Privacy Notice on the Protection of Personal Data

Last updated: September 29, 2026 · Prepared under Law No. 6698 on the Protection of Personal Data ("KVKK", Türkiye's Personal Data Protection Law).

This is an English translation provided for convenience. In case of any discrepancy, the Turkish original prevails.

1. Data controller

This privacy notice has been prepared by Globya Bilgi Teknolojileri (Globya Information Technologies; Mustafa Kemal Mh. Dumlupınar Bulvarı, Tepe Prime Plaza A Blok No:266 D:18, Çankaya/Ankara, Türkiye; "Globya"), acting as data controller, under Article 10 of Law No. 6698 on the Protection of Personal Data (the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform you about the personal data processing activities carried out through the globya.com.tr and globya.net.tr domains.

2. Personal data processed and how it is collected

Through the contact form, the IMFLEXI demo form and the site assistant (chatbot) on our website, the following personal data is processed, entered directly by you in electronic form:

Identity and contact data: full name, email address, phone number, company/organization name
Transaction/request data: message content, request subject and (if any) project details such as industry, current platform and volume; if you use the site chat, the full conversation, the pages you visited during the chat and (if you fill it in) your satisfaction survey scores
Transaction security data: your IP address, browser/device information (user agent), referring page (referer), the time you took to fill in the form and the reCAPTCHA verification result — this data is recorded automatically by our servers when you submit the form
Transaction/consent record: whether the checkbox confirming that you have read this notice and giving your explicit consent was ticked, and the date/time of consent
(Only with your separate explicit consent) Usage/analytics data: if you choose "Accept" in the cookie banner, your page view, scroll and click behavior via Google Analytics and Microsoft Clarity — see the Cookie Policy

3. Purposes of processing

Your personal data is processed to receive, evaluate and respond to your contact/proposal request; to carry out pre-contract discussions with you; to route your request to the relevant team; to send automatic confirmation/information emails; to protect our forms against misuse (spam, bots, fake submissions) and thereby ensure the legal security of Globya and of you; and, if you have given explicit consent, to measure and improve the site experience.

4. Legal basis for processing

Your identity, contact and request data is processed on the legal grounds of Article 5(2)(c) of the Law — "processing is directly related to the establishment or performance of a contract" (the proposal/business discussion process) — and Article 5(2)(f) — "processing is necessary for the legitimate interests of the data controller" (so that we can respond to your request). Your transaction security data (IP, user agent, etc.) is likewise based on the legitimate interest of preventing spam, bots and fraud under Article 5(2)(f). The storage of your data on servers hosted abroad and the Google Analytics / Microsoft Clarity analytics cookies are based on your explicit consent under Articles 5(1) and 9 of the Law, as explained in sections 6 and 7 below.

5. Parties to whom personal data is transferred and why

Your personal data may be transferred to the following parties, limited to the purposes above:

Globya employees/officers — to evaluate and respond to your request (within Türkiye)
Our email/SMTP infrastructure provider — to deliver notification and automatic reply emails
Google LLC (reCAPTCHA) — to protect forms against bot/spam attacks; in doing so, your IP address and interaction data are shared with Google (see the Google Privacy Policy)
Our AI service provider (Anthropic PBC, USA) — to generate replies to the messages you write in the site chat; the chat content is processed by this provider only to generate replies
Microsoft Corporation (Clarity) — only with your explicit consent, to analyze the site experience
Google LLC (Google Analytics) — to measure visit statistics (page views, traffic source, device type); with your explicit consent, measurement with cookies; if you have not yet stated a cookie preference, only a cookieless and anonymous page signal (see the Cookie Policy)

Your personal data is never sold, rented or shared free of charge with third parties for marketing purposes.

6. Transfer of personal data abroad

Our website runs on an infrastructure (Hetzner Online GmbH) whose servers are physically located in Germany; your personal data is therefore technically stored in Germany. Likewise, data shared with Google (USA-based) listed in section 5 above and — with your explicit consent — with Google Analytics and Microsoft (USA-based) is transferred abroad. If you use the site chat, the messages you write are sent to our USA-based AI service provider to generate replies; sending a message in the chat window covers your explicit consent to this transfer.

Under Article 9 of the Law, a transfer to countries for which the Personal Data Protection Board has not announced an "adequacy decision" (including Germany, since the Board has not yet announced an adequacy decision for any country) is possible, where appropriate safeguards (standard contracts, undertakings, binding corporate rules) cannot be provided, only with your explicit consent, one of the limited "incidental" exceptions listed in the Law. Therefore, the consent checkbox you tick when submitting the form also covers your explicit consent to the transfer of your data abroad as described above.

7. Retention period

Your contact form records are kept for 2 years from the conclusion of your request (being answered, quoted or declined); at the end of this period they are deleted, destroyed or anonymized. If your request turns into a customer relationship, your data is transferred to our customer records and becomes subject to the retention periods set by commercial and financial legislation (for example, generally 10 years under Turkish Commercial Code No. 6102 and tax legislation).

8. Data security

Your personal data is protected by technical and administrative measures such as HTTPS-encrypted connections, server-side prepared statements, authorized access control, form submission rate limiting and automatic attack detection (honeypot).

9. Your rights (KVKK Article 11)

Under Article 11 of the Law, by applying to us you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in line with that purpose; to know the third parties to whom it is transferred in Türkiye or abroad; to request correction if it is incomplete or inaccurate; to request deletion/destruction when the conditions in Article 7 of the Law are met; to request that your correction/deletion requests be notified to the third parties to whom the data was transferred; to object to a result against you arising from analysis of the processed data exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.

10. How to apply

To exercise the rights above, or for any question or request about your personal data, you can email info@globya.com.tr with information that verifies your identity. Your request will be concluded free of charge within 30 days at the latest, depending on its nature.