Privacy Notice

This notice is prepared under Article 10 of Turkish Law 6698 on the Protection of Personal Data. Devana Teknoloji Proje ve Yönetim Danışmanlığı Ticaret Limited Şirketi ("Devana") acts as data controller. Address: Ziya Gökalp Mah. Süleyman Demirel Bulvarı, Mall of İstanbul The Office No: 7E, Floor 17, Unit 136, 34490 Başakşehir / İstanbul, Türkiye.

Data processed

Purposes

• Delivering consulting services and performing the contract
• Filing incentive, grant and support applications with the relevant institutions
• Running project tracking and document exchange through the client portal
• Answering information requests and contact form submissions
• Invoicing, accounting and statutory retention duties
• Maintaining information security and preventing unauthorised access

Legal grounds

Under Article 5 of the Law: necessity for the conclusion and performance of a contract, compliance with a legal obligation of the controller, establishment and protection of a right, legitimate interest, and explicit consent where required.

Recipients

Personal data may be shared, limited to the stated purposes, with:

• Public institutions receiving the application
• Financial advisors, independent auditors and legal counsel
• Hosting, email and software service providers
• Competent public authorities where legally requested

Where a transfer abroad is necessary, the conditions in Article 9 of the Law apply.

Retention

Data is kept for as long as the processing purpose requires and for the limitation periods set out in the applicable legislation. Once the period ends, data is deleted, destroyed or anonymised.

Your rights

Under Article 11 of the Law you may request to:

• Learn whether your personal data is processed
• Obtain information about processing, if it has taken place
• Learn the purpose of processing and whether it is used accordingly
• Know the third parties to whom data is transferred, in Türkiye or abroad
• Have incomplete or inaccurate data corrected
• Request erasure or destruction
• Have correction, erasure and destruction notified to third parties the data was transferred to
• Object to an adverse outcome produced solely by automated analysis
• Claim compensation for damage caused by unlawful processing

Making a request

Requests can be submitted in writing or by the other methods set out by the Personal Data Protection Board. Include information that verifies your identity and a clear statement of the request. Requests are concluded within thirty days at the latest.

Contact details are on the Contact page.