Note: This is a courtesy translation. In case of any discrepancy, the Turkish version is legally binding.
Last updated: 9 October 2026
1. Our commitment
As Erşan Dayankaç – Kilitkutu Teknoloji Çözümleri ("Kilitkutu"), we undertake to collect only the information we genuinely need to provide our services, not to use it for purposes other than those disclosed, not to sell or rent your personal data, and to protect it with appropriate technical and administrative measures. The legal disclosure regarding the processing of your personal data is set out in the KVKK Privacy Notice (KVKK: Turkish Personal Data Protection Law No. 6698); this policy supplements that notice.
2. Information collected on the website
- Contact and project proposal forms: Full name, e-mail, phone (optional), subject and message; in the project proposal form, additionally the company name, project type, estimated budget, start date and any request for a non-disclosure agreement (NDA); the IP address at the time of submission and a record of confirmation of the KVKK disclosure. This information is forwarded to us by e-mail in order to respond to your request.
- Cookie preference: The choice you make in the cookie notice is stored in your browser's local storage.
- Analytics data: Visit statistics are collected through Google Analytics only if you select the "Accept" option in the cookie notice.
- Technical data: When pages are served, your IP address and browser information are technically processed by our servers and by the providers of third-party resources used on the site.
- Domain name search: To determine availability, the domain name you search for is forwarded via our server to the WHOIS servers of the relevant registry operators (Verisign, Public Interest Registry, TRABİS); your IP address is not forwarded to these servers. The result is cached for 10 minutes.
- WHOIS, DNS and IP tools: In the WHOIS lookup and DNS propagation check tools, the domain name or IP address you enter is forwarded via our server to the WHOIS servers of the relevant registration authorities and regional internet registries (e.g. RIPE NCC, ARIN) and to the public DNS servers listed on the page; your IP address is not forwarded to these servers. The My IP Address tool uses the IP address from which you connect to our server in order to display it to you and to identify the organisation with which the address is registered; for this purpose, your IP address is forwarded to the WHOIS server of the regional registry and, for the reverse DNS lookup, to public DNS servers. Queries are not stored; WHOIS results are cached for a maximum of 1 hour.
- Abuse prevention: To prevent automated abuse of the forms and lookup tools, the number of submissions and queries you can make within a short period is limited. For this purpose, it is not your IP address itself but a digest (HMAC-SHA256) generated with a secret key, which cannot be reversed to the IP address, that is kept on our server together with the submission/query times, and it is deleted within 24 hours at the latest. No cookies are used for this purpose.
- Project information: Business ideas and project information you share in the project proposal form or in preliminary meetings are shared only with the team that will work on the project; on your request, a non-disclosure agreement (NDA) is signed before the meeting.
Ordering, billing and service management processes are carried out through the customer panel, which operates at a separate address; data processed in these processes is also covered by the KVKK Privacy Notice.
3. Purposes for which information is used
We use the information we collect to respond to your requests, to provide and invoice our services, to fulfil our legal obligations, to ensure the security of our website and infrastructure, to prevent abuse and, if you give your consent, to analyse and improve the use of our website. We do not send you commercial electronic messages for marketing purposes without your explicit consent.
4. Security measures
To protect your information against unauthorised access, loss, alteration and disclosure, we apply technical and administrative measures, including the following:
- Encrypted communication: All traffic between your browser and our website and customer panel is encrypted with SSL/TLS.
- Access authorisation: Access to personal data is restricted to authorised persons who need it for their duties, on a "need-to-know" basis.
- Password security: Customer panel passwords are stored in irreversible form (hashed).
- Logging and monitoring: Access to systems is logged, and unusual activity and attack attempts are monitored.
- Abuse prevention: Spam and submission frequency limits are applied to the contact form.
- Keeping up to date: Our servers and software are regularly updated with security updates.
No data transmission over the internet or method of electronic storage can be guaranteed to be absolutely secure. If we learn that your personal data has been unlawfully obtained by third parties, we will notify the data subjects concerned and the Personal Data Protection Board as soon as possible, pursuant to Article 12 of the KVKK.
5. Third parties
We share your information only to the extent necessary to provide the service or to comply with a legal obligation. The main recipients are:
- For domain name transactions, TRABİS, the domain name registrar of which we are a reseller, ICANN-accredited registrars and registry operators,
- For SSL certificates, the certificate authority Sectigo; for trademark applications, TÜRKPATENT (Turkish Patent and Trademark Office),
- For payments, banks and payment institutions; for accounting, our certified public accountant,
- For the website, Google LLC (Google Analytics and Google Tag Manager — only with your consent; Google Maps — only when you choose to display the map),
- For software, website and digital marketing services, at your request, app stores and advertising platforms (Apple, Google, Meta, TikTok), e-commerce infrastructure providers and the service providers with which integrations are made,
- Upon request, authorised public institutions and organisations and judicial authorities.
Third-party service providers have their own privacy policies. Kilitkutu is not responsible for the content and privacy practices of sites accessed through links to other sites on our website.
6. Cookies
By default, only strictly necessary cookies are used on our website; analytics cookies are subject to your consent. You can change your preference at any time via the "Cookie preferences" link in the site footer. For details, please see the Cookie Policy.
7. Retention period
We retain your information only for as long as the purpose of processing requires and for the periods prescribed by the legislation. For example, contact form correspondence is retained for 2 years from the conclusion of the request. All retention periods are set out in the KVKK Privacy Notice.
8. Children's privacy
Our services are intended for natural persons who have the capacity to enter into contracts and for legal entities. Persons under the age of 18 should not share personal data through the contact form or the customer panel without the consent of their parent or guardian. If we become aware that a child's data has been shared in this way, we will delete it, subject to our statutory retention obligations.
9. Your rights
Under Article 11 of the KVKK, you have rights regarding your personal data, such as the right to request information, rectification, erasure and to object. How you can exercise these rights is explained in the KVKK Privacy Notice.
10. Changes to this policy
This policy may be updated in line with changes to our services or to the legislation. The current version is always published on this page, and the "Last updated" date at the top of the page is changed. We also notify our customers of significant changes by e-mail.
11. Contact
For privacy-related questions and requests, you can write to [email protected], reach us by phone at +90 (422) 333 01 12, or use our Contact page. You can send written applications to the address Hacı Abdi Mah. Sofa Sk. No:40/7 Battalgazi / Malatya, and applications made via KEP (registered electronic mail) to —.