Privacy Policy
Last Update and Effective Date
Last updated: August 3, 2026 | Version: 1.0. This Privacy Policy was published on the website on the date indicated above and entered into force on the same date. With each update, the effective date and version number of the text are shown only in this section, at the beginning of the text; no date is stated separately anywhere else. Changes to the Policy take effect from the date the new version is published and apply to processing activities carried out after that date. You may send requests for information about previous versions to info@mikrolink.com.tr.
Scope and Purpose
This Privacy Policy has been prepared by Mikrolink Bilişim Sanayi Ticaret A.Ş. ("Mikrolink" or the "Company") to explain for which purposes and on which legal grounds personal data obtained through the website at https://www.mikrolink.com.tr and the services offered through this website is processed, to whom it is transferred, how long it is retained, and the rights you have as a data subject. The text is based on Law No. 6698 on the Protection of Personal Data ("KVKK") and its secondary legislation and, for data subjects located in the European Union, on the provisions of the EU General Data Protection Regulation ("GDPR", 2016/679). The Policy covers website visitors, persons who complete the contact, quote request and newsletter forms, employees and authorized representatives of customers and suppliers, and other natural persons who contact the Company. The personal data of job candidates falls outside the scope of this Policy; such data is processed under the Clarification Text for Job Candidates and in accordance with the principles set out therein. For links on the website that lead to third-party platforms, the privacy policies of those platforms apply.
Identity and Contact Details of the Data Controller
Mikrolink Bilişim Sanayi Ticaret A.Ş., the data controller under the KVKK, is domiciled at Kartal Kule, Esentepe Mah. İnönü Cad. No:147 Kat:24, 34870 Kartal/İstanbul and is registered under trade registry number [Trade Registry No.] and MERSİS number [MERSIS No.]. The Company’s registration number in the Data Controllers’ Registry Information System (VERBİS) is [VERBIS Registration No.]. You may submit your requests and applications concerning the protection of personal data directly to the Company; for this purpose, you may use the e-mail address info@mikrolink.com.tr, the registered electronic mail (KEP) address mikrolinkbilisimsanayi@hs03.kep.tr, and the telephone number +90 212 502 38 10. You may also reach the Company by telephone at +90 312 472 79 98 (Ankara). As data processing activities are carried out in Türkiye, no separate EU representative has been appointed under Article 27 GDPR; data subjects located in the European Union may submit their requests directly to the Company through the channels listed above. As the conditions set out in Article 37 GDPR are not met, no Data Protection Officer (DPO) has been appointed; this does not prevent the Company from fulfilling its obligations under the KVKK and the GDPR or from concluding your applications within the prescribed time limits.
Categories of Personal Data Processed
Within the scope of its activities, and in a limited and proportionate manner, the Company may process the following categories of data: (i) identity data (name, surname, title, position, and the organization represented), (ii) contact data (e-mail address, telephone number, business address, KEP address), (iii) customer transaction and request data (quote requests, form contents, correspondence and meeting records, support requests), (iv) transaction security data (IP address, date and time information, access and server logs, browser and device information, operating system, referring address), (v) financial data (invoice and payment information, bank account and IBAN details, current account records), (vi) physical premises security data (campus entry and exit records and camera footage), (vii) legal transaction data (information on disputes and case files, official correspondence), (viii) marketing data (newsletter subscription, commercial electronic message consent status, event and trade fair participation information), and (ix) cookie data (on-site browsing behavior, session information, consent preferences). This list of categories is identical to the list in the KVKK Information Notice. The Company does not intend to collect special categories of personal data through the website; we kindly ask you not to enter such data in the free-text fields of the forms. Under no category is more data collected than the purpose of processing requires, and the principle of data minimization is observed.
Purposes of Processing Personal Data
Your personal data is processed for the purposes of conducting commercial activities and operating the website. These purposes include, in particular: (i) responding to contact and quote requests, answering your questions, and communicating with you, (ii) conducting the sale of goods and services, after-sales support, and technical support processes, (iii) conducting pre-contractual negotiations, performing contractual obligations, and carrying out finance and accounting operations, (iv) ensuring the security of the website and the IT infrastructure, preventing misuse and cyberattacks, and fulfilling the obligations arising from our status as a content provider under Law No. 5651, (v) conducting marketing and promotional activities and sending commercial electronic messages where you have given explicit consent, (vi) measuring website usage, improving the user experience, and developing content, (vii) ensuring campus and physical premises security, and (viii) fulfilling legal obligations and exercising the right of defense in legal disputes. Your personal data is not used for purposes other than those for which it was collected or in a manner incompatible with those purposes. No decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR, are made; the limited profiling carried out through marketing cookies is subject solely to your explicit consent and ends if you withdraw that consent.
