0 850 308 82 26 Blog Contact 1$
1$ Client Area Sign Up
language-tr Turkish
language-tr
menu-open
Privacy Policy and Personal Data

This page presents the “Privacy Policy and KVKK Information Notice” in a structured format for all online/offline processes carried out on www.sunucun.com.tr involving personal data processing activities.

  1. DATA CONTROLLER AND SCOPE

    1. Data Controller: Sunucun Bilgi İletişim Teknolojileri ve Tic. Ltd. Şti. (“Sunucun”)
    2. Contact and Registration Details:
      Address: MASLAK MAH. AOS 55. SK. 42 MASLAK B BLOK NO: 4 İÇ KAPI NO: 542 SARIYER/İSTANBUL
      Postal Code: 34396 • MERSİS: 0784072978100001 • VERBİS: 460507-5
      Phone: +90 (850) 308 82 26 • E-mail: info@sunucun.com.tr • KEP: sunucun@hs01.kep.tr
    3. This Notice covers the personal data processing activities conducted by Sunucun across all processes, including the www.sunucun.com.tr domain and subdomains, the customer panel, payment/support channels, and services such as web hosting, virtual server (VDS), dedicated server, and e-mail (mail).

  2. DEFINITIONS

    • KVKK: Law No. 6698 on the Protection of Personal Data.
    • Data Subject: The natural person whose personal data are processed (customer, prospective customer, visitor, etc.).
    • Data Controller: The natural/legal person who determines the purposes and means of processing personal data (Sunucun).
    • Data Processor: Service providers that process data on behalf of the data controller (e.g., data center operators, payment institutions, e-mail services).
    • Cookie: Identification files placed on the browser by visited websites.
    • Traffic Data: IP address, connection date/time, service used, port information, etc.

  3. CATEGORIES OF PERSONAL DATA PROCESSED

    • Identity: Full name, national ID/nationality/passport (where required), invoice title, year of birth.
    • Contact: E-mail, mobile/landline number, address, billing/shipping address.
    • Customer Transaction: Order/subscription records, ticket/support records, contracts, undertakings, subscription changes.
    • Finance/Voucher Information: Invoice, payment receipt, IBAN, collection information (payment card data are not stored in Sunucun systems; they are processed by the payment institution).
    • Transaction Security: System/application logs, IP/MAC, port, login/logout, error logs, security incidents.
    • Location/Online Identifier: Approximate IP-based location, user/browser agent, cookie identifiers.
    • Network and Server Usage: Allocated IP blocks, DNS records, e-mail send/receive logs, resource usage statistics (CPU/RAM/Disk), backup statuses.
    • Marketing Preferences: Preferences for commercial electronic communications, subscription/opt-in/opt-out records.
    • Legal Transaction/Reputation: Complaint/objection records, processing of legal request/notification information.

    Note: With respect to its own customer data, Sunucun acts as the data controller; with respect to data relating to customers’ end-users, Sunucun acts, in most scenarios, as a data processor. This distinction is additionally regulated in the agreements.

  4. PURPOSES OF PROCESSING AND LEGAL GROUNDS

    Special Categories of Personal Data: As a rule, Sunucun does not process special categories of personal data. Except in mandatory cases (e.g., requests from judicial authorities), such data are not requested.

  5. METHODS OF COLLECTION

    • Online forms (website, customer panel, live support, ticketing system),
    • Contracts/offer processes, e-mail/telephone correspondence,
    • System, network and application logs; security/access records,
    • Collection/payment verification information received from payment institutions and banks,
    • Process and verification flows received from domain and certificate providers,
    • Cookies and similar technologies (see Cookie Policy Summary).

    Legal grounds are determined within the framework of being stipulated by law, contract, legal obligation, legitimate interest, or explicit consent.

  6. TRANSFERS (DOMESTIC / INTERNATIONAL)

    1. Domestic Recipients: Certified public accountant/independent audit, banks/payment institutions, legal/audit consultants, domestic data center/infrastructure providers, cargo/courier, SMS/e-mail services, İYS integrations, public authorities/courts.
    2. International Recipients: Global data center/infrastructure providers, CDN, DNS/e-mail security services, domain registration/certificate (CA) authorities, cloud software vendors.
    3. Cross-Border Transfers: Transfers are carried out under an adequacy decision, standard contractual clauses, binding corporate rules, or the statutory exceptions. The transfer mechanism used, recipient/country, data category, and retention period are shown in the Personal Data Inventory and Sub-Processor List (published in the panel). Explicit consent is not the primary method for transfers; it is relied upon only in exceptional cases where appropriate safeguards are not available.

