1. Scope
This notice has been prepared to provide information about the processing of personal data belonging to natural persons who visit the Finovus Partners website, send an email through a link on the website, or submit an application to exercise their rights under Law No. 6698 on the Protection of Personal Data ("KVKK").
Other processing activities concerning clients, employees, job applicants, suppliers and contracting parties may be covered by separate disclosure notices specific to the relevant activity.
2. Data controller
The data controller under the KVKK is:
Finovus Partners Danışmanlık Limited Şirketi ("Finovus Partners" or the "Company")
Address: Çınarlı Mahallesi, Ozan Abay Caddesi, Ege Perla No: 8, İç Kapı No: Z17, Konak/İzmir
Email: info@finovuspartners.com
3. Personal data processed, purposes and legal grounds
3.1. Website access and security logs
When the website is accessed, the hosting infrastructure may process the IP address, access date and time, requested page or file, HTTP response information and, depending on the server configuration, limited browser, operating-system and referring-page information in standard access and security logs.
These data are processed for the purposes of:
- providing the website securely and without interruption,
- identifying technical errors and performance problems,
- preventing or investigating unauthorised access and security incidents.
Processing is based on the condition in Article 5(2)(f) of the KVKK that processing is necessary for the legitimate interests pursued by the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.
If a security incident or dispute arises, the relevant records may also be processed under Article 5(2)(e) of the KVKK, where processing is necessary for the establishment, exercise or protection of a right. Where lawful requests from competent authorities must be fulfilled, processing is based on Article 5(2)(ç) of the KVKK, concerning compliance with a legal obligation to which the data controller is subject.
The data are obtained electronically and by automated means through the technical access request sent to the website.
3.2. Contact emails
The website does not use a contact form that sends data to the Company’s server. The contact area creates a mailto link that opens the email application on the user’s device. The Company obtains contact data only if the user sends the prepared email.
Depending on the content of the email, the user’s name and surname, email address, subject, message content, attachments and any other information voluntarily shared by the user may be processed.
These data are processed in a manner connected with, limited to and proportionate to the relevant purpose on the basis of:
- legitimate interests under Article 5(2)(f) of the KVKK, to evaluate and respond to general information and contact requests,
- Article 5(2)(c) of the KVKK, where processing is directly related to the establishment or performance of a contract in connection with a service request or pre-contractual discussion,
- Article 5(2)(e) of the KVKK, where processing is necessary for the establishment, exercise or protection of a right in the event of a dispute or legal claim,
- Article 5(2)(ç) of the KVKK, where a legal obligation requires a response or the keeping of records.
The data are obtained electronically and by automated means through the email service selected by the user and, where necessary, by non-automated means while the email is evaluated within the Company.
Users are requested not to attach identity documents, financial documents or special categories of personal data that are not necessary for the communication. Special categories of personal data sent voluntarily by the user are processed only if an appropriate processing condition under Article 6 of the KVKK applies; data for which no appropriate processing condition exists are erased or destroyed in accordance with applicable law.
3.3. Technical preferences stored on the device
The website may store limited technical preference values in the user’s browser localStorage and sessionStorage to remember the selected language and to avoid unnecessarily replaying the opening animation during navigation within the website.
These values are not used for advertising, marketing, user profiling or cross-site tracking; they are not sent to the Company’s server, combined with server access logs or transferred to third parties. Further information is available in the Cookie and Device Storage Policy.
3.4. Applications under the KVKK
During an application under the KVKK, the applicant’s name and surname, signature, limited information for identity verification, contact details, the subject of the request and supporting documents may be processed.
These data are processed to verify the applicant’s identity, evaluate and respond to the request and keep a record of the application process, based on compliance with a legal obligation under Article 5(2)(ç) of the KVKK and, where necessary, the establishment, exercise or protection of a right under Article 5(2)(e). Information or documents disproportionate to the nature of the request are not sought for identity verification.