Legal Grounds for Processing
Each processing activity is based on a legal ground under the KVKK and the GDPR. Responding to contact and quote requests and contractual processes fall under Article 5(2)(c) of the KVKK (processing directly related to the conclusion or performance of a contract) and Article 6(1)(b) GDPR (performance of a contract or pre-contractual steps). Keeping and retaining logs, and the bookkeeping, documentation and archiving obligations arising from legislation, are based on Article 5(2)(ç) of the KVKK (compliance with a legal obligation) and Article 6(1)(c) GDPR; ensuring website and campus security, maintaining business relationships, and corporate communication are based on Article 5(2)(f) of the KVKK (legitimate interest of the data controller) and Article 6(1)(f) GDPR. The use of non-essential cookies, marketing communications, the sending of commercial electronic messages, and other processing subject to explicit consent are carried out on the basis of explicit consent under Article 5(1) of the KVKK and consent under Article 6(1)(a) GDPR; for commercial electronic messages, Law No. 6563 on the Regulation of Electronic Commerce and the rules of the Message Management System (İYS) also apply. Where data must be processed for the establishment, exercise or protection of a right, Article 5(2)(e) of the KVKK and Article 6(1)(f) GDPR serve as the legal basis. Special categories of personal data are processed only where one of the exceptional conditions listed in Article 6 of the KVKK and Article 9 GDPR applies and the necessary additional security measures have been taken; for processing based on legitimate interest, a balancing test is carried out to ensure that your fundamental rights and freedoms are not harmed.
Methods and Channels of Collecting Personal Data
Your personal data is collected by fully or partly automated means, or by non-automated means provided that they form part of a data filing system, through the contact, quote request and newsletter forms on the website, e-mail and KEP correspondence, telephone calls, contracts and documents drawn up within commercial relationships, participation in trade fairs and events, campus security systems, and server and application logs. Your data may not always be obtained directly from you; in corporate communication and business development processes, it may also be collected indirectly through publicly available sources, trade registry records, corporate websites, business partners, and third parties who refer you. Where data is not obtained from you, you are informed of the source and the processing activity within a reasonable period in accordance with Article 14 GDPR. The website is hosted by [Hosting Provider] on servers located in Türkiye; the hosting provider obligations within the meaning of Law No. 5651 rest with this company, and the Company acts as the content provider for the website’s content. Data collected through the website and server logs are hosted on this infrastructure in Türkiye. Collection through cookies and similar technologies is explained separately in the following section.
Cookies and Similar Technologies
The website uses cookies and similar technologies, and cookies are classified into four categories: strictly necessary cookies, functional cookies, analytics cookies, and marketing cookies. As strictly necessary cookies are required for the website to function, they are not subject to explicit consent and cannot be disabled from the cookie preferences panel; functional, analytics and marketing cookies are disabled by default, can be selected individually, and are activated only upon the explicit consent you give through the panel. Your preferences are stored in JSON format in a cookie named "mk_consent"; you may change your cookie preferences or withdraw your consent at any time through the same panel, and withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. The website uses the Google Analytics 4 (GA4) measurement infrastructure. Analytics cookies run only if you give explicit consent to the Analytics category in the cookie preferences panel and are managed in compliance with Google Consent Mode v2; unless consent is given, no measurement cookie is set and your data is not collected. Your IP address is processed in anonymized form. The embedded Google Maps content on the website belongs to the functional cookie category and is loaded only if you consent to this category; until you do, no request is sent to third-party servers, and an informational area is shown in place of the map together with a link that lets you view our address in an external map service. This practice has been designed in line with the Guideline on Cookie Practices published by the Personal Data Protection Authority and the explicit-consent principle laid down in the ePrivacy Directive and its national implementations; for the detailed cookie inventory, please see the Cookie Policy.
Domestic Transfer of Personal Data
Your personal data may be transferred to third parties in Türkiye to the extent required by the purposes of processing and in accordance with the applicable legislation. The parties to whom such transfers may be made are the IT infrastructure provider that hosts the website on servers located in Türkiye ([Hosting Provider]), maintenance and software support suppliers, accounting, audit and legal advisors, banks and financial institutions, and legally authorized public institutions and organizations. Transfers are carried out within the framework of Article 8 of the KVKK and limited solely to the purpose of the transfer; where the recipient acts as a data processor, written data processing agreements are concluded in accordance with Article 28 GDPR. The data security capabilities of suppliers and business partners are assessed at the selection stage, and contractual confidentiality obligations are imposed. Transfers to legally authorized public institutions are made within the procedures and limits prescribed by the relevant legislation.
