Privacy and information notice
In plain language, we explain which of your data we process and why, how long we keep it, and what your rights are under KVKK (Law No. 6698 on the Protection of Personal Data).
Last updated Version 1.0Draft, awaiting legal review
This translation is provided for convenience; the Turkish version prevails.
In short
- We don’t sell
- We do not sell or rent your personal data to anyone, and we do not share it for advertising.
- No marketing email
- We only write to you about what you asked for. You receive the newsletter only if you subscribe.
- No tracking cookies
- We do not use advertising or third-party analytics cookies on this site.
- Test data deleted after 30 days
- Data accessed during client tests is deleted 30 days after the project is closed, and a deletion record is shared.
The full text below is binding. This summary is only meant to make reading easier.
On this page
Data controller
Your personal data is processed by Noroxi Bilgi Güvenliği Danışmanlık A.Ş. (“Noroxi”) in its capacity as data controller.
Data we process
We process only the data you give us or data that is strictly necessary for the service to work.
We do not ask for special categories of personal data (such as health or biometric data). Please do not share this kind of information in forms.
Purposes and legal grounds
We process your data on the following legal grounds set out in Article 5 of KVKK:
If we ever need to process data for any other purpose, for example marketing, we will do so only with your explicit consent, and you can withdraw your consent at any time.
Data accessed during testing
During a penetration test or red team engagement, we may access personal data in our client’s systems. In that case, our client is the data controller; Noroxi acts as a data processor and only on the instructions set out in the contract.
- A non-disclosure agreement and a data processing addendum are signed before the work begins.
- Only the minimum data needed to demonstrate a finding is taken as evidence; personal data is masked in the report.
- Reports are delivered over an encrypted channel.
- Test data is deleted 30 days after the project is closed, and a deletion record is shared.
Transfers
We share your data with the following recipients only to the extent necessary to provide the service:
- Service providers: companies that provide us with hosting, email and accounting services. These companies process your data only on our instructions.
- Competent authorities: where there is a legal obligation or a court order, and only to the extent requested.
If a service provider’s servers are located outside Türkiye, the transfer is made only with the safeguards provided for in Article 9 of KVKK, for example the standard contract published by the Personal Data Protection Board (KVKK Board). You can request the current list of service providers at kvkk@noroxi.com.
Retention periods
When the retention period expires, the data is deleted, destroyed or anonymized.
Security measures
Security is our business; we apply to our own systems the same standards we recommend to our clients.
- All traffic is encrypted with TLS; forms are submitted only over HTTPS.
- Only employees who need access for their work can access data, and only with two-factor authentication.
- Access is logged and reviewed regularly.
- We have our own systems tested by an independent team at least once a year.
If you have found a vulnerability in our systems, please report it in line with our responsible disclosure policy.
Your rights and how to apply
Under Article 11 of KVKK, you have the right to:
- learn whether your data is processed and, if so, request information about it;
- learn the purpose of the processing and whether the data is used in line with that purpose;
- know the third parties, in Türkiye or abroad, to whom your data has been transferred;
- request rectification if your data has been processed incompletely or inaccurately;
- request erasure or destruction of your data, and request that these actions be notified to the parties to whom the data has been transferred;
- object to an outcome against you that results from analysis of your data exclusively by automated systems;
- claim compensation if you suffer damage because of unlawful processing.
How to apply
You can send your request to kvkk@noroxi.com, via KEP to noroxi@hs01.kep.tr, or in writing to the address above. So that we can verify your identity, please state your first and last name and describe your request clearly.
We will respond to your request free of charge within 30 days at the latest. If you are not satisfied with our response, you may file a complaint with the Personal Data Protection Board (KVKK Board).
Changes
When we change this notice, we update the version number and date. If you have an account, we will also notify you of material changes by email.