Tuna Industrial Platform™This is a draft. It requires review by a KVKK-competent legal advisor before publication. Placeholder fields (PENDING) are not yet filled in.
Privacy Policy
1. Who and what this policy covers
This Privacy Policy covers the websites listed above operated by Tuna Project Global Ticaret Anonim Şirketi ("Tuna Project", "we"), the contact and demo-request forms on them, lead processes, and the technical operation of the site. Data processed under a pilot/customer contract is governed by separate agreements; this policy does not replace them. Controller: Tuna Project Global Ticaret A.Ş. (see COMPANY_FACT_SHEET.md). Tuna Project LLC (US) is not a controller in this context (DEC-002).
2. Categories of data we process
Identity and contact data (name, e-mail, phone, company, title/role); request content (area of interest, sector/factory information, free-text message); commercial-evaluation data (lead notes, interaction history, request status); technical/security data (IP address, browser and device information, logs, timestamps, anti-abuse signals); cookie/measurement data (site-usage data, session identifiers, Google Analytics 4 data — subject to your cookie consent). Web forms are not designed to collect clinical or special-category data; please do not enter excessive or sensitive information in free-text fields.
3. Purposes and legal bases
| Purpose | KVKK Art. 5 | GDPR Art. 6 |
|---|---|---|
| Responding to requests, scheduling demos, preparing proposals/pilots | 5/2-(c) and/or 5/2-(f) | 6(1)(b) pre-contractual steps and/or 6(1)(f) legitimate interests |
| Lead follow-up, commercial-communication management | 5/2-(f) | 6(1)(f) legitimate interests |
| Site and infrastructure security, logging | 5/2-(f), where applicable 5/2-(ç) | 6(1)(f) and/or 6(1)(c) |
| Analytics / measurement cookies | 5/1 explicit consent | 6(1)(a) consent |
| Marketing electronic messages | 5/1 explicit consent (+ İYS) | 6(1)(a) consent |
| Legal obligations | 5/2-(ç) | 6(1)(c) |
Where we rely on legitimate interests, we will provide the balancing test on request.
4. Cookies
The site uses strictly necessary cookies and — subject to your consent — analytics cookies (Google Analytics 4). See the Cookie Policy for the cookie list and preference management. Non-essential cookies run only if you consent via the cookie banner; you can withdraw consent at any time.
5. Sharing and recipients
We do not sell your data. We share it only as necessary with: hosting/infrastructure/e-mail providers ([PROVIDER(S) — PENDING]); Google (Google Analytics 4) — only with analytics-cookie consent; an internal tracking/CRM tool ([TOOL — PENDING]); legal, accounting and audit advisers as needed; and competent public authorities upon a lawful request. We aim to put a data processing agreement (DPA) in place with each provider.
6. International transfers
Some providers (particularly analytics and cloud infrastructure) may process data outside Türkiye and/or the EEA. KVKK: transfers are made in accordance with Art. 9 (explicit consent or prescribed safeguards). GDPR: transfers outside the EEA rely on Chapter V mechanisms (e.g. the European Commission's Standard Contractual Clauses, or an adequacy decision). The definitive transfer inventory and mechanism will be completed during legal review.
7. Retention
Your data is retained for as long as necessary for the processing purpose and the applicable limitation periods, then deleted, destroyed or anonymised. Draft per-category periods are in KVKK Notice §6; the definitive schedule will be set during legal review.
8. Your rights
Your KVKK Art. 11 rights are listed in KVKK Notice §7. Your GDPR rights (to the extent applicable): access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21 — including to processing based on legitimate interests and to direct marketing), and withdrawal of consent for consent-based processing (Art. 7(3)). No automated individual decision-making / profiling (Art. 22) takes place. Requests: office@tunaproject.com.
9. Lodging a complaint
Türkiye: the Personal Data Protection Authority (KVKK) — kvkk.gov.tr. EEA: you may complain to the data protection authority of your member state. GDPR Art. 27 EU representative: not appointed; the obligation to appoint one will be assessed by counsel if regular monitoring of, or regular offering of goods/services to, individuals in the EEA occurs. Data Protection Officer (DPO): not appointed; GDPR Art. 37 / KVKK requirements will be assessed by counsel.
10. Children's data
The site and the Tuna Industrial Platform are business-to-business and are not directed at children. We do not knowingly collect children's data.
11. Security
We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss and misuse. For the product's security architecture see the Security Statement. No method of transmission or storage is 100% secure.
12. Changes
We may update this policy; the current version is always published on this page with its effective date. We will announce material changes appropriately.
13. Contact
Privacy questions: office@tunaproject.com · Tuna Project Global Ticaret A.Ş., Fuat Edip Baksı Mah. Anadolu Cad. No: 175/1 D: 13, Bayraklı / İzmir 35540, Türkiye.