International Transfer of Personal Data
As the website is hosted on servers located in Türkiye, no personal data is transferred abroad in connection with hosting and server logs. International transfers arise only in the following limited cases: (i) the external recruitment portal (Peoplebox) used to receive job applications, and (ii) Google services used when the analytics infrastructure is enabled; the operation of analytics cookies is additionally subject to your explicit consent. Transfers in these limited cases are based not on explicit consent but on the safeguard mechanisms provided for in the legislation, applied in the following order: first, on the basis of an adequacy decision announced by the Personal Data Protection Board, where one exists; in the absence of an adequacy decision, by providing one of the appropriate safeguards under Article 9(3) of the KVKK (standard contracts, binding corporate rules, a written undertaking, or provisions of international agreements). Only where neither an adequacy decision nor appropriate safeguards can be provided may the incidental exceptions listed in Article 9(6) of the KVKK be relied on; explicit consent comes into play only within this scope and solely as an incidental exception, and is not used as the legal basis for regular transfers. The obligation to notify the Authority of standard contracts within 5 (five) business days of their signature is fulfilled. For transfers falling within the scope of the GDPR, Articles 44 to 49 of the Regulation apply; for transfers to countries without a Commission adequacy decision, the Standard Contractual Clauses (SCCs) adopted by the European Commission are used and, where necessary, a transfer impact assessment and supplementary measures such as encryption and pseudonymization are applied. In all cases, transfers are limited to the purpose, proportionate, and in line with the data minimization principle.
Retention Periods and Destruction
Your personal data is retained for the period prescribed by the relevant legislation or required for the purpose for which it is processed. In determining this period, the minimum retention periods under the relevant legislation, statutes of limitation, commercial practice, and the Company’s legitimate interests are assessed together. Within this framework, contact and quote request form records are retained for [Contact Form Retention Period], commercial relationship and contract records for [Contract Retention Period], traffic and access logs under Law No. 5651 for [5651 Log Retention Period], and records relating to marketing consents for [Marketing Consent Retention Period]. When the retention period expires or the reasons requiring processing cease to exist, personal data is erased, destroyed or anonymized ex officio or upon your request, in accordance with the Regulation on the Erasure, Destruction or Anonymization of Personal Data. Under its internal procedures, the Company applies periodic destruction cycles of 6 (six) months and records all destruction operations.
Technical and Administrative Measures for Data Security
Pursuant to Article 12 of the KVKK and Article 32 GDPR, the Company takes measures to ensure an appropriate level of security in order to prevent the unlawful processing of and unlawful access to personal data and to ensure its safekeeping. Technical measures include TLS encryption of communications, firewalls and intrusion detection systems, access control based on an authorization matrix, strong authentication, up-to-date patch and vulnerability management, logging and log monitoring, backup and business continuity solutions, and network segmentation. Administrative measures include maintaining a personal data inventory, regular awareness training for employees, confidentiality undertakings, data processing agreements with suppliers, revocation of access rights during authorization changes and upon termination of employment, and internal audits. Where a service is performed by third parties acting as data processors, it is contractually ensured that these parties also provide an equivalent level of security. The adequacy of the measures taken is reviewed regularly in light of risks and technological developments.
Your Rights as a Data Subject
As a data subject, you have the following rights under Article 11 of the KVKK, which you may exercise by applying to the Company: (i) to learn whether your personal data is processed, (ii) to request information if it has been processed, (iii) to learn the purpose of processing and whether the data is used in accordance with that purpose, (iv) to know the third parties to whom the data is transferred in Türkiye or abroad, (v) to request the correction of incomplete or inaccurately processed data, (vi) to request erasure or destruction within the framework of the conditions set out in Article 7 of the KVKK, (vii) to request that correction, erasure and destruction operations be notified to the third parties to whom the data has been transferred, (viii) to object to a result arising to your detriment from the analysis of your data exclusively through automated systems, and (ix) to claim compensation if you suffer damage due to unlawful processing. Data subjects located in the European Union also have, under Articles 15 to 22 of the Regulation, the right of access, the right to rectification, the right to erasure (right to be forgotten), the right to restriction of processing, the right to data portability, the right to object to processing and to object to direct marketing at any time, and the right not to be subject to automated decision-making and profiling. For processing based on explicit consent, you may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal. The procedure for exercising your rights is explained in the following section.
