Privacy Policy and KVKK Privacy Notice

Last updated: October 2026 · Version 2026-10-v1

This notice is intended for people who visit the ertanlar.com website, contact us through it, or submit a job application. In accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, it explains which personal data we process, for what purpose, on what legal basis and by what method, to whom we may transfer it, how long we keep it, and what your rights are.

1. Data Controller

Your personal data is processed by the following company as the data controller under KVKK.

2. Overview

The table below summarizes when your data is processed. Details are in the relevant section.

Your personal data is not sold and is not shared with third parties for marketing purposes. Your data is processed only for the purposes stated in this notice, and only to the extent that is related, limited and proportionate to those purposes.

3. Website Visitors

Data processed: When you view the site, the server records your IP address, browser and device information, the page you accessed and the date and time of access as an access log. Information about cookies is in Section 6 and in the Cookie Policy.

Purposes: Providing the site and keeping it operational, ensuring information security, preventing misuse (automated attacks, spam), and fulfilling legal obligations.

Legal basis: Fulfillment of a legal obligation (KVKK Art. 5/2-ç) and the legitimate interests of the data controller (KVKK Art. 5/2-f).

Collection method: Collected automatically by the server, in electronic form, when you visit the site.

Retention: Access logs are retained for the periods determined under Law No. 5651 and the related regulation.

4. Contact Form

Data processed: Full name, email address, telephone number and the content of your message.

Purposes: Receiving your requests, questions and quotation inquiries, forwarding them to the relevant department, and replying to you.

Legal basis: The legitimate interests of the data controller (KVKK Art. 5/2-f). If your request relates to a quotation or pre-contract discussion, the processing is also directly related to the establishment of a contract (KVKK Art. 5/2-c).

Collection method: Collected in electronic form when you fill in and submit the contact form on the site. Your message is first saved in our system and then notified to the relevant employees by email.

Retention: Contact messages are kept for 2 years; at the end of this period they are automatically deleted from the system. The necessary administrative measures are taken so that notification emails are also deleted from the mailbox at the end of the same period. Data in backup copies is deleted when the backup cycle is completed.

Note: Please do not share special categories of personal data, such as health, religion, trade union membership or criminal conviction, in the message field.

5. Job Application

Data processed: Full name, email address, telephone number, position area, education level, years of experience, cover letter (optional) and all information contained in the résumé (CV) file you upload. In addition, the date on which you confirmed that you read this notice and the version identifier of the notice you read are recorded.

Purposes:

• Receiving your application and evaluating it in the recruitment process,
• Contacting you when necessary,
• During the retention period, re-evaluating your application and contacting you when a suitable position opens,
• Proving that the obligation to inform has been fulfilled.

Legal basis:

• Evaluating your application at the stage of establishing a contract (KVKK Art. 5/2-c),
• Re-evaluating your application during the retention period, based on the legitimate interests of the data controller (KVKK Art. 5/2-f),
• Keeping the notice record, for the establishment, exercise or protection of a right (KVKK Art. 5/2-e).

Confirming the notice is not the same as giving explicit consent. The checkbox on the application form records that you have read this notice; it does not mean "explicit consent" to the processing of your data. The data in your application is processed on the legal bases stated above.

Special categories of personal data: Please do not include special categories of personal data (KVKK Art. 6), such as health condition, religion or sect, trade union membership, criminal conviction or biometric data, in your CV or cover letter. This information is not needed for the evaluation; it is not used in the evaluation, and if it is detected, the necessary action is taken to delete it.

Collection method: Collected in electronic form when you fill in and submit the job application form on the site. Your CV file is saved in a private storage area that cannot be accessed directly from the internet. The application notification is sent by email to our human resources employees; the notification does not include the CV file or the cover letter. Only authorized employees can access applications.

