Personal data protection notice (KVKK)

Note: This is a courtesy translation. In case of any discrepancy, the Turkish version is legally binding.

Last updated: 9 October 2026

This Privacy Notice has been prepared pursuant to Article 10 of the Law No. 6698 on the Protection of Personal Data ("KVKK" or the "Law", the Turkish Personal Data Protection Law) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, in order to inform the natural persons ("data subject", "you") who visit our website (https://www.kilitkutu.com), use the contact form, purchase services through our client panel or contact us through other channels.

1. Identity of the data controller

Your personal data is processed by our business, whose details are set out below ("Kilitkutu" or the "Company"), in its capacity as data controller:

Trade name: Erşan Dayankaç – Kilitkutu Teknoloji Çözümleri
Address: Hacı Abdi Mah. Sofa Sk. No:40/7 Battalgazi / Malatya
Telephone: +90 (422) 333 01 12
Email: [email protected]
Registered electronic mail (KEP) address: —
Tax office / Tax number: — / —
MERSİS No. (Central Registry System number): —
Website: https://www.kilitkutu.com

2. Categories of personal data processed

Depending on the nature of our relationship (visitor, prospective client, client, authorized representative/employee of a client, domain name registrant, trademark applicant, reseller or authorized representative of a reseller, or a person submitting a project proposal request), the following categories of personal data may be processed:

Data category	Example data
Identity	First name, last name; for individual clients and sole proprietorships, the Turkish Republic identity number for invoicing and where legally required; in trademark applications, the identity details of the applicant.
Contact	Email address, telephone number, postal/billing address; for legal entity clients, the contact details of the authorized person.
Client transaction	Order and service information, domain name registrant and technical/administrative contact details, invoice records, support requests and correspondence, the subject and message content submitted through the contact form; company, project type, budget and timeline information shared in the project proposal form and correspondence relating to the project scope; the tax certificate, signature circular and similar documents submitted with a reseller application.
Financial	The sender's name and bank details shown on the wire transfer/EFT receipt, payment and refund records, tax office and tax number. For card payments, card details are processed by the payment institution; we do not store card numbers.
Transaction security	IP address, client panel login/logout records, server and service access (log) records, username, hashed password information, and traffic data within the scope of Law No. 5651.
Legal proceedings	Requests received from official authorities, information and documents relating to dispute and complaint processes, and abuse reports.
Marketing	Only where you have given your explicit consent and your approval to receive commercial electronic messages: campaign and announcement preferences, and consent records.
Online usage (cookies)	Your cookie preference; only if you give your consent, visit statistics obtained through Google Analytics (such as pages visited, device/browser type and approximate location).

No special categories of personal data (KVKK Art. 6) are requested within the scope of our services. Please do not share such data through the contact form, support requests or email. In hosting and server services, the client itself is the data controller with respect to personal data contained in the content that our clients upload to their own systems; Kilitkutu merely provides the technical infrastructure for such data. Likewise, in software development and website projects, the client is the data controller with respect to personal data that the client transfers to the software or processes through the software; Kilitkutu processes such data solely in its capacity as data processor and in accordance with the instructions in the project contract.

3. Purposes of processing personal data

Your personal data is processed for the following purposes, in a manner that is relevant, limited and proportionate to these purposes:

Establishing and performing contracts relating to domain name registration, transfer and renewal; web hosting, reseller hosting, VPS, VDS, game server and dedicated server rental; SSL certificates; corporate email; and trademark registration consultancy services,
Evaluating requests for software development, mobile applications, website design and digital marketing (advertising management), holding preliminary meetings, preparing proposals, and carrying out non-disclosure agreement (NDA) and project contract processes,
Evaluating reseller applications and establishing and performing the reseller agreement,
Creating the client account, verifying identity and ensuring the security of the client panel,
Carrying out registration transactions with domain name registrars, TRABİS (the .tr domain name registry system) and extension registry operators; completing SSL certificate validation processes; filing and monitoring trademark applications before TÜRKPATENT (the Turkish Patent and Trademark Office),
Carrying out invoicing, collection, refund and accounting processes,
Managing technical support, requests and complaints; responding to requests submitted through the contact form,
Fulfilling obligations arising from legislation, including hosting provider obligations under Law No. 5651, and sharing information with competent authorities,
Carrying out information security processes; preventing and detecting abuse, spam, attacks and fraud,
Establishing, exercising and protecting rights in legal disputes,
Sending service continuity, maintenance and outage notifications and renewal reminders,
Where you have given your explicit consent: analysing the use of the website and sending you campaign, announcement and promotional messages.

