本文件仅土耳其语和英语版本具有法律约束力；以下显示英文文本。
This notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ).
1. Data controller
MARFEN Mühendislik Tasarım ve Danışmanlık – Mahmut TARI Address: Şehitler Mah. 416. Sk. No: 2 İç Kapı No: 1, 41650 Gölcük / Kocaeli, Türkiye Email: info@marfen.com.tr · KEP (registered electronic mail): Mahmut.tari@hs01.kep.tr
2. Categories of personal data processed
| Category | Data |
|---|---|
| Identity | first and last name |
| Contact | email address |
| Customer transaction | sign-in provider user ID (Google/Facebook), plan and subscription information, model and job records, consent records, requests |
| Transaction security | IP address, browser information, server logs, encrypted Drive refresh token |
| Visual records | profile picture link |
| Other (content) | personal data that may be contained in IFC files (e.g. the names of the persons who prepared the model) |
No special categories of personal data are processed.
3. Purposes of processing
- Provision of the Service: account creation, sign-in, generation and delivery of drawings, Drive integration.
- Conduct of contract and subscription processes; quota and plan management.
- Conduct of information security processes; prevention of abuse.
- Fulfillment of legal obligations: statutory consent records, data subject requests, requests from competent authorities.
- Follow-up of requests and complaints; support.
4. Method of collection and legal bases
Personal data is collected electronically, by automated and partially automated means, from Google or Facebook during sign-in, from the application interface, from the files you upload, from payment notifications received from Paddle and from server logs. Legal bases:
- processing is directly related to the establishment or performance of a contract (Art. 5(2)(c)),
- processing is necessary for the data controller to fulfill its legal obligation (Art. 5(2)(ç)),
- processing is necessary for the establishment, exercise or protection of a right (Art. 5(2)(e)),
- processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5(2)(f)).
5. Transfers
Personal data may be transferred to the following groups of recipients, limited to the purposes set out above:
- Suppliers (abroad): hosting (Hetzner Online GmbH, Germany), payment (Paddle.com Market Limited, United Kingdom), sign-in and Drive (Google LLC, USA), Facebook sign-in (Meta Platforms Ireland Limited, Ireland), domain name service (Cloudflare, Inc., USA). Current list: Subprocessors.
- Authorized public institutions and organizations: upon request by authorities competent under the law.
Transfers abroad are carried out in accordance with KVKK Art. 9. For transfers to countries for which there is no adequacy decision, standard contractual clauses, one of the appropriate safeguards under Art. 9(4), are used and notified to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) within 5 business days after the contract is signed. For incidental transfers that are necessary for the use of the Service, reliance may be placed on Art. 9(6).
6. Your rights (KVKK Art. 11)
By applying to the data controller, you may exercise the following rights:
- to learn whether your personal data is processed and, if so, to request information about such processing,
- to learn the purpose of the processing and whether the data is used in accordance with that purpose,
- to know the third parties in Türkiye or abroad to whom the data is transferred,
- to request rectification if the data is incomplete or inaccurately processed,
- to request erasure or destruction of the data under the conditions set out in KVKK Art. 7,
- to request that rectification, erasure and destruction be notified to the third parties to whom the data has been transferred,
- to object to an outcome to your detriment arising from the analysis of the data exclusively by automated systems,
- to claim compensation for damages if you suffer damage due to unlawful processing.
7. Method of application
You may submit your applications in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ) through the following channels:
- the Data Subject Request form while signed in to the application,
- an email to info@marfen.com.tr sent from the email address registered in our system,
- an application bearing a secure electronic signature sent to our KEP address (Mahmut.tari@hs01.kep.tr),
- a written application bearing a wet-ink signature sent to the address above.
Applications are concluded free of charge within 30 days at the latest. If the action requires an additional cost, a fee may be charged according to the tariff determined by the Board.