Retention: Application records and CV files are kept for 1 year from the application date; at the end of this period they are automatically deleted from the system. The necessary administrative measures are taken so that notification emails are also deleted from the mailbox at the end of the same period. Data in backup copies is deleted when the backup cycle is completed. If you want them deleted before this period ends, you can apply through the channels in Section 11.

6. Cookies

The site uses strictly necessary cookies. For visit statistics, Google Analytics 4 cookies (_ga, _ga_*) are activated only with the consent you give in the cookie banner, through Google Tag Manager. If you do not consent, analytics cookies are not set and no data is collected for analytics purposes. You can change your preference at any time from the "Cookie Preferences" link at the bottom of the page. See the Cookie Policy for cookie types, durations and management.

Legal basis: For strictly necessary cookies, the legitimate interests of the data controller (KVKK Art. 5/2-f); for analytics cookies, explicit consent (KVKK Art. 5/1).

7. Transfer of Personal Data

Domestic transfers. Within the limits of the purposes above and under KVKK Art. 8, your data may be transferred to the following recipient groups:

• The domestic hosting service provider that hosts the website,
• Domestic email and information technology service providers,
• Our internal departments concerned with your request or application (for example, human resources),
• Public institutions and judicial authorities that are legally authorized.

Transfers abroad. If you consent to analytics cookies in the cookie banner, measurement data about your visit may be transferred to servers abroad through Google (Google Tag Manager and Google Analytics 4). Under KVKK Art. 9, this transfer is made only with your explicit consent; if you do not consent or if you withdraw your consent, no transfer is made for this purpose. For other third-party content used on the site, see Section 12.

Your contact form and job application data is not transferred abroad.

8. Retention Periods

If there is a legal retention obligation, a lawsuit or an official proceeding, the relevant data may be kept for as long as those proceedings require.

9. Data Security

Reasonable technical and organizational measures are applied to protect your data against unauthorized access, loss and disclosure. These include an encrypted connection (HTTPS), role-based access, storing uploaded files in an area that cannot be accessed directly from the internet, and spam and misuse protections for forms.

10. Your Rights under KVKK Article 11

As a data subject, you have the right to:

• Learn whether your personal data is processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether it is used in line with that purpose,
• Know the third parties to whom your data is transferred, in Türkiye or abroad,
• Request correction if it has been processed incompletely or incorrectly,
• Request deletion or destruction under KVKK Art. 7,
• Request that correction, deletion and destruction be notified to the third parties to whom the data has been transferred,
• Object to an outcome against you that results from analysis of the processed data exclusively through automated systems,
• Request compensation for damage if you suffer harm because of unlawful processing.

11. How to Apply

You can submit requests about your rights through the following channels, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• In writing: To Organize Sanayi Bölgesi 8. Cadde No:17, Eskişehir / Türkiye, writing "Personal Data Protection Law Information Request" on the envelope,
• Email: To info@@ertanlar.com.

Your application must include your full name, your Turkish ID number (for foreign nationals, nationality and passport or ID number), your residence or workplace address for notification, your email address and telephone number if any, and the subject of your request. Written applications must also be signed. We may request additional information to verify your identity.

Your application is concluded within 30 days at the latest, depending on the nature of the request, and the reply is sent to you in writing or electronically. If the process requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If you find the reply insufficient, your application is rejected, or no reply is given in time, you may file a complaint with the Personal Data Protection Board within 30 days from the date you learn of the reply, and in any case within 60 days from the date of your application.

12. Third-Party Links and Content

The site may contain links to third-party sites such as YouTube and LinkedIn; the relevant providers are responsible for the privacy practices of those sites. When you open the promotional video on the home page, the video is loaded from YouTube; if you choose to load the map on the contact page, the map is loaded from Google. When this content is loaded, Google may use cookies and similar technologies (see the Cookie Policy for details).

13. Changes

This notice may be updated according to changes in legislation or in the data processing activities on the site. The current version is always published on this page; the version identifier and date at the top of the page change. The version identifier of the notice you read when you submit a job application is stored together with your application record.