4. Transfer of personal data
Personal data may be transferred, in accordance with Article 8 of the KVKK and limited to the relevant purpose, to:
- domestic hosting, email and authorised information-technology service providers engaged to provide website hosting, corporate email, backup and information-security services,
- authorised lawyers and legal advisers where necessary to evaluate a legal claim or protect rights,
- competent public institutions, administrative authorities and judicial bodies in order to comply with legal obligations or respond to a lawful request.
Personal data are not sold, rented or shared with marketing platforms for advertising purposes.
As of the effective date, the website and corporate email servers are hosted in Türkiye. Font and software files used by the website are served from the Company’s hosting environment; no direct request is made to Google Fonts, unpkg or a similar overseas content-delivery network. No third-party analytics, advertising or marketing tracking tool is used on the website.
If the user employs an email service hosted abroad or asks for a reply to be sent to such an address, the email content may reach the overseas infrastructure of the service provider selected by the user. Where the Company must reply through that channel, the transfer is limited to the data necessary to answer the user’s request and an applicable condition under Article 9 of the KVKK is satisfied. If no appropriate transfer condition is available, that channel is not used and, where possible, a domestic alternative communication method is offered.
If a service requiring regular international data transfers is used in the future, an appropriate safeguard or other transfer mechanism provided for in Article 9 of the KVKK will be established before the transfer begins, and this notice will be updated.
5. Retention and disposal
Personal data are retained only for the period necessary for the relevant processing purpose or the period prescribed by law.
- General communication records are retained only for the time required to conclude the request and complete a reasonable follow-up process.
- Records connected with a contract, legal claim or dispute may be retained for the applicable statutory retention and limitation periods.
- Server access and security logs are retained only for the period required by information-security needs and the legislation applicable to the hosting service.
- KVKK application records are retained for the period necessary to respond to the application and demonstrate that the Company has complied with its legal obligations.
When all processing conditions cease to exist, the data are erased, destroyed or anonymised in accordance with Article 7 of the KVKK and the relevant secondary legislation.
6. Data security
The Company takes technical and organisational measures appropriate to the nature of the processing activity in order to prevent unlawful processing of and access to personal data and to ensure that the data are securely retained. Service providers processing personal data on behalf of the Company are also required to implement appropriate security measures.
7. Rights of the data subject
Under Article 11 of the KVKK, data subjects have the right:
- to learn whether their personal data are processed,
- to request information if their personal data have been processed,
- to learn the purpose of processing and whether the data are used in accordance with that purpose,
- to know the third parties to whom personal data are transferred in Türkiye or abroad,
- to request rectification of incomplete or inaccurate data,
- to request erasure or destruction under the conditions set out in Article 7 of the KVKK,
- to request notification of rectification, erasure or destruction to third parties to whom the data have been transferred,
- to object to an adverse result arising from analysis of the processed data solely through automated systems,
- to claim compensation for damage arising from unlawful processing.
8. Application to the data controller
Requests under the KVKK may be submitted:
- by hand or post, as a wet-signed application, to Çınarlı Mahallesi, Ozan Abay Caddesi, Ege Perla No: 8, İç Kapı No: Z17, Konak/İzmir,
- to info@finovuspartners.com using a secure electronic signature or mobile signature,
- to info@finovuspartners.com from an email address previously notified to the Company by the applicant and recorded in the Company’s systems.
The application must include the applicant’s name and surname; signature for written applications; Turkish identity number for citizens of the Republic of Türkiye; nationality, passport number or identity number, if any, for foreign nationals; address for service; email address for notification, if any; telephone or fax number; and the subject of the request. Information and documents concerning the request may be attached.
Using the description "KVKK Data Subject Application" facilitates the evaluation process. The Company concludes applications as soon as possible according to the nature of the request and no later than thirty days. If the procedure requires an additional cost, the fee specified in the tariff determined by the Personal Data Protection Board may be charged.
9. Updates
This notice may be updated in line with changes in processing activities or applicable legislation. If a new processing purpose arises, data subjects will be informed separately before personal data begin to be processed for that purpose. The current version and effective date are published on this page.