EN

Personal Data Protection Notice

Version 1.1 · Effective:

Contents

1. Data controller

Peraist İnşaat Yazılım Ticaret Limited Şirketi (“Peraist”)
MERSIS: 0728040533900001
Head office address: Pancarlı Mah. 58080 Sk. Park No: 4, 27060 Şehitkamil/Gaziantep, Türkiye
Email: info@peraist.com.tr

In accordance with Article 10 of Personal Data Protection Law No. 6698 (the “Law”), this notice explains how we process your personal data when you visit the peraist.com.tr and peraist.dev websites and when you use the contact form and the job application form.

2. When you visit the website

Data processed: your IP address, browser and device information, the page you visit, the date and time, and the page you came from.

Purpose: to keep the website secure and running without interruption, to prevent attacks and misuse, and to fix errors.

Legal basis: our legal obligation relating to data security (Law Art. 5/2-ç) and our legitimate interest (Art. 5/2-f).

Method: automatically, through server logs and the Cloudflare service that carries our traffic.

Visit statistics: To understand how often our pages are read, we use a measurement tool that runs on our own server and does not use cookies. This tool does not store your IP address. It does not track you across websites. It does not share data with third parties. It only produces aggregate counts of how many times each page was viewed per day and in which language. If your browser sends a “Global Privacy Control” or “Do Not Track” signal, your visit is not counted. You can turn this measurement off with the “Opt out of visit statistics” link at the bottom of the website. The legal basis is our legitimate interest (Art. 5/2-f).

Information about cookies is in our Cookie Policy.

3. Contact form

Data processed:

  • Your full name and email address.
  • If you provide them, your phone number, company, position and country.
  • Your message.
  • The language and time in which you sent the form.
  • To prevent misuse, a digest value derived from your IP address with a key that changes every day and is deleted at the end of the day. We do not store your IP address itself in this record.

Purpose: to respond to your request, to conduct quotation or partnership discussions, and to follow up our correspondence.

Legal basis:

  • If your request is aimed at concluding a contract, its being directly related to the conclusion of a contract (Art. 5/2-c).
  • In other cases, our legitimate interest (Art. 5/2-f).

4. Job application form (job applicants)

Data processed:

  • Your full name, email address and phone number.
  • The position you are interested in.
  • If you provide them, your city of residence and cover letter.
  • Your CV file and the education and work experience information in it.
  • The language and time of submission, and the IP digest described above.

Purpose:

  • To evaluate your application.
  • To contact you and arrange interviews.
  • To consider your application for suitable positions that open within 1 year of your application date.
  • To protect our rights in the event of a dispute.

Legal basis:

  • Its being directly related to the conclusion of an employment contract (Art. 5/2-c).
  • Our legitimate interest in considering you for new positions (Art. 5/2-f).
  • The establishment, exercise or protection of a right (Art. 5/2-e).

Special categories of data: We do not ask for special categories of personal data such as health, religion, ethnic origin, trade union membership or criminal records. If your CV contains such data, it is not used in the evaluation. If we notice it, we may delete your file and ask you for a CV with this information removed.

References: If you list other people's contact details as references in your CV, we will contact them only at an advanced stage of the evaluation and after informing you.

If you are hired, your application information is transferred to your personnel file. From then on, our privacy notice for employees applies.

We do not share your application with other companies.

5. Who we transfer data to

We do not sell your data or use it for advertising. Only our authorised employees who handle your request or application see the information you send through the forms.

To provide our services, we share data with the service providers below, only for the stated purpose and only to the extent necessary (Law Art. 8 and Art. 9). Data may be transferred to public institutions and judicial authorities authorised by law, upon their request, under our legal obligation (Art. 5/2-ç).

In Türkiye:

  • AWS Turkey Pazarlama Teknoloji ve Danışmanlık Hizmetleri Ltd. Şti. (Amazon Web Services), server in Istanbul: website server, database and CV files.

Abroad:

  • Cloudflare, Inc. (USA): secure and fast delivery of the website's traffic and bot verification on forms (Cloudflare Turnstile). For this purpose, your IP address, browser information and the information you enter in the forms pass through Cloudflare's infrastructure in encrypted form. Cloudflare also processes the technical signals it collects during bot verification under its own responsibility to improve this service.
  • Amazon Web Services, Frankfurt (Germany): encrypted database backups and server disk images.
  • When we reply to you by email, our correspondence is transmitted and stored via the server of our email infrastructure provider in Germany (Hetzner Online GmbH data centre).

The Personal Data Protection Board has not issued an adequacy decision for these countries. Transfers abroad fall under Art. 9 of the Law and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. As of today, these providers do not offer the standard contracts published by the Board. This section will be updated once a standard contract is signed and notified to the Authority.

6. How long we keep data

  • Contact form messages: deleted 2 years after they are sent.
  • Job applications and CV files: deleted 1 year after they are sent.
  • IP digest: can no longer be linked to anyone at the end of the day on which it is generated, because its key is deleted.
  • Server access logs: deleted after 90 days.
  • Backups: deleted records drop out of database backups within 30 days at the latest and out of server disk images within 7 days at the latest.
  • Records kept by Cloudflare: subject to the provider's own retention periods.

We carry out deletions automatically every day.

7. Your rights

Under Article 11 of the Law, you have the right to:

  • Learn whether your personal data is processed and, if so, request information about it.
  • Learn the purpose of processing and whether the data is used in line with that purpose.
  • Know the third parties in Türkiye and abroad to whom the data is transferred.
  • Request correction if the data is incomplete or inaccurate.
  • Request deletion or destruction of the data in accordance with the Law, and notification of these actions to the parties to whom the data was transferred.
  • Object to a result against you arising from analysis carried out exclusively by automated systems.
  • Request compensation for damage you suffer due to unlawful processing.

8. How to apply

You can submit your request in one of the following ways:

  • In writing to our head office address above.
  • From the email address you have previously given us and that is registered in our system, to info@peraist.com.tr.

Your request must state your name, surname, signature (for written requests), Turkish ID number (for foreigners, nationality and passport or ID number), address for notifications, email address if any, and your request (Communiqué on the Procedures and Principles of Application to the Data Controller).

We will conclude your request within 30 days at the latest and, as a rule, free of charge. If your request is rejected, if you find the response insufficient or if no response is given in time, you may file a complaint with the Personal Data Protection Board under Art. 14 of the Law.

Under the criteria set out in the Personal Data Protection Board's decision No. 2023/1154 of 06.07.2023 (fewer than 50 employees per year and an annual balance sheet total of less than 100 million Turkish lira), our company is exempt from the obligation to register with the Data Controllers' Registry (VERBİS). This exemption does not remove our other obligations under the Law.