Legal Notice

Personal Data Protection (KVKK) Disclosure Statement

Last updated: 3 July 2026

This Disclosure Statement on the Processing of Personal Data has been prepared, within the scope of the Law on the Protection of Personal Data No. 6698, regarding the processing of the personal data of persons who visit the STK360 website, use its contact forms, request information about services or products, or otherwise communicate with STK360.

1. Data Controller

Within the scope of the Law on the Protection of Personal Data No. 6698, your personal data is processed by the following company in its capacity as data controller:

Trade name: STK 360 Global Organizasyon Danışmanlık ve Yazılım Anonim Şirketi
Brand: STK360
Address: Muratpaşa Neighborhood, Yavuz Street No: 2, Interior Door No: 8, Bayrampaşa / İstanbul
Phone: +90 547 300 07 85
E-mail: bilgi@stk360.tr
Website: stk360.tr

In this statement, STK 360 Global Organizasyon Danışmanlık ve Yazılım Anonim Şirketi is referred to in short as “STK360” or the “Company.”

2. Scope of the Disclosure Statement

This Disclosure Statement covers:

persons who visit the stk360.tr website,
persons who use the contact and preliminary-inquiry forms,
persons who communicate with STK360 by phone, e-mail or other communication channels,
persons who request information about services, products, quotations, demos or partnerships,
persons who visit STK360’s blog, product, service and corporate pages.

Where necessary, separate disclosure statements specific to the relevant data processing activity may also be provided for employees, job candidates, customers, suppliers, business partners and product users.

3. Personal Data Processed

Depending on the nature of your communication with STK360, the form you use or the service you request, the following personal data may be processed.

3.1. Identity Information

First and last name
Signature
Information used to verify your identity depending on the nature of the application

3.2. Contact Information

Phone number
E-mail address
Correspondence or notification address
Preferred communication channel

3.3. Organizational and Professional Information

The name of the organization you work for or represent
Role or title information
Type of organization
Authorization and representation details
The organization’s field of activity

3.4. Request and Transaction Information

The service or product you are interested in
The explanations you share in the contact form
Demo, preliminary-inquiry, quotation or service requests
Meeting scheduling information
Complaints, suggestions and feedback
E-mail and correspondence content
Documents and attachments you send

3.5. Transaction Security and Website Usage Information

IP address
Date and time of access
Browser type and version
Device type
Operating system information
Pages visited
Referring web address
Server logs
Error and security logs
Identifiers obtained through cookies and similar technologies
Cookie preferences

3.6. Marketing and Communication Preferences

Commercial electronic message preferences
Explicit consent or refusal records
Cookie preference records
Permission, preference and subscription statuses

4. Special Categories of Personal Data

STK360 does not request the submission, through the general contact forms on the website, of health information, criminal conviction data, political opinion, philosophical belief, religion, sect, association/foundation/union membership, biometric data or similar special categories of personal data.

Unless it is necessary for the evaluation of your request, we kindly ask you not to write your special categories of personal data into contact forms or e-mails, and not to send such documents.

Where there is a separate service, project or process in which processing special categories of personal data is mandatory, the relevant person is separately informed of that specific processing activity, and the conditions stipulated in the applicable legislation are applied.

5. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

Receiving and responding to communication and information requests
Scheduling preliminary meetings, demos or meetings
Evaluating service or product requests
Carrying out a preliminary analysis of your organization’s needs
Providing information about services, products and solutions
Preparing and delivering quotations
Carrying out pre-contractual processes
Managing service processes in the event a contract is established
Managing customer, business-partner and stakeholder relationships
Evaluating requests, complaints, suggestions and feedback
Ensuring the secure and proper operation of the website
Carrying out information-security processes
Preventing risks of unauthorized access, misuse and fraud
Keeping system, error and security logs
Fulfilling legal, administrative and financial obligations
Meeting the lawful requests of authorized public institutions and organizations
Establishing, exercising or protecting rights in legal disputes
Where explicit consent is given, carrying out commercial electronic messaging, marketing, campaign, announcement and information activities
Where explicit consent is given, carrying out analytics, performance and user-experience measurement activities

6. Legal Grounds for Processing Personal Data

Depending on the nature of the transaction, your personal data is processed on the basis of the following legal grounds set out in Article 5 and, to the extent applicable, Article 6 of Law No. 6698.

6.1. Establishment or Performance of a Contract

Personal data necessary for evaluating your service, product, demo, quotation or preliminary-inquiry requests; for carrying out pre-contractual processes; and, where a contract is established, for performing the service, may be processed on this legal ground.

6.2. Fulfillment of a Legal Obligation

Your personal data may be processed within the scope of record-keeping, retention, notification, information-provision and authority-request obligations arising from legislation.

6.3. Establishment, Exercise or Protection of a Right

Request, complaint, contract, correspondence, payment, quotation and dispute records may be processed and retained for the purpose of establishing, exercising or protecting legal rights.

