Privacy Policy.

Deka Teknoloji Bilişim Hiz. ve Tic. A.Ş.
Aydınevler Mah. Durak Sok.
Ofisin Maltepe A Blok Kat 2
34854 Maltepe / Istanbul, Turkey

Phone: +90 216 606 69 57
Email: [email protected]

VERBİS registration number: 10183770 (Turkish Data Controllers Registry, pursuant to KVKK Art. 16).

Deka Technology has not appointed a Data Protection Officer (DPO) as the company does not fall within the mandatory categories under Art. 37 GDPR. For all data protection enquiries, please contact the address above.

This website is hosted on Cloudflare Pages and delivered via the Cloudflare CDN (Content Delivery Network). When you access our website, your request is routed through Cloudflare's global network. Cloudflare may process:

• IP address
• Browser type and version
• Requested URL and referrer
• Date and time of access
• Country of origin

This processing is necessary for the secure and efficient delivery of the website (Art. 6(1)(f) GDPR — legitimate interest; KVKK Art. 5(2)(f) — legitimate interest of the controller).

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare is certified under the EU-US Data Privacy Framework. For more information, see Cloudflare's Privacy Policy.

When visiting the website, technical data is automatically stored in server log files maintained by Cloudflare:

• IP address (anonymised after 24 hours)
• Browser type, version, and operating system
• Referrer URL
• Pages visited and time of access
• HTTP status code and data volume transferred

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in secure website operation. KVKK Art. 5(2)(f).

Retention: Log files are automatically deleted after 72 hours by Cloudflare.

When you contact us via the form on our website, we process the following data:

• Name
• Company name
• Email address
• Phone number (optional)
• Message content

Purpose: To respond to your enquiry and, where applicable, to initiate pre-contractual measures.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract or pre-contractual steps; Art. 6(1)(f) GDPR — legitimate interest. KVKK Art. 5(2)(c) and (f).

Retention: Contact form data is stored for 12 months after the last communication, unless a contractual relationship is established (in which case statutory retention periods under Turkish commercial law apply — typically 10 years per TTK Art. 82).

When you submit an application through our careers page, we process the following data:

• Name
• Email address
• Phone number
• LinkedIn profile URL
• GitHub profile URL (optional)
• Position preference
• Cover note (optional)
• CV / resume (if attached to the email)

Purpose: Evaluating your candidacy for the selected position or similar future openings (only with your separate consent).

Legal basis: Art. 6(1)(a) GDPR — your explicit consent; KVKK Art. 5(1) — explicit consent of the data subject. For the execution of pre-contractual steps: Art. 6(1)(b) GDPR; KVKK Art. 5(2)(c).

Mechanism: Clicking "Send application" opens your default email client with pre-filled fields addressed to [email protected]. The data is transmitted via your own email provider — no data is stored on our servers through this form.

Retention: Application data (emails received at [email protected]) is retained for 6 months after the recruitment process concludes, then permanently deleted. If you separately consent to consideration for future openings, your data may be retained for up to 12 months.

Special category data: Please do not include sensitive personal data (health information, religious beliefs, ethnic origin, political opinions) in your application unless strictly relevant to the position.

Your rights: You may withdraw your consent at any time by contacting [email protected]. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You may also exercise your rights under KVKK Art. 11 and GDPR Art. 15–22 (access, rectification, erasure, restriction, portability, objection).

When you send us an email, we process your email address, name, and message content to handle your enquiry.

Legal basis: Art. 6(1)(b) and (f) GDPR; KVKK Art. 5(2)(c) and (f).

Retention: Business correspondence is retained for 10 years in accordance with TTK Art. 82 and Vergi Usul Kanunu Art. 253.

If you subscribe to our newsletter, we collect the following data:

• Email address
• Language preference (EN / DE)
• Subscription date and confirmation status

Purpose: Sending periodic newsletters about Deka Technology services, insights, and company updates. Emails are only sent after you confirm your subscription via a double opt-in link.

Legal basis: Art. 6(1)(a) GDPR — your explicit consent; KVKK Art. 5(1) — explicit consent of the data subject.

Service provider: Newsletter emails are sent via Brevo (Sendinblue SAS, France). Data processing is governed by a DPA with Brevo in accordance with Art. 28 GDPR. Brevo's servers are located in the EU.

Retention: Your data is stored for as long as you remain subscribed. You can unsubscribe at any time by clicking the "Unsubscribe" link in any newsletter email or by contacting [email protected]. Upon unsubscription, your email is anonymised within 30 days.

Tracking: Newsletter emails may contain tracking pixels to measure open rates and click-through rates in aggregate. No individual profiling is performed. This tracking is covered by your consent under Art. 6(1)(a) GDPR, given at subscription, which includes measurement of opens and clicks for communication improvement purposes.

This website uses cookies. Cookies are small text files stored on your device. We distinguish between:

• Essential cookies: Required for website operation (no consent needed).
• Analytics cookies: Help us understand website usage (require prior consent under TTDSG § 25 and Art. 6(1)(a) GDPR).

For detailed information on the cookies we use, their purpose, and duration, please see our Cookie Policy.

We use Cloudflare Turnstile to protect our contact form against automated abuse (spam, bots). When you submit the form, Turnstile analyses behavioural signals (mouse movements, keystrokes) without using a traditional CAPTCHA challenge.

Data processed: IP address, browser information, interaction data.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in preventing abuse. KVKK Art. 5(2)(f).

Provider: Cloudflare, Inc. (see Section 2 for details).

We use the following service providers who process personal data on our behalf:

No data is sold to third parties. We do not use any tracking, advertising, or social media plugins.

As a Turkish company serving clients in the EU/EEA, data may be transferred across borders:

EU/EEA → Turkey: Turkey is not recognised as providing an adequate level of data protection under Art. 45 GDPR. Transfers to Turkey are safeguarded by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR, or based on Art. 49(1)(b) GDPR where the transfer is necessary for the performance of a contract.

Turkey → EU/EEA: Under KVKK Art. 9, transfers to countries with adequate protection or with the data subject's explicit consent. EU/EEA countries are generally recognised as adequate under KVKK.

USA (Cloudflare): Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR adequacy decision of 10 July 2023). Additionally, SCCs are in place as a supplementary safeguard.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — obtain confirmation and a copy of your data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — request deletion ("right to be forgotten")
• Right to restriction (Art. 18) — limit processing in certain cases
• Right to data portability (Art. 20) — receive your data in a machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)) — at any time, without affecting prior processing

To exercise any of these rights, contact us at [email protected].

Supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority. If you are located in the EU, you may contact the authority in your country of residence. A list is available at edpb.europa.eu.

Under KVKK Art. 11, data subjects have the right to:

• Learn whether personal data is being processed
• Request information about the processing
• Learn the purpose of processing and whether data is used accordingly
• Know the third parties to whom data is transferred
• Request rectification of incomplete or inaccurate data
• Request erasure or destruction under KVKK Art. 7
• Object to adverse results arising from automated analysis
• Claim compensation for damages caused by unlawful processing

Applications can be made to [email protected] or by registered mail to our address. You may also contact the Kişisel Verileri Koruma Kurumu (KVKK Board) at kvkk.gov.tr.

We do not use automated decision-making or profiling as defined by Art. 22 GDPR or KVKK Art. 6.

We may update this privacy policy to reflect changes in our processing activities or legal requirements. The current version is always available on this page. We recommend reviewing it periodically.