Privacy Notice (KVKK)

1. Identity of the data controller

HOSTIMOR acts in the capacity of data controller for its customer account, order, invoicing, support and own site security processes. With respect to data relating to visitors of websites or applications hosted by the Customer, the Customer's role as data controller and HOSTIMOR's role as data processor within the scope of the service are assessed separately.

2. Categories of data processed and collection methods

• Identity and customer information: full name/trade name, account details, identity/tax information required for the transaction.
• Contact: e-mail, telephone, address, KEP or notification details provided.
• Customer transaction and finance: service/order information, invoices, payment status and records relating to the matching of payment transactions.
• Support: subject of the request, correspondence, documents submitted by the Customer for technical support and the necessary technical information.
• Transaction security and site usage: IP address, session, access/time logs, browser/device information and related cookie/preference information.

Data is obtained through web and account forms, order/payment records, the support system, e-mail, telephone and written applications, as well as by automated or non-automated means during the technical operation of the service. Not all data categories are requested in every transaction. Do not attach special categories of personal data that are not needed for the service, or unnecessary documents of third parties, to support correspondence.

3. Purposes and legal grounds

• Account, order, service activation and support: Article 5(2)(c) of the Law, for necessary processing directly related to the conclusion or performance of a contract.
• Invoices, financial records and applicable legal notification/record-keeping obligations: Article 5(2)(a) and/or (ç), as expressly provided for in the relevant law and for compliance with the legal obligation of the data controller; for each record, the applicable obligation is taken as the basis.
• Dispute and request records: Article 5(2)(e), for the establishment, exercise or protection of a right.
• Account and infrastructure security, prevention of abuse: Article 5(2)(f), for processing within the scope of a necessary legitimate interest, provided that fundamental rights and freedoms are not harmed; proportionality and the balance of interests are assessed.
• Optional marketing or non-essential tracking: where no other valid processing condition exists, Article 5(1), for freely given, specific and informed explicit consent. Consent to commercial electronic messages is assessed separately under the relevant separate legislation.

The privacy notice, acceptance of the agreement and explicit consent are not used interchangeably. If the data necessary to provide the service is processed on the grounds of the contract/legal obligation, this processing is not additionally made conditional on consent to advertising. The fact that data was sent by the Customer does not by itself mean that it may be processed for any purpose.

4. Recipient groups and purposes of transfer

To the extent required by the service, recipient groups may include payment institutions/banks (processing payments), invoicing and financial service providers (creating legal records), domain name registrars/registry operators (registration, transfer and renewal), data center/infrastructure and technical support providers (hosting and support), competent public authorities (legal obligations/requests) and legal advisors (management of rights and disputes). Transfers are limited to the relevant specific service and legal basis.

If a transaction requires a transfer to a registrar or external provider located abroad, adequacy or appropriate safeguard mechanisms in accordance with Article 9 of the Law and the relevant conditions are assessed. This document does not claim that all data is transferred abroad or that every transfer is made lawful in advance by explicit consent. Current recipient and transfer information for each service can be requested from the data controller.

5. Retention and destruction

The retention period is determined according to the purpose of the data, the agreement, the financial/technical record-keeping obligations under the legislation and the requirements of legal claims. When the processing conditions cease to apply, the data is deleted, destroyed or anonymized. Closing an account does not require the immediate deletion of invoice or dispute records that must legally be retained; nor does the existence of such a record justify keeping all data indefinitely.

Automatic backups of hosting content are taken daily and retained for 2–7 days. This technical backup range is not a common retention period for all personal data. Details can be found in the Backup and Data Retention Policy.

6. Rights of the data subject and applications

Under Article 11 of the Law, you have the right to learn whether your data is processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in line with that purpose; to know the domestic/foreign recipients; to request the correction of incomplete or inaccurate data; to request deletion/destruction under the legal conditions; to request that correction and deletion be notified to recipients; to object to a result against you arising solely from automated systems; and to request compensation for damage caused by unlawful processing.

Application channels, identity verification and the response method are explained in the KVKK Application Procedure. Your request is answered as soon as possible depending on its nature, and within 30 days at the latest. Applications are, as a rule, free of charge; where additional costs arise, only the fee rules permitted by the legislation may be applied.