4. Legal grounds for processing personal data

Your personal data is processed on the basis of the following legal grounds listed in Article 5 of KVKK:

Being expressly provided for by law (Art. 5/2-a): Retention of traffic data under Law No. 5651 on Regulating Publications on the Internet and Combating Crimes Committed through Such Publications; issuing and retaining invoices, books and documents under Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102; records under Law No. 6563 on the Regulation of Electronic Commerce and Law No. 6502 on the Protection of Consumers.
Being directly related to the establishment or performance of a contract (Art. 5/2-c): Receiving orders, setting up and providing services, filing domain name and trademark applications, support services, managing the client panel account; preliminary meeting and proposal processes for software and web projects (including negotiations prior to the conclusion of a contract).
Fulfilment of a legal obligation (Art. 5/2-ç): Responding to information requests from competent public institutions and organizations and judicial authorities, accounting and tax obligations, and registrant information obligations arising from TRABİS and registrar rules.
Establishment, exercise or protection of a right (Art. 5/2-e): Debt collection, dispute and litigation processes, and the examination of abuse complaints.
Legitimate interest (Art. 5/2-f): Provided that it does not harm your fundamental rights and freedoms: ensuring information and system security, preventing abuse of the contact form (spam), improving service quality, and responding to requests submitted through the contact form.
Explicit consent (Art. 5/1): The use of analytics cookies such as Google Analytics (through the "Accept" option in the cookie notice), commercial electronic messages and marketing activities, and transfers abroad based on explicit consent. You may withdraw your explicit consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

5. Method of collecting personal data

Your personal data is collected through the contact form on our website, the client panel (order, registration and support screens), email, telephone, bank wire transfer/EFT records, physical or electronic documents and cookies, by fully or partially automated means or, provided that it forms part of a data filing system, by non-automated means. Server and service access records are generated automatically by our infrastructure.

The contact and project proposal forms on our website collect your name and surname, email, telephone (optional), subject and message, and, in the project proposal form, additionally your company name, project type, estimated budget, preferred start time and your request for a non-disclosure agreement (NDA), together with the submission date, your IP address and your confirmation regarding the privacy notice. This information is forwarded to our Company by email in order to respond to your request. The domain name you type in the domain name search tool is forwarded via our server to the WHOIS servers of the relevant registry operators in order to determine its availability; your IP address is not forwarded to these servers. The domain name or IP address you type in the WHOIS lookup and DNS propagation check tools is likewise forwarded via our server to WHOIS and DNS servers. In the My IP Address tool, your IP address is forwarded to the WHOIS servers of regional internet registries in order to display it to you and to identify the organization to which the address is registered, and to public DNS servers for the reverse DNS lookup; queries made in these tools are not recorded. In order to prevent automated abuse of the forms and tools (information security), an irreversible hash of your IP address generated with a secret key is kept on our server, together with the submission and query times, for no longer than 24 hours.

6. Transfer of personal data

6.1. Domestic transfers

Your personal data may be transferred to the following groups of recipients pursuant to Article 8 of KVKK and limited to the purposes set out above:

For .tr domain names, TRABİS (the .tr Network Information System) and the Information and Communication Technologies Authority (BTK),
For domain name services, the domain name registrar of which we are a reseller (DomainNameAPI),
For trademark registration consultancy, the Turkish Patent and Trademark Office (TÜRKPATENT),
For payment processes, banks and payment institutions operating under Law No. 6493,
For accounting and tax processes, the persons/firms from which we receive financial advisory (certified public accountant) services and e-invoice/e-archive service providers,
For infrastructure services, suppliers from which we receive data center, hosting and software licensing services (only to the extent strictly necessary for the provision of the service),
In software, website and digital marketing services, upon your request and to the extent required by the service, application stores and advertising platforms (Apple Inc., Google LLC, Meta Platforms Inc., TikTok), e-commerce infrastructure providers and third-party service providers with which integrations are made,
For legal obligations, competent public institutions and organizations, law enforcement agencies and judicial authorities, upon request,
For the protection of rights, the attorneys from whom we receive legal support.

6.2. Transfers abroad

Due to the nature of certain services, your personal data may be transferred abroad. These transfers are carried out in compliance with Article 9 of KVKK as amended by Law No. 7499 with effect from 1 June 2024; where there is no adequacy decision of the Board (the Personal Data Protection Board), they are based on one of the appropriate safeguards such as the standard contracts announced by the Board, or are made in the cases of incidental transfer under Art. 9/6 (such as where the transfer is necessary for the establishment/performance of a contract, or on the basis of your explicit consent):

Generic top-level domain (gTLD) names (.com, .net, .org, etc.): ICANN-accredited registrars and the registry operator of the relevant extension. Registrant and contact details are transmitted to these organizations as required by ICANN rules and, subject to the applicable data redaction rules, may become accessible through Whois/RDAP systems. This transfer is necessary for the performance of the domain name registration contract you have requested.
SSL certificates: The domain name contained in the certificate request and (for organization/extended validation certificates) the organization and authorized person details are transmitted to the certificate authority Sectigo in order to complete the validation process.
Google LLC: Google Analytics (only if you select the "Accept" option in the cookie notice), Google Tag Manager (googletagmanager.com, only while Google Analytics is being loaded) and the Google Maps embed on the Contact page (loaded only when you click the "Show map" button or if you have selected the "Accept" option in the cookie notice). When Google Maps content is loaded, your IP address is technically transmitted to Google servers. For details, please see the Cookie Policy.

