KVKK Disclosure Notice

1. Data controller

The data controller is PHISHARK TEKNOLOJİ ANONİM ŞİRKETİ at the address stated below. Privacy requests may be sent to [email protected] using a method permitted by the KVKK and related communiqués.

2. Personal data and processing purposes

Identity/contact, account, transaction, customer-operation, security, legal-process and technical usage data; and content submitted for security analysis may be processed to establish and perform contracts, provide and secure the service, manage billing and support, prevent abuse, meet legal duties and protect or exercise rights.

3. Legal grounds and collection methods

Data is collected electronically from websites, applications, APIs, extensions, email add-ins, customer administrators, support channels and integrated providers. It is processed on the legal grounds in Articles 5 and 6 of the KVKK, including explicit legal provision, performance of a contract, legal obligation, establishment or protection of a right, legitimate interests that do not harm fundamental rights, and explicit consent where required.

4. Domestic and overseas transfers

Data may be transferred, only as necessary and proportionate, to infrastructure, security, AI, communications, support and payment providers; advisers; authorized public bodies; and enterprise customers acting as controller. Overseas transfers must use an Article 9 KVKK mechanism applicable at the time, including adequacy, an appropriate safeguard or an applicable statutory exception.

The transfer inventory, recipient countries and executed standard contracts must be verified before publication.

5. Rights under Article 11

• Learn whether personal data is processed and request information if it is.
• Learn the purpose of processing and whether data is used consistently with that purpose.
• Know third parties in Türkiye or abroad to whom data is transferred.
• Request correction of incomplete or inaccurate data and notification to recipients.
• Request deletion or destruction where legal conditions are met and notification to recipients.
• Object to a result against you arising exclusively from automated analysis.
• Claim compensation where unlawful processing causes damage.

6. Application procedure

Applications must identify the requester and the requested right and include information necessary to locate the relevant records. PhiShark will respond within the statutory period, ordinarily no later than 30 days. A fee may be charged only where law or the authority’s tariff permits.