Article 9 of the Law (country with adequate protection, written undertaking or standard contract, and explicit consent where necessary).
7. Retention and Destruction
Your personal data is retained for as long as necessary for the purpose for which it is processed and for the minimum periods required by the relevant legislation. The main periods are as follows:
| Data type | Retention period |
|---|---|
| Contact form messages and email correspondence | 2 years from the conclusion of the correspondence |
| Contracts, invoices and commercial ledger records | 10 years (Turkish Commercial Code Art. 82 and Tax Procedure Law Art. 253) |
| Job applications and CVs | 1 year from the application |
| Server access (log) records | Up to 12 months |
Once the period expires, your personal data is deleted, destroyed or anonymized.
8. Your Rights as a Data Subject (Law Art. 11)
By applying to the data controller, you have the following rights:
- To learn whether your personal data is being processed,
- To request information if it has been processed,
- To learn the purpose of processing and whether it is used in line with that purpose,
- To know the third parties in Türkiye or abroad to whom your data is transferred,
- To request correction if it is incomplete or incorrectly processed,
- To request deletion or destruction within the framework of the conditions in Article 7 of the Law,
- To request that correction, deletion and destruction be notified to third parties to whom your data was transferred,
- To object to a result against you arising from analysis exclusively through automated systems,
- To request compensation if you suffer damage due to unlawful processing
— all under Article 11 of the Law.
9. Application Procedure
You can submit requests regarding the rights above through the following channels, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- Email: info@stringsco.com with the subject line "KVKK Başvurusu" (KVKK Application),
- In writing: With a wet-signed petition sent to our headquarters at Medeniyet Teknopark Üsküdar Alanı, Ünalan Mahallesi, Ünalan Caddesi No:1, A Blok D:1-CJ, Üsküdar / Istanbul.
Your application must include your full name, your signature if the application is in writing, your Turkish ID number if you are a Turkish citizen (otherwise your nationality and passport number), your address for notifications, your email address for notifications if any, and the subject of your request. Attaching information and documents related to your request speeds up the evaluation.
Your applications are finalized free of charge as soon as possible depending on the nature of the request, and within 30 days at the latest . If the process involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint within 30 days of learning of the response, and in any case within 60 days of the application date, with the Personal Data Protection Board.
10. Cookies and Other Notices
For detailed information about the cookies used on our website, see our Cookie Policy; for all of our data processing practices, see our Privacy Policy.
11. Changes to This Notice
This privacy notice may be updated in line with changes in legislation or our business processes. The current version is always published on this page, and the "last updated" date at the top of the page is refreshed.
STRINGS
Your end-to-end solution partner in software and mobile technologies. Mobile, enterprise, AI-powered automation and consulting.