1. Identity of the data controller
The company intended to be identified as data controller is DERA Test Belgelendirme ve Mühendislik Hizmetleri Ltd. Şti..
Address: Atakent Mah. 221. Sk. Rota Office Sit. A Blok No:3/1 No:17, Küçükçekmece / İstanbul. Email: info@deracert.com. The company’s MERSIS number, trade-registry details, any data-controller representative and registered electronic mail address have not been provided and must be confirmed before publication.
2. Categories of data that may be processed
Information entered into the quote form is not sent or stored by the site. If the user sends the email draft through their own email application, the categories below may be processed through the email communication channel, subject to confirmation in the data processing inventory.
- Identity data: full name.
- Contact data: email address and optional phone number.
- Professional and corporate data: company name.
- Request data: selected service, product group, message, product and target-market details.
- Transaction-security data: IP address, date/time and server logs; whether Hostinger or another provider records these must be verified.
3. Purposes of processing
- Receiving, assessing and responding to contact and quote requests.
- Identifying the requested technical service and preliminary scope.
- Managing communication and request records with a prospective customer.
- Meeting legal obligations and establishing, exercising or defending rights in possible disputes.
- Securing the website and communications infrastructure, only for technical records that are actually collected.
4. Legal grounds — awaiting confirmation
The exact legal ground has not been approved for each processing activity and data category. Following the inventory, only the condition in Article 5 that fits the actual activity should be used, potentially including necessity for entering into or performing a contract, compliance with a legal obligation, establishment/exercise/protection of a right, or legitimate interests that do not harm fundamental rights.
Consent should not be used as the default ground where another processing condition applies, and only where freely given consent requirements are genuinely met. Transparency and consent are separate processes.
5. Collection methods
Data may be obtained electronically or verbally through email and telephone channels. The quote form does not transfer information to a server; it prepares an email draft on the user’s device for the user to send.
The email communication process, server logs and any future CRM transfer steps must be confirmed in the inventory, and automated or partly automated collection methods must be described.
6. Recipient groups and transfer purposes — awaiting confirmation
Actual recipients and transfer flows have not been verified. If confirmed by the business model and contracts, data may be shared only as necessary with hosting, email or IT providers, technical assessment parties required by the request, and legally authorised public bodies.
Any disclosure to laboratories, assessment bodies or other technical parties must have a project-specific scope, purpose and legal ground. This notice does not state that such transfers currently occur.
7. International transfers — awaiting confirmation
The server locations of hosting, email, backup, form and security providers have not been verified, so no definitive statement can be made about international data transfers.
If an international transfer occurs, the mechanism, country, recipient, data categories and appropriate safeguard must be identified under the current Article 9 of Law No. 6698 before publication.
8. Retention and deletion
Definitive retention periods have not been established. Maximum periods must be documented in the processing inventory by linking each data category to its purpose, legal obligations and limitation periods. Data should then be deleted, destroyed or anonymised as applicable.
9. Rights of the data subject
Under Article 11 of Law No. 6698, data subjects have the following rights.
- Learn whether personal data is processed and request information if it is.
- Learn the purpose of processing and whether data is used in accordance with that purpose.
- Know third parties to whom data is transferred in Türkiye or abroad.
- Request correction of incomplete or inaccurate data.
- Request deletion or destruction under the conditions in the Law and notification of correction or deletion to recipients.
- Object to an adverse result arising exclusively from automated analysis.
- Claim compensation for damage caused by unlawful processing.
10. Application method — must be completed
For initial contact, info@deracert.com and Atakent Mah. 221. Sk. Rota Office Sit. A Blok No:3/1 No:17, Küçükçekmece / İstanbul may be used. Before publication, DERA must specify accepted formal methods under Article 13, including any registered electronic mail or registered email channel, identity-verification steps and the person responsible for applications.