Information Notice under Law No. 6698 on the Protection of Personal Data

1. Identity of the Data Controller

This Information Notice has been prepared by VIPULSE TEKNOLOJİ ANONİM ŞİRKETİ ("Company"), acting as the data controller, pursuant to Law No. 6698 on the Protection of Personal Data ("Law") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilment of the Obligation to Inform.

Data Controller: VIPULSE TEKNOLOJİ ANONİM ŞİRKETİ

Address: Ostim OSB, Cevat Dündar Cd., Ostim Teknopark Turuncu Bina No: 43, 06374 Ankara, Türkiye

Contact Information: [email protected]
+90 (312) 386 00 23

As a result of visiting the Company's website located at www.vi-pulse.com ("Website"), you have the status of a "data subject" within the scope of the Law.

2. Personal Data Processed, Purposes of Processing and Legal Grounds

Your personal data is processed in accordance with the general principles set out in the Law, based on the purposes and legal grounds specified below.

2.1. When the Website Is Visited

Category of data processed: Transaction security information, including the date and time of connection, IP address, protocol information used, amount of data transferred, information regarding pages accessed, device information and browser information.

Purposes of processing: Conducting information security processes, carrying out activities in compliance with legislation, and ensuring the operation and security of the Website.

Legal ground: Processing being expressly provided for by law pursuant to the Law, including obligations under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications and the relevant secondary legislation, and processing being necessary for the Company to fulfil its legal obligations pursuant to the Law.

2.2. When Contact Is Made Through the Contact Form or by Electronic Mail

Categories of data processed: Identity information, including name and surname; contact information, including electronic mail address and telephone number; information regarding the subject and content of the request; and transaction security information, including the date and time of submission.

Purposes of processing: Conducting communication activities and receiving, evaluating and resolving requests and complaints.

Legal ground: Processing being necessary for the legitimate interests of the data controller pursuant to the Law, provided that the fundamental rights and freedoms of the data subject are not harmed. Where the request is connected with a contractual relationship, processing is based on the legal ground that it is directly related to the establishment or performance of a contract pursuant to the Law.

2.3. Within the Scope of Cookie Use

Data obtained through cookies that are strictly necessary for the operation of the Website is processed on the legal ground of the legitimate interests of the data controller pursuant to the Law.

Data obtained through non-essential cookies, including performance/analytics and targeting/marketing cookies, is processed only where your explicit consent has been obtained pursuant to the Law. You may withdraw your explicit consent at any time. For detailed information, you may review the Cookie Policy.

2.4. Special Categories of Personal Data

Special categories of personal data are not requested within the scope of the Website, and their processing is not envisaged. You are kindly requested not to submit data of this nature voluntarily.

3. Method of Collecting Personal Data

Your personal data is obtained directly from you, wholly or partially by automated means and electronically, when you visit the Website, complete contact forms or send electronic mail.

4. Transfer of Personal Data

4.1. Domestic Transfers

Your personal data may be transferred, in accordance with the conditions set out in the Law and only to the extent necessary, to:

Suppliers and service providers from which hosting, infrastructure, maintenance and information security services are obtained,
Persons and organisations from which legal consultancy and audit services are obtained,
Authorised public institutions and organisations and judicial authorities, where requested pursuant to legislation.

Please be informed that transfers may be carried out without fulfilling the obligation to inform or obtaining explicit consent in cases permitted under the Law.

4.2. International Transfers

Where your personal data is required to be transferred abroad, the transfer shall be carried out pursuant to the Law:

On the basis of an adequacy decision issued by the Personal Data Protection Board regarding the relevant country, sector or international organisation, where such a decision exists,
Where no adequacy decision exists, provided that one of the appropriate safeguards specified in the Law is ensured, including the execution of a standard contract between the parties, the existence of binding corporate rules, the preparation of a written undertaking or the existence of an agreement that does not qualify as an international treaty, and provided that the data subject has the opportunity to exercise their rights and access effective legal remedies in the country to which the data is transferred,
Where the above conditions cannot be met, only in the presence of the occasional circumstances specified in the Law.

Where the servers of hosting or cloud service providers are located abroad, the above conditions shall also be complied with.

5. Retention Period of Personal Data

Your personal data is retained for the period prescribed by the relevant legislation, where such a period is specified, or, where no period is specified, for as long as necessary for the purpose for which it is processed. The retention periods prescribed under Law No. 5651 and the relevant legislation are taken as the basis for traffic and log records.

When the retention period expires or the reasons requiring processing cease to exist, your personal data is deleted, destroyed or anonymised within the periodic destruction periods specified in the Regulation on the Deletion, Destruction or Anonymisation of Personal Data and the Company's retention and destruction policy.

6. Your Rights as a Data Subject

Pursuant to the Law, you have the right to:

Learn whether your personal data is being processed,
Request information regarding the processing of your personal data, where it has been processed,
Learn the purpose for which your personal data is processed and whether it is used in accordance with that purpose,
Know the third parties to whom your personal data has been transferred domestically or abroad,
Request the correction of your personal data where it has been processed incompletely or inaccurately,
Request the deletion or destruction of your personal data within the framework of the conditions prescribed under the Law,
Request that the transactions carried out pursuant to paragraphs (5) and (6) above be notified to third parties to whom your personal data has been transferred,
Object to the occurrence of a result against you through the analysis of your processed data exclusively by automated systems,
Request compensation for damages where you suffer loss due to the unlawful processing of your personal data.

7. Application Procedure

You may submit your requests concerning the rights listed above, pursuant to Article 13 of the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller:

In person or through a notary public, by submitting a written petition bearing a wet signature to Ostim OSB, Cevat Dündar Cd., Ostim Teknopark Turuncu Bina No: 43, 06374 Ankara, Türkiye,
To the registered electronic mail address, by signing your application with a secure electronic signature or mobile signature,
To [email protected] using your electronic mail address registered in the Company's system.

Your application must contain your name and surname; your signature if the application is submitted in writing; your Turkish Republic identity number, or, for foreign nationals, your nationality, passport number or identity number, where available; your residential or business address for notification; your electronic mail address for notification, where available; your telephone and fax numbers; and the subject of your request. Information and documents relating to the subject must be attached to the application.

In order to submit an application on behalf of a third party, a special power of attorney issued through a notary public in the name of the person submitting the application must be presented.

Your request shall be concluded free of charge within no more than thirty days, depending on its nature. Where the transaction requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board. Your application may be rejected by providing the reasons for the rejection.

Where your application is rejected, the response provided is found insufficient or no response is provided within the prescribed period, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and, in any event, within sixty days of the application date. Pursuant to the Law, a complaint may not be submitted to the Board without first exhausting the application procedure before the data controller.

8. Amendments to the Information Notice

The Company reserves the right to amend this Information Notice in accordance with legislative amendments and updates to its data processing activities. The current version shall be published on the Website.

Last Updated: 03.08.2026