  7. COOKIE POLICY SUMMARY

    • Strictly Necessary Cookies: Session, load balancing, fraud prevention.
    • Functional Cookies: Language preference, panel/view settings.
    • Performance/Analytics Cookies: Usage statistics, debugging.
    • Advertising/Targeting Cookies: Remarketing (operate with explicit consent).

    You may manage cookies via your browser settings and provide consent/opt-out through the Cookie Preferences module in the panel. Non-essential cookies are not activated without consent.

  8. RETENTION PERIODS AND DISPOSAL

    Sunucun retains personal data for as long as necessary for the purpose and within the minimum/maximum periods prescribed by applicable legislation. Upon expiry, data are deleted, destroyed, or anonymized. Example periods:

    Periodic Disposal: Disposal procedures are carried out at least every 6 months. Data that are not practically necessary or not legally required to be retained are subject to disposal.

  9. SECURITY MEASURES (TECHNICAL/ADMINISTRATIVE)

    • Network segmentation, least-privilege principle (RBAC), password policy and MFA,
    • Up-to-date TLS/SSL, key/certificate management, secure encryption for data at rest/in transit,
    • Firewall, WAF, IDS/IPS, DDoS protection, anti-malware, e-mail security (SPF/DKIM/DMARC),
    • Security event and log management (timestamping, integrity verification),
    • Secure software development and vulnerability management (SAST/DAST, CVE monitoring),
    • Supplier/sub-processor agreements, confidentiality undertakings and access restrictions,
    • Staff training on KVKK/cybersecurity, authorization matrix and offboarding procedures,
    • Physical security and environmental monitoring (DC access control, CCTV – subject to DC policies),
    • Backup and business continuity/disaster recovery plans, regular testing.

  10. RIGHTS OF THE DATA SUBJECT

    The data subject has the rights under Article 11 of the KVKK: to learn whether personal data are processed; to request information; to learn the purpose of processing and whether data are used in accordance with that purpose; to know the third parties to whom the data are transferred domestically/abroad; to request rectification/deletion/destruction/anonymization; to object; and to claim compensation in case of damage. Applications must be submitted in accordance with the KVKK Communiqué on Application Procedures and Principles.

  11. APPLICATION METHODS AND TIME LIMITS

    1. Application Channels:
      • Written application: MASLAK MAH. AOS 55. SK. 42 MASLAK B BLOK NO: 4 İÇ KAPI NO: 542 SARIYER/İSTANBUL (wet-ink signature),
      • KEP: sunucun@hs01.kep.tr,
      • Secure e-signature/mobile signature,
      • E-mail from your previously notified and system-registered e-mail address to info@sunucun.com.tr.
    2. Assessment: Requests are finalized free of charge within 30 days at the latest; written responses are free of charge up to 10 pages, with any excess subject to the tariff in the relevant Communiqué. Applications must include full name, signature, national ID/nationality, address for notification, a description of the request, and any supporting documents, if any.

  12. AUTOMATED DECISION-MAKING / PROFILING

    Sunucun may apply basic scoring limited to legitimate interests such as fraud detection, security, and spam/abuse prevention. Fully automated decision-making processes that produce legal effects or significantly affect the individual are not used.

  13. SUB-PROCESSORS AND THIRD PARTIES

    The current list of sub-processors (data center/infrastructure, payment, domain, SSL, e-mail/SMS, call center, CDN, DDoS, etc.) is published in the customer panel. When a new sub-processor is added, prior notice is given within a reasonable period.

  14. UPDATES TO THIS POLICY

    This Notice may be updated in the event of legislative or service changes or security requirements. The current version is always published on the website.

  15. CONTACT

    For all questions regarding KVKK and privacy, you may write to info@sunucun.com.tr.

Publication Date: • Last Update: