KVKK Information Notice and Privacy Policy

1. Data Controller

This KVKK Information Notice and Privacy Policy has been prepared by HAZEM GLOBAL TERCÜME VE DANIŞMANLIK PROFESYONEL SİTE YÖNETİMİ İNŞAAT SANAYİ VE TİCARET LİMİTED ŞİRKETİ (Tax No: 4601152960) ("Hazem", "Company", "we") acting in the capacity of data controller under Law No. 6698 on the Protection of Personal Data ("KVKK").

Contact: info@hazemtercume.com
Telephone/WhatsApp: +90 541 583 01 03
Head office information: Merkez mahallesi 52127. Sokak No.11 / A Skysense Mezitli A blok Daire no: 86 Mezitli / Mersin

2. Scope

This notice relates to personal data processed through the Hazem Tercüme website, panel, order forms, payment pages, support channels, document upload/OCR flows, and connected digital services. A User who uploads documents or data belonging to third parties to the Platform acknowledges that they are authorized to share such data and that they have informed the relevant persons to the extent required.

3. Categories of Personal Data Processed

The following categories of data may be processed by Hazem:

- Identity and contact data: name, surname, title, e-mail, telephone, invoicing and delivery information.
- Account and transaction data: user account, order number, service preferences, language pairs, price/payment status, support requests, acceptance records.
- Document and content data: files uploaded for translation, images, texts, official documents, personal data contained within documents, and information shared by the User.
- Payment and financial data: payment method, payment reference, invoice information; full card details are not stored by Hazem and are processed by the relevant payment institutions.
- Technical data: IP address, device/browser information, log records, cookies, session and security records.
- Special categories of personal data: where contained in documents uploaded by the User, special categories of data such as health, criminal convictions, biometric data, religion, trade union membership, and political opinion may be processed on a limited basis for the performance of the service.

4. Purposes of Processing

Personal data are processed for the purposes of preparing quotes, document analysis, provision of the translation service, coordination of additional services such as notarization/apostille/courier, payment and invoicing, customer support, membership and order tracking, quality control, resolution of disputes, prevention of fraud and misuse, information security, fulfillment of legal retention and notification obligations, and, where consent to commercial communications has been given, conducting campaigns and providing information.

5. Legal Grounds

Data are processed in reliance on the applicable processing conditions under Article 5/2 of the KVKK, primarily the establishment or performance of a contract, the legal obligation of the data controller, the establishment/exercise/protection of a right, legitimate interest, and cases where the data have been made public by the data subject themselves. Where explicit consent is required, explicit consent is additionally obtained. Special categories of personal data, where shared by the User within documents due to the nature of the service, are processed limited to the performance of the service, within the framework of the processing conditions compliant with the applicable legislation and the necessary security measures.

6. Transfer of Data

Personal data may be shared, for the performance of the service, with sworn/specialist translators, editors, notary offices, the relevant institutions in apostille and official procedures, courier/cargo companies, payment institutions, banks and financial institutions, hosting, cloud, OCR, e-mail, SMS/WhatsApp, security, and analytics service providers, accounting and legal advisors, and authorized public institutions and organizations.

Where the technical infrastructure or service providers are located abroad, personal data may be transferred abroad within the framework of transfer mechanisms compliant with the KVKK and secondary legislation, explicit consent, an adequacy decision, standard contracts, or other safeguards prescribed by the Personal Data Protection Board.

7. Methods of Collection

Data are collected by automated or non-automated means through website forms, membership screens, document upload areas, e-mail, telephone, WhatsApp, payment pages, support correspondence, cookies, log records, and OCR and file analysis systems.

8. Retention Period

Personal data are retained for the period necessary for the purpose of processing and for the duration of the statute of limitations and the accounting, tax, consumer, commercial, and evidentiary obligations prescribed in the applicable legislation. When the purpose ceases to exist and no retention obligation remains, the data are deleted, destroyed, or anonymized. Translation documents are retained limited to the period necessary for completion of the service, revisions, support, disputes, and legal obligations; the User's deletion requests are assessed to the extent permitted by legislation.

9. Data Security

Hazem implements access control, authorization, logging, SSL/TLS, secure hosting, backups, confidentiality obligations for employees/service providers, and the necessary technical/administrative measures. The absolute security of data transmission over the internet cannot be guaranteed; the User is also obliged to ensure the security of their account password, device, and e-mail.

10. Rights of Data Subjects

Under Article 11 of the KVKK, data subjects have the right to learn whether their personal data are being processed; to request information if they have been processed; to learn the purpose of the processing and whether the data are used in accordance with that purpose; to know the third parties to whom the data are transferred domestically/abroad; to request the correction of incompletely/incorrectly processed data; to request deletion/destruction where the conditions are met; to request that correction/deletion operations be notified to the third parties to whom the data have been transferred; to object to results arising to their detriment through automated analysis; and to claim compensation in the event of damage due to unlawful processing.

Applications may be submitted to info@hazemtercume.com. An application must include the name-surname/title, contact information, the subject of the request, and reasonable information enabling identity verification. Hazem concludes applications within the time limits set out in the KVKK and the applicable legislation.

11. Cookies

Cookies and similar technologies may be used on the Platform for session management, security, remembering preferences, performance, and analytics purposes. Essential cookies are necessary for the operation of the service; for other cookies, preference/consent mechanisms may be applied in accordance with legislation.

12. Updates

This notice may be updated due to changes in legislation, technical infrastructure, service scope, or business processes. The current version is published on the Platform and enters into force on the date of its publication.

13. Service Providers, International Transfers, and Analytics

Data may be shared, limited to the purpose, with the recipient groups necessary for the provision of the service, such as hosting/database infrastructure, e-mail delivery, banks and payment institutions, the courier company where courier service has been requested, and the in-house OCR infrastructure that processes document content. Authorization, access logging, confidentiality obligations, and data processor agreements are applied.

Google Analytics is loaded only upon the user's acceptance of the "Analytics" preference. In that case, device and usage data may be processed on the infrastructure of Google Ireland Limited/Google LLC and transferred abroad. Explicit consent may be withdrawn at any time via the cookie panel. Other processes requiring transfer abroad are not initiated unless one of the appropriate safeguards or exceptions under Article 9 of Law No. 6698 (KVKK) is satisfied.

14. Retention and Destruction Periods

Uploads not linked to an order and draft order files are automatically deleted after 24 hours; working files of delivered or cancelled orders are automatically deleted after 30 days. The order contract, preliminary information, and acceptance evidence are retained for at least 3 years for the evidentiary period under the legislation on Distance Contracts; invoices and financial records are retained for the 5- and 10-year periods under the applicable tax and commercial legislation. Account data are retained for as long as the account remains open and thereafter for the duration of legal claim/dispute periods. Personal data whose period has expired are deleted, destroyed, or anonymized as part of periodic operations. Records subject to a statutory retention obligation are not deleted before that period expires.

15. Application Procedure

Data subjects may submit applications concerning their rights under Article 11 of Law No. 6698 (KVKK), together with information suitable for identity verification, to info@hazemtercume.com or to the address Merkez Mahallesi 52127. Sokak No:11/A Skysense Mezitli A Blok Daire No:86 Mezitli/Mersin. Applications are concluded free of charge within 30 days at the latest; where the operation additionally requires a cost, the tariff of the Personal Data Protection Board may be applied.