Application Procedure and Right to Lodge a Complaint
You must submit your requests to the Company in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, stating your name, surname, signature, Republic of Türkiye identity number (for foreign nationals: nationality, passport number or, if available, identity number), address for service, e-mail address and telephone number (if any), and the subject of your request. You may send your applications in writing to Kartal Kule, Esentepe Mah. İnönü Cad. No:147 Kat:24, 34870 Kartal/İstanbul; to the registered electronic mail address mikrolinkbilisimsanayi@hs03.kep.tr with a secure electronic signature or mobile signature; or to info@mikrolink.com.tr from your e-mail address registered in the Company’s systems. You may also obtain information by telephone at +90 212 502 38 10. Your requests are concluded free of charge as soon as possible depending on their nature, and in any event within 30 (thirty) days of the application reaching the Company; where the transaction entails an additional cost, the fee set out in the tariff determined by the Board may be charged. Requests under the GDPR are answered within 1 (one) month, and this period may be extended by a further 2 (two) months, taking into account the complexity and number of requests. If your application is rejected, the response is found insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 (thirty) days of learning of the response and in any event within 60 (sixty) days of the application date; data subjects located in the European Union may lodge a complaint under Article 77 GDPR with the competent supervisory authority in the member state of their habitual residence, place of work, or place of the alleged infringement, and may seek effective judicial remedies.
Commercial Electronic Messages and Consent Management
Commercial electronic messages such as newsletters, promotions, campaigns and event announcements are sent only if you have given prior explicit consent. Consents are recorded in, and can be queried through, the Message Management System (İYS) within the framework of Law No. 6563 on the Regulation of Electronic Commerce and its secondary legislation. You may opt out of receiving commercial electronic messages at any time without giving any reason; you can exercise this right via the link included in the messages, through İYS, or by sending a notice to info@mikrolink.com.tr. Opt-out notices are processed within 3 (three) business days at the latest in accordance with the relevant Regulation, after which no further commercial electronic messages are sent to you. Opting out does not prevent the sending of informational and transactional messages relating to the performance of the contractual relationship between us.
Children’s Personal Data
The website and the services offered through it are intended for corporate customers and business partners; they are not designed for children, and personal data is not knowingly collected from children. The contact, quote request and newsletter forms on the website are intended to be completed by persons aged 18 (eighteen) or over; internship and recruitment applications are an exception to this rule and are received not on the website but under the Clarification Text for Job Candidates, through the external recruitment portal (Peoplebox). In accordance with Article 8 GDPR, for consent-based processing in relation to information society services, parental or guardian consent is required for children below the age limit set by the legislation of the relevant member state. If the Company determines that it has obtained a child’s personal data without the consent of their parent or guardian, such data is erased or destroyed without delay. Parents or guardians who become aware of such a case may contact the Company at info@mikrolink.com.tr.
Data Breach Notification
If personal data is unlawfully obtained by others, the Company immediately investigates the incident, implements measures to limit its impact, and makes the necessary notifications. In accordance with Article 12(5) of the KVKK and the Board’s Principle Decision No. 2019/10, the breach is notified to the Personal Data Protection Board as soon as possible and within 72 (seventy-two) hours at the latest after it becomes known; affected data subjects are also informed within the shortest reasonable time and, where possible, directly. For breaches falling under the GDPR, the competent supervisory authority is notified within 72 (seventy-two) hours pursuant to Article 33 of the Regulation; where the breach poses a high risk to the rights and freedoms of data subjects, the data subjects are also informed pursuant to Article 34. The Company records all breach incidents, performs root cause analysis, and carries out corrective and preventive actions to prevent recurrence.
Other Related Legal Texts
This Privacy Policy applies as an integrated whole together with the other legal texts published on the website. For detailed information on cookie categories, the cookie inventory and preference management, please see the Cookie Policy; for details of the information obligation under the KVKK, please see the KVKK Information Notice. The subject and scope of processing activities based on explicit consent are explained in the Explicit Consent text, and the principles relating to the personal data of job candidates are set out in the Clarification Text for Job Candidates. The Terms of Use govern the general conditions for using the website. In the event of any inconsistency between these texts, this Policy and the KVKK Information Notice prevail on matters relating to the processing of personal data; on cookie-specific matters, the Cookie Policy and your current preferences in the cookie preferences panel are decisive.
Updates to the Policy
The Company reserves the right to update this Privacy Policy in line with changes in legislation, decisions of the Board and supervisory authorities, technological developments, and changes in business processes. The updated text enters into force on the date it is published on the website, and its effective date and version number are shown in the "Last Update and Effective Date" section at the beginning of the text. For changes that materially affect your rights, additional notice is given where possible and, if necessary, explicit consent is obtained again. We recommend that you review the Policy at regular intervals to stay informed of the current provisions. You may send requests for information about previous versions to info@mikrolink.com.tr.