7. Retention periods of personal data

Your personal data is retained for the period required by the purpose of processing and for the maximum periods stipulated in the relevant legislation. Upon expiry of the period, the data is erased, destroyed or anonymized. The main retention periods are as follows:

Data / record type	Retention period	Legal basis
Hosting provider traffic data and access records	Not less than 1 year and not more than 2 years	Law No. 5651, Art. 5 and the related regulation
Invoices, accounting records and tax documents	5 years from the beginning of the calendar year following the year to which they relate	Tax Procedure Law (VUK) No. 213, Art. 253
Commercial books, contracts and commercial documents	10 years	Turkish Commercial Code (TTK) No. 6102, Art. 82
Client account and service records	For the duration of the contract and for 10 years, the general limitation period, after its termination	Turkish Code of Obligations (TBK) No. 6098, Art. 146; Turkish Commercial Code (TTK) No. 6102, Art. 82
Distance contract and preliminary information approval records	3 years	Regulation on Distance Contracts
Contact form submissions and email correspondence	2 years from the conclusion of the request	Legitimate interest (KVKK Art. 5/2-f)
Commercial electronic message consent records	3 years from the withdrawal of consent	Regulation on Commercial Communication and Commercial Electronic Messages
Cookies and cookie preference	The period determined separately for each cookie	Cookie Policy

Where there is an ongoing dispute, an official investigation or a statutory retention obligation, the relevant data may be retained until the conclusion of such process.

8. Your rights under Article 11 of KVKK

Pursuant to Article 11 of KVKK, by applying to the data controller, you have the right to:

a) Learn whether your personal data is being processed,
b) Request information if your personal data has been processed,
c) Learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
ç) Know the third parties to whom your personal data is transferred domestically or abroad,
d) Request the rectification of your personal data if it has been processed incompletely or inaccurately,
e) Request the erasure or destruction of your personal data under the conditions set out in Article 7 of KVKK,
f) Request that the operations carried out pursuant to paragraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred,
g) Object to a result arising to your detriment by means of the analysis of the processed data exclusively through automated systems,
ğ) Claim compensation for damages in the event that you suffer damage due to the unlawful processing of your personal data

as set out above.

9. Application method

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests concerning your rights in Turkish by one of the following methods:

In writing: By delivering your petition bearing a wet signature in person to the address Hacı Abdi Mah. Sofa Sk. No:40/7 Battalgazi / Malatya, through a notary public, or by registered mail with return receipt,
By registered electronic mail (KEP): To the address —,
With a secure electronic signature or mobile signature: By sending your signed application to [email protected],
From the email address registered in our system: By sending it from the email address you previously notified to us and which is registered in our system to [email protected].

Your application must include your name, surname and, for written applications, your signature; for citizens of the Republic of Türkiye, your Turkish Republic identity number (for foreign nationals, your nationality and passport/identity number); your place of residence or business address for notification purposes; your email address for notification purposes, if any; your telephone number; and the subject of your request. You may attach information and documents relating to your request to your application. We may request additional information in order to verify your identity.

Your application will be concluded as soon as possible depending on the nature of the request and within 30 (thirty) days at the latest, free of charge. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged. If the application arises from an error of the data controller, the fee charged will be refunded. If your request is accepted, it will be fulfilled; if it is rejected, the reasons will be notified to you in writing or electronically.

10. Right to lodge a complaint with the Personal Data Protection Board

Pursuant to Article 14 of KVKK, if your application is rejected, if you find the response insufficient or if your application is not answered in due time, you may lodge a complaint with the Personal Data Protection Board within 30 (thirty) days from the date you learn of the response and, in any event, within 60 (sixty) days from the date of application. Pursuant to Article 13 of the Law, it is mandatory to apply to the data controller before resorting to a complaint to the Board.

11. Changes

This Privacy Notice may be updated in line with legislative changes or changes in our data processing activities. The current version is always published on this page; the "Last updated" date at the top of the page shows the date of the most recent change. You may also review our Privacy Policy and Cookie Policy pages.

Privacy notice on the protection of personal data