Personal data protection notice
Information for the main website and Heptapus Group subdomains. The base text version is shown below.
Content version:
1. Controller identity
Operating identity: Heptapus Group — Heptapus Group Teknoloji Şirketleri Grubu. Contact: contact@heptapusgroup.com. These details were provided by the operator.
2. Contact enquiries
Name, email, subject and message are collected electronically to assess, answer and track your enquiry. If directly necessary for forming/performing a contract, KVKK 5(2)(c) may apply. Necessary and balanced legitimate interests may support general enquiry handling under 5(2)(f); preserving legal rights may fall under 5(2)(e). Sending a form is not marketing consent or blanket processing permission.
3. Recruitment
Name, email, optional phone and covering message are used to assess the specified vacancy and communicate with the applicant. Necessary pre-contractual steps may fall under 5(2)(c), and protecting legal rights under 5(2)(e). No indefinite talent-pool consent is collected. Sensitive data is not requested and would require a separate Article 6 assessment.
5. Security and administration
Authorised accounts, password hashes, permissions, session validity and audit events support access control and incident handling. Necessary balanced security processing may rely on 5(2)(f), and protection of rights on 5(2)(e). Starting Cloudflare Turnstile may send IP/browser signals to Cloudflare. Starting verification is not blanket consent to international transfers.
6. International transfers and recipients
Hetzner hosts the application server in Finlandiya, Helsinki for infrastructure operation. Cloudflare security, Google/YouTube media and email/backup providers need separate recipient and transfer assessments. Operator-supplied transfer details: Hetzner DPA / AB standart sözleşmesi mevcut. Regular foreign hosting is not made lawful merely by a general consent checkbox. Each actual flow requires its appropriate transfer route.
7. Retention and safeguards
Saklama süreleri bültene abone olunduktan sonra tekrar iptal başvurusu oluşturana kadardır, diğer başvurular için 1 senedir. Backup locations: Almanya, Hamburg. Access roles, signed sessions, password hashing, rate limiting and file-type checks are implemented; they are not a guarantee of absolute security.
8. Rights and requests
Under KVKK Article 11 you may learn whether/how data is processed, its purpose and recipients, request correction or deletion where conditions apply and notification of those actions to recipients, object to an adverse outcome based solely on automated analysis, and seek compensation for unlawful processing. Send a request identifying the relevant record to contact@heptapusgroup.com; applicable request formalities and proportionate identity verification may be needed. Do not send unnecessary identity documents. Valid requests must be answered promptly and within 30 days. For a complaint to the Turkish authority, the 30-day period from learning the response and overall 60-day period from the initial request must be considered.
9. Other applicable data protection laws
Where GDPR or another data protection law applies to the actual activity, rights such as access, rectification, erasure, restriction, objection, portability and complaint to the relevant authority may also arise. An EU server location alone does not establish GDPR applicability/compliance or meet Turkish transfer requirements.
Published team profiles, images and CVs
Team profiles may publish a name, role, professional background, photo, social link and CV file. Website image/CV files are served through public URLs, not a confidential file-sharing channel. Published profiles/files can be indexed by search engines. The scope, processing/publication grounds and authority to share each person's information must be confirmed separately; this notice does not assume everyone has consented. Sending a CV for assessment is not permission for unrestricted web publication. Contact us for removal/correction; external search caches may require separate updates. Externally hosted images also connect the browser to their image provider, so that data flow is not necessarily limited to the application server in Finland.