KVKK Privacy Notice (Türkiye)

1. Data controller and scope

Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), the personal data within the scope of this notice is processed by Forty2 LLC (1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA) acting as the data controller; the privacy contact address is privacy@dynacop.com. Argen Bulut ve Yazılım Teknolojileri A.Ş. (Şişli/Istanbul) provides operations and support services in Türkiye.

Scope: this notice covers the activities for which Dynacop is the data controller — website visitors, management panel accounts, subscription/billing, and support communication. Windows sign-in records, account inventories, machine details, and attack telemetry obtained from protected machines are processed in the capacity of data processor on the instructions of our business customers; for that data, the data controller is the relevant Dynacop customer, and the obligation to inform its own employees rests primarily with it.

2. Personal data processed

• Identity and contact: name, email address, language preference, company details
• Account and transaction security: panel sign-in time and IP address, browser/device details, session and trusted-device records, the type and enrollment status of the verification factor
• Subscription and finance: plan and subscription details, invoice details, payment transaction identifier (payment card data never reaches Dynacop; it is processed by Stripe)
• Communication: the content of support and sales requests, dispatch records of transactional emails
• Site and network security: server logs, IP address, user agent, and Cloudflare security verification results

3. Purposes and legal bases

• Creating the account, managing the subscription, and providing the service — formation or performance of a contract (KVKK art. 5/2-c)
• Invoicing, accounting, and statutory records — compliance with a legal obligation (art. 5/2-ç)
• Panel, account, and service security; fraud and abuse prevention — legitimate interest (art. 5/2-f)
• Responding to support requests and service notifications — performance of the contract; where necessary, establishment, exercise, or protection of a right (art. 5/2-e)
• Transactional emails (account, invitation, security, and subscription operations) — performance of the contract

No marketing profiling or behavioral advertising is carried out.

4. Method of collection

Personal data is collected by automatic or partially automatic means through forms on the site and panel, panel session interactions, and email interactions.

5. Recipient groups

Personal data may be transferred, only to the extent necessary for the stated purposes, to providers of hosting, payment, email delivery, network security, mapping, and technical support services; to legally authorized public institutions; and to financial/legal advisors. The current list of service providers is available in our Privacy Policy.

International transfers: the service's primary data is hosted in Türkiye. However, limited personal data within the scope of payments, transactional email, network security, and Forty2 LLC's service administration may be transferred to the United States and to other countries where the relevant service providers operate. International transfers are carried out using the appropriate safeguards and transfer mechanisms set out in KVKK art. 9.

6. Retention

Personal data within the scope of this notice is retained for as long as your account is active and as necessary for the relevant purpose. After the account is closed, data is deleted or anonymized within a reasonable period; data subject to statutory retention obligations, such as invoicing and accounting records, is kept for the applicable statutory periods.

7. Your rights under KVKK art. 11

• To learn whether your personal data is processed and to request information if it is
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties to whom the data is transferred, in Türkiye or abroad
• To request correction of incomplete or inaccurate data
• To request deletion or destruction under KVKK art. 7, and notification of these operations to third-party recipients
• To object to a result arising against you from analysis exclusively by automated systems
• To claim compensation for damage arising from unlawful processing

8. How to apply

You may submit your requests through the following channels:

• In writing, to the data controller's postal address stated above
• Via registered electronic mail (KEP), secure electronic signature, or mobile signature
• From the email address you previously provided to Dynacop and registered in our systems, to privacy@dynacop.com

Applications are concluded in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller — as soon as possible and within 30 days at the latest, free of charge as a rule; where the operation additionally requires a cost, the fee in the tariff set by the Personal Data Protection Board may apply.

If your application is rejected, the response is found insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the response and in any case within 60 days of the application date.