6.4. Legitimate Interest

Provided that no harm is caused to your fundamental rights and freedoms, your personal data may be processed for the purposes of ensuring website security, managing communication processes, preventing misuse, improving service quality and running corporate activities in an orderly manner.

Processing that requires explicit consent — such as non-mandatory analytics, functional and marketing cookies; sending commercial electronic messages; and campaigns, announcements or similar marketing activities — is carried out only if you are separately informed and give your explicit consent.

Providing the disclosure and obtaining explicit consent are separate processes. In cases requiring explicit consent, the explicit-consent statement is presented separately from this Disclosure Statement.

7. Methods of Collecting Personal Data

Your personal data may be collected by fully or partially automated means, or by non-automated means provided it forms part of a data recording system. The main collection methods are:

Website contact and application forms
Demo, preliminary-inquiry and quotation request forms
Cookies, server logs and similar technologies
Phone calls
E-mail correspondence
Online or face-to-face meetings
Messaging and corporate communication channels
Documents you send
Pre-contractual discussions
Service or product usage processes
Information lawfully transmitted by authorized persons, institutions or organizations

8. Transfer of Personal Data

Your personal data may be transferred, limited to and proportionate with the processing purpose, to the following groups of recipients:

Authorized public institutions and organizations
Courts, enforcement offices and other judicial or administrative authorities
Persons or organizations from which legal, financial-advisory, audit and consultancy services are obtained
Website hosting and technical infrastructure providers
E-mail, communication, information-security and backup service providers
Software, form, CRM, analytics and business-process service providers
Suppliers and business partners necessary for carrying out the service
Where explicit consent is given, marketing, analytics and advertising-technology service providers

Your personal data is transferred only to the extent necessary for providing the relevant service, operating the technical infrastructure, fulfilling legal obligations, ensuring security or protecting rights.

9. Transfer Abroad

Your personal data may be transferred to hosting, e-mail, cloud, analytics, communication, software or technology service providers located abroad.

In such cases, the transfer is carried out by satisfying one of the conditions set out in Article 9 of Law No. 6698. Depending on the applicable situation, an adequacy decision, appropriate safeguards, standard contract, binding corporate rules or other lawful transfer mechanisms provided for in the Law may be used.

Where there is a transfer abroad that must rely on explicit consent, the explicit consent is obtained separately from this Disclosure Statement.

10. Retention Period of Personal Data

Your personal data is retained:

for the period necessary for the purpose of processing,
for the retention periods stipulated in the relevant legislation,
for the statute-of-limitation periods relating to contracts and legal disputes,
to the extent necessary to meet the lawful requests of authorized institutions,
in consent-based processing, until the explicit consent is withdrawn or the processing purpose ends.

When the processing purpose and the legal retention obligation end, your personal data is deleted, destroyed or anonymized in accordance with the relevant legislation and the Company’s retention-and-destruction practices.

Communication, quotation and preliminary-inquiry records that do not turn into a contract are deleted or anonymized at the end of the reasonable period necessary for managing any future requests and disputes.

11. Rights of the Data Subject

Within the scope of Article 11 of Law No. 6698, by applying to STK360 you have the following rights:

to learn whether your personal data is being processed,
to request information if your personal data has been processed,
to learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
to know the third parties, domestically or abroad, to whom your personal data is transferred,
to request the correction of your personal data that is incomplete or inaccurately processed,
to request the deletion or destruction of your personal data where the conditions set out in the Law are met,
to request that correction, deletion or destruction operations be notified to third parties to whom the personal data has been transferred,
to object to a result to your detriment arising solely from the analysis of the processed data through automated systems,
to request the compensation of damages in the event you suffer damage due to the unlawful processing of your personal data.

12. Application Method

You can submit your requests regarding your personal data to STK360 by one of the following methods.

Written application

You can send your application, together with information and documents suitable for verifying your identity, to the following address:

STK 360 Global Organizasyon Danışmanlık ve Yazılım Anonim Şirketi — Muratpaşa Neighborhood, Yavuz Street No: 2, Interior Door No: 8, Bayrampaşa / İstanbul

It is recommended to write “Personal Data Protection Application” on the envelope or the application document.

Application by e-mail

You can send your application to bilgi@stk360.tr from your e-mail address registered in the Company’s systems, or together with information and documents suitable for verifying your identity.

Your application must include the following information:

First and last name,
Signature in written applications,
The information necessary to verify your identity,
Address or contact details for notification,
The subject of the request,
Supporting documents, if any.

Applications are concluded as soon as possible depending on the nature of the request, and at the latest within 30 days. Where the transaction additionally requires a cost, the fee in the tariff set by the Personal Data Protection Board may be applied.

13. Updates to the Statement

This Disclosure Statement may be updated in the event of changes in legislation, data-processing activities, the technical systems used, or service processes. The current version is published on the stk360.tr website.