KVKK Disclosure Notice

As Argen Teknoloji, this Disclosure Notice has been prepared to fulfill our disclosure obligation pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), within the scope of cloud technology services we provide under the Hiperbulut brand.

1. Data Processor

In accordance with the KVKK, Argen Teknoloji (Hiperbulut) holds the capacity of data processor, processing personal data determined by its customers as data controllers, in accordance with the instructions of the data controller. Your personal data may be processed within the scope described below.

2. Personal Data Processed

The following categories of your personal data are processed by Hiperbulut:

3. Purposes of Processing Personal Data

Your personal data is processed in accordance with the personal data processing conditions specified in Articles 5 and 6 of the KVKK for the following purposes:

• Providing and managing cloud server (VPS), cloud storage, cloud backup, and security solution services
• Fulfilling obligations arising from the service agreement
• Responding to requests, questions, and complaints communicated via the contact form, email, and phone
• Issuing invoices and processing payment transactions
• Providing technical support and customer services
• Measuring, increasing, and improving service quality
• Planning and managing information security processes
• Fulfilling obligations required by legal regulations (tax, commercial, and electronic communication legislation, etc.)
• Providing information to authorized public institutions and organizations
• Conducting promotional, campaign, and informational activities for products and services when consent has been given
• Planning internal audit, risk management, and business continuity activities

4. Legal Basis for Processing Personal Data

Your personal data is processed based on the following legal grounds as specified in paragraph 2 of Article 5 of the KVKK:

• Establishment or performance of a contract: Processing of data necessary for the creation of the service agreement and provision of services (Art. 5/2-c)
• Legal obligation: Fulfillment of obligations arising from tax legislation, the Turkish Commercial Code, Law No. 5651, and other regulations (Art. 5/2-d)
• Legitimate interest: Improving service quality, ensuring information security, and maintaining business continuity (Art. 5/2-f)
• Explicit consent: Your explicit consent is obtained for processing that does not fall under the above legal grounds, such as marketing and communication activities (Art. 5/1)

5. Transfer of Personal Data

Your personal data may be transferred to the following parties in accordance with Articles 8 and 9 of the KVKK and limited to the purposes stated in this Disclosure Notice:

5.1. Domestic Transfer

• To authorized public institutions and organizations within the scope of legal obligations (courts, prosecutors, tax offices, BTK, etc.)
• To organizations providing legal consultancy and financial advisory services
• To independent audit firms
• To payment infrastructure service providers

5.2. International Transfer

Within the scope of providing our services, your personal data may be shared with the following international service providers:

• Supabase: Database infrastructure service for the secure storage of contact form data
• Google (Gmail SMTP): Email service for delivering contact form notifications

International data transfers are carried out in compliance with the conditions specified in Article 9 of the KVKK, with adequate measures in place. In cases where the destination country does not provide adequate protection, a written undertaking is signed with the relevant data controller/data processor and the approval of the Personal Data Protection Board is obtained.

6. Data Security Measures

As Argen Teknoloji, in our capacity as data processor, we take the necessary technical and administrative measures pursuant to Article 12 of the KVKK to prevent the unlawful processing of your personal data, to prevent unauthorized access, and to ensure their preservation:

Technical Measures

• Encrypted data transmission with SSL/TLS certificates
• Firewall protection
• Database access controls and encryption
• Regular security scans and penetration tests
• Regular application of security patches
• Backup and disaster recovery procedures
• Log management and monitoring systems
• DDoS protection infrastructure

Administrative Measures

• Preparation of personal data processing inventory
• Employee training on data security
• Execution of confidentiality agreements
• Access authorization and restriction policies
• Establishment of data processing policies and procedures
• Preparation of data breach response plan

7. Data Subject Rights (KVKK Article 11)

Under Article 11 of the KVKK, as a data subject, you have the following rights:

1. To learn whether your personal data is being processed
2. To request information if your personal data has been processed
3. To learn the purpose of processing your personal data and whether it is being used in accordance with its purpose
4. To know the third parties to whom your personal data is transferred, whether domestically or abroad
5. To request correction of your personal data if it has been processed incompletely or incorrectly
6. To request deletion or destruction of your personal data under the conditions stipulated in Article 7 of the KVKK
7. To request that the operations carried out pursuant to items (5) and (6) above be notified to third parties to whom your personal data has been transferred
8. To object to any outcome arising against you through the analysis of processed data exclusively by automated systems
9. To claim compensation for damages in the event that your personal data is processed unlawfully

8. Application Method

You can submit your applications regarding the rights listed above through the following methods. Your applications will be evaluated by us and forwarded to the relevant data controller:

Applications must include the following information: first name, last name, Turkish ID number (passport number for foreign nationals), residential or business address for notification purposes, email address for notification if available, phone number, and the subject of the request.

Your application will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if the process requires an additional cost, the fee determined by the Personal Data Protection Board may be charged.

9. Disclosure Notice Updates

This Disclosure Notice may be updated in parallel with changes in Law No. 6698 and related legislation, as well as changes in Hiperbulut's personal data processing purposes and policies. Updates take effect on the date they are published on hiperbulut.com.