01Data controller
The name supplied for this draft is Cynlume LTD. ŞTİ., operating under the Cynlume brand. Address: Esentepe Mah. Talatpaşa Cad. No:5/1 Şişli / İstanbul. Contact: info@cynlume.com; +90 (850) 840 6690. The complete trade registry name, MERSİS number and tax office must be verified before adoption.
02Categories, purposes and method of collection
Business contacts may provide their name, employer, work email, role, requested service, indicative budget and project summary. These are collected directly from the contact person through a deliberately sent email or, if activated, the online enquiry form. Technical request data may be processed by hosting and security services.
The purposes are evaluating an enquiry, arranging a response, conducting preliminary commercial discussions, securing the communication channel and handling relevant legal requests. Source code, credentials, identity-document uploads and special-category personal data are not requested. Current email-draft mode prepares the message locally and does not record form content on the website.
03Legal basis
The relevant Article 5 condition must match the actual processing: contractual steps where directly connected with a contract of the person concerned; legitimate interests for appropriate business-contact handling subject to fundamental rights; and legal obligations or protection of rights where applicable. Consent must not be used as a blanket substitute for this assessment.
Acknowledging receipt of this notice is separate from consent. This form does not request marketing permission or unrestricted overseas-transfer consent.
04Recipients and overseas transfers
Information may be shared, where necessary and lawfully justified, with authorised personnel, hosting and email service providers, professional advisers and competent authorities. Enquiry information is not sold.
Hosting and email services may entail overseas processing. Before regular online intake is activated, the company must identify the applicable providers and locations and implement the appropriate Article 9 transfer mechanism and related obligations. A general acknowledgement of this notice does not establish a lawful recurring transfer arrangement.
05Retention and safeguards
The proposed period for non-contractual enquiries is no more than 180 days after the last relevant interaction unless an applicable legal requirement or substantiated dispute supports further retention. Contractual records require a separate schedule. Actual mailbox, database and backup operations must implement the adopted schedule.
Access should be limited to authorised personnel; suitable technical and organisational measures and a documented deletion process must be maintained. The online intake prepared for this site includes validation, limited technical metadata and restricted public access.
06Article 11 rights
You may ask whether data concerning you are processed; request information on that processing and its purposes; learn the relevant domestic and overseas recipients; seek correction of inaccurate or incomplete data; and request erasure or destruction when the legal conditions are met.
You may also seek notification of qualifying corrections or deletions to recipients, object to an adverse result produced exclusively by automated analysis, and seek compensation for harm arising from unlawful processing. These rights remain subject to the applicable statutory conditions.
07How to apply
Send a written, signed request to Esentepe Mah. Talatpaşa Cad. No:5/1 Şişli / İstanbul. The electronic methods permitted by the applicable KVKK application rules may also be used, including the email address previously supplied and registered in our systems, where that condition is satisfied. info@cynlume.com can help you identify the appropriate route; ordinary unverified email may require identity verification.
A formal request should identify the applicant, include the contact and request details required by the applicable communiqué, and be signed where required. Use an agreed secure method for sensitive verification information. Applications are addressed without undue delay and within 30 days at the latest, with any permitted fee determined only under the applicable rules. If the statutory conditions are met after the controller application, you may complain to the Personal Data Protection Board. Access to other legal remedies is preserved.
08Status of this text
This English text accompanies the Turkish KVKK Information Notice. Both are review drafts dated 5 September 2026. The company must confirm the controller identity and the actual processing and transfer arrangements before adoption; the Turkish statutory requirements govern their application.