Privacy notice — draft
How website, business-contact and authorised-support data are addressed in this draft.
#1. Identity and scope
Sigillum Teknoloji ve Danışmanlık Limited Şirketi (“Sigillum”) acts as controller for its website and corporate communications to the extent that it determines processing purposes and means. Contact: info@sigillum.cloud. The registered address must be completed during legal review.
Roles for transaction data in a bank’s own infrastructure depend on the actual activity. Supplying software alone does not automatically make Sigillum a processor or an independent controller. Authorised remote support and data access require their own factual and contractual assessment.
#2. Data, purposes and sources
| Activity | Potential data | Purpose and legal-basis assessment |
|---|---|---|
| Documentation visits | Server access records: IP address, time, request and device details | Service delivery and security; assess necessity and legitimate interests |
| Email enquiries | Name, work email, institution and message | Pre-contract enquiries, support or correspondence |
| Institutional contracts | Authorised contacts and billing details | Contract administration and applicable legal duties |
| Authorised support | Issue details and necessary technical samples | Institutional instructions and support/data-processing terms |
Data may come from direct correspondence, technical access or authorised institutional contacts. Actual hosting logs must be confirmed before publication. This website application contains no analytics tracker or transaction-data upload form.
#3. Legal bases and sensitive data
Identify a specific legal basis for each processing activity. Consent is not a universal basis for all processing. Assess the relevant conditions under Türkiye’s Personal Data Protection Law (KVKK) and, where applicable, GDPR, including additional requirements for special-category data. Public availability does not permit unrestricted reuse.
Avoid sending customer secrets, health or biometric data, account numbers or unnecessary personal information by email. Where sensitive data are necessary, assess current legal conditions and safeguards. KVKK text; special-category guidance.
#4. Recipients and international transfers
Authorised staff and contractually restricted providers may access information only for assigned purposes. Public-authority requests are assessed under applicable law. Actual hosting and email providers and their countries must be identified before publication.
An institution-hosted deployment does not establish the location of public website or email processing. International transfers require the applicable KVKK Article 9 mechanism and, where GDPR applies, Chapter V safeguards. Linking to standard clauses does not execute them. KVKK transfer documentation.
#5. Rights and requests
Depending on the applicable law and conditions, rights may include information, access, rectification, erasure, restriction, portability, objection, withdrawal of consent and remedies for unlawful processing. KVKK also addresses objections to adverse results arising solely from automated analysis.
Start an enquiry at info@sigillum.cloud. Identity and authority checks must be proportionate; ordinary email does not replace every formal request procedure. Requests concerning institutional transaction data should reach the relevant controller. KVKK requests are generally answered within 30 days; GDPR requests within one month, subject to permitted extensions and notice requirements. Rights to complain to the competent authority remain available. GDPR.
#6. Retention and updates
Set retention periods by category, purpose and legal duty. At expiry, apply appropriate deletion, destruction or anonymisation, subject to justified legal holds or disputes and restricted access. See Retention and incidents. Material changes should carry a date and version; later wording cannot retrospectively legitimise unrestricted processing.