Data Protection & Privacy Notice

In connection with operations conducted via zncdijital.com, personal data is processed by the verified data controller identified below pursuant to the Turkish Personal Data Protection Law (KVKK No. 6698) and relevant data protection principles.

Data Controller: Cengiz Çoşkun (trading as ZNC Dijital — Sole Proprietorship)

Registered Tax Office: Didim Tax Office

Public Location: Didim / Aydın, Türkiye

Direct Inquiries: info.zncdijital@gmail.com | Phone: +90 545 665 42 81

Our platform strictly limits data collection to what is technically and operationally necessary to evaluate your inquiry and communicate with you.

Your personal data is processed exclusively for the following specified, legitimate business purposes:

• Reviewing your project requirements, scope specifications, and commercial expectations,

• Communicating directly with you by email or telephone regarding your inquiry,

• Formulating bespoke technical roadmaps, architecture proposals, and formal service quotes,

• Protecting network and information security, detecting bot submissions, and preventing service abuse.

Personal data is processed pursuant to the following legal grounds under KVKK Article 5 and GDPR Article 6:

• Pre-Contractual Steps (GDPR Art. 6(1)(b), KVKK Art. 5/2(c)): Processing is necessary to take steps at the request of the prospective client prior to entering into a contract when you submit a project inquiry; explicit consent is not required for routine inquiry evaluation.

• Legitimate Interests (GDPR Art. 6(1)(f), KVKK Art. 5/2(f)): Processing is necessary for the legitimate interests pursued by the controller in safeguarding platform infrastructure, preventing fraud and spam, and managing qualified business inquiries without infringing upon your fundamental rights.

• Explicit Consent (GDPR Art. 6(1)(a), KVKK Art. 5/1): Applied only where statutory requirements necessitate unambiguous consent or for separate marketing communications.

We do not sell, rent, or trade your personal data to data brokers, marketing agencies, or advertising aggregators.

Data is shared strictly with verified technical infrastructure providers under secure protocols:

• Hosting Infrastructure: The hosting provider on which this website is published. The server location will be stated in this notice once the hosting environment is finalized.

• Email Notification and Reply Infrastructure: Contact form submissions are delivered by our server over SMTP through Google's Gmail service to our company inbox, and inquiries are answered from the same Gmail account (Google LLC / Google Ireland Ltd.).

• Direct Messaging (Optional): When you choose to initiate a chat via the WhatsApp button, communication occurs directly via Meta Platforms Ireland Ltd. according to your personal WhatsApp privacy settings.

Information you submit through the contact form is transmitted via Google's Gmail service for email notification and is stored in our Gmail inbox. Google's data centers and infrastructure may be located outside Türkiye, so using the contact form may constitute a transfer of personal data abroad. The location of the servers hosting this website will also be stated once the hosting environment is finalized.

Data is transmitted over TLS-encrypted connections. Encryption in transit does not mean that the legal requirements for the transfer under KVKK Article 9 are satisfied.

The legal basis and safeguards for transfers abroad under KVKK Article 9 are under legal review by the business; this notice will be updated once they are finalized. If you prefer not to have your data transferred abroad, you may contact us directly by telephone or email instead of using the contact form.

Personal data is retained only for the duration required by its processing purpose and applicable statutory limitation periods:

• Sales Inquiries (Non-Contractual): Project inquiries submitted through the website that do not mature into active client contracts are retained in the receiving Gmail inbox for a maximum of 6 (six) months, after which they are periodically purged; statutory retention mandates or justified legal claims remain reserved.

• Active Client Engagements: Inquiries and correspondence resulting in commercial agreements, invoicing, and active projects are retained in accordance with statutory commercial, accounting, and tax retention periods (5 to 10 years); the six-month rule does not apply to active business records.

• Security & Rate Limiting Telemetry: Client IP addresses processed for abuse prevention are held strictly in server volatile memory (RAM) and evicted automatically upon expiration of a 10-minute sliding window. No persistent database storage is used.

ZNC Digital implements industry-standard technical and organizational safeguards to prevent unauthorized access, alteration, or disclosure:

• Transit Encryption: Strict HTTPS and TLS 1.3 encryption across all client-server communications.

• Injection Defenses: Server-side sanitization preventing CRLF, script, and header injection.

• Payload Restriction: Request bodies capped at 32KB to thwart denial-of-service attempts.

• Privacy-by-Design Logging: Server diagnostic logs mask identifying credentials (e.g. j***e@domain.com) and omit message text.

• In-Memory Throttling: IP-based rate limiting mitigating automated attacks.

Under GDPR Articles 15–22 and KVKK Article 11, you are entitled to exercise the following rights regarding your personal data:

• Right to Access: Confirm whether your data is processed and request a copy of relevant records,

• Right to Rectification: Correct inaccurate or incomplete personal information,

• Right to Erasure: Request deletion of your data when retention grounds no longer apply,

• Right to Restriction: Restrict processing under specified statutory circumstances,

• Right to Data Portability: Receive your data in a structured, commonly used machine-readable format,

• Right to Object: Object to processing conducted on the basis of legitimate interests,

• Right to Remedy: Seek legal remedies in the event of unlawful data handling.

To exercise any of the statutory rights described above, please transmit your request along with verifiable identity information to info.zncdijital@gmail.com.

Requests will be evaluated without charge and answered within statutory deadlines, not exceeding 30 calendar days. Additional identity verification may be requested to protect against unauthorized data exposure.