Last updated: 10 September 2026
1. Who Is the Data Controller?
Under the Turkish Personal Data Protection Law no. 6698 (“KVKK”), the data controller is:
| Legal name | Tecmony Yazılım Bilişim ve Danışmanlık Hizmetleri Ltd. Şti. |
| Registered address | Fatih Sultan Mehmet Mahallesi, Balkan Caddesi No: 62/A, Ümraniye / Istanbul, Türkiye |
| Trade registry no | 236811-5 |
| Mersis no | 0833098641200001 |
| Telephone | +90 (216) 912 00 79 |
| Data protection contact | [email protected] |
2. What Does This Policy Cover?
This is Tecmony’s umbrella privacy policy. It covers visitors to our website, people who contact us, customer and supplier representatives, and job applicants.
What it does not cover: end-user data that our products process inside a corporate customer’s own infrastructure. For that data the customer organisation is the data controller and Tecmony acts as a data processor bound by contract. CallGem has its own, more detailed policy: callgem.tecmony.com/privacy.
Website-specific details — cookies, the contact form, session analytics — are in the Website Annex at the end of this document.
3. What We Process, Why, and On What Legal Basis
| Category | What is collected | Purpose | Legal basis (KVKK art. 5) | Retention |
|---|---|---|---|---|
| Contact form | Name, email address, subject, message | Responding to your enquiry | Legitimate interest — replying to your own request | 2 years after the correspondence closes |
| Form technical data | IP address, browser information, originating page and timestamp | Detecting abuse and spam; legal evidence | Legitimate interest and legal obligation | 2 years, together with the message |
| Customer / supplier contacts | Name, job title, business email and phone, correspondence | Contracts, quotations, support, invoicing | Performance of a contract and legal obligation | 10 years, as required by tax legislation |
| Job applicants | The information in your CV | Assessing your application | Explicit consent | 1 year from application; immediately if consent is withdrawn |
| Website analytics | Pages viewed, clicks and scrolling, device and browser, IP, country/city | Improving the usability of the site | Explicit consent (cookie banner) | 90 days (deleted automatically) |
| Server logs | IP address, timestamp, requested URL, browser information | Security, debugging, attack detection | Legitimate interest and legal obligation | 12 months maximum |
We do not process special categories of personal data. We neither request nor retain health data, biometric data, religious or political beliefs, trade union membership or similar data covered by Article 6 of the KVKK. Please do not send us such information.
4. Who We Share Data With
We do not sell or rent your personal data, and we do not transfer it to third parties for marketing. Data is shared only with the service providers below, and only to the extent the service requires:
- Our service providers — the firms behind our corporate email, site infrastructure and security services, only to the extent the service requires and in line with our instructions.
- Competent public authorities — where legally required, and only to the extent requested.
Contracts are in place committing these providers to process personal data only to the extent the service requires and in line with our instructions.
The choice is yours. Declining the cookie notice stops website analytics from running at all, and you are welcome to contact us by telephone rather than through the form.
Product data is outside this table. In our on-premise products, customer data remains on the customer’s own server and is not transferred to the providers listed above.
5. Security Measures
- Encryption in transit: our website and services are served exclusively over HTTPS (TLS 1.2 and above).
- Access control: access to systems is role-based, and multi-factor authentication is mandatory for administrator accounts.
- Audit trail: administrative access is logged.
- Bot and abuse protection: the contact form is protected by Cloudflare Turnstile.
- Data minimisation: form fields are masked in session analytics — the name, email address and message you type never appear in recordings.
- Patching discipline: server and application components are updated regularly.
Our quality and information security management systems are certified: ISO 9001:2015 Quality Management (certificate QMS-26.01.310) and ISO/IEC 27001:2022 Information Security Management (certificate ISMS-26.01.310). Both were issued by DSR Certification and are valid to 08.01.2027. Our ISO 42001:2024 AI Management System certificate (AIMS-26.08.206) was also issued by DSR Certification under TÜRKAK accreditation and is valid to 09.09.2027.
6. Use of Artificial Intelligence
No decision is made about you by artificial intelligence on this website. There is no profiling, automated assessment or system that sorts you into a category here.
Our products (such as CallGem Pro and DisasterCall) do use artificial intelligence. Three principles bind those systems:
- Decision support, not decision-making. An AI output carries no guarantee of accuracy; the final judgement belongs to a person.
- Human oversight is mandatory. These systems do not take critical decisions autonomously; low-confidence outputs are flagged and routed to human review.
- Transparency. Where a system uses artificial intelligence, the purpose and the limits of that use are disclosed to the parties concerned.
Data processed by the products falls outside this policy; there the customer organisation is the data controller. For CallGem, see callgem.tecmony.com/privacy.
7. Breach Notification
If we identify a personal data breach in systems under our control, or form a reasonable suspicion of one, we notify the Turkish Data Protection Authority within 72 hours and inform affected individuals as soon as reasonably possible. Where an incident occurs within a customer organisation’s own infrastructure, the notification duty rests with that organisation; Tecmony provides technical support on request.
8. Your Rights (KVKK Article 11)
In relation to your personal data, you have the right to:
- learn whether your personal data is being processed, and request information if it is
- learn the purpose of processing and whether the data is used in line with that purpose
- know the third parties to whom data is transferred, in Türkiye or abroad
- request correction of incomplete or inaccurate data
- request erasure or destruction once the grounds for processing no longer exist
- request that corrections and erasures be communicated to third parties who received the data
- object to a result reached solely through automated analysis that works against you — no such assessment is carried out on this site
- claim compensation for damage caused by unlawful processing
How to apply: send your request by email to [email protected], or in writing to our registered address. Please submit it in a way that allows us to verify your identity. Requests are concluded within 30 days at the latest and, as a rule, free of charge. If you find our response inadequate, you retain the right to complain to the Turkish Data Protection Authority.
9. Changes to This Policy
We may update this policy following changes in legislation or in our processing activities. The current version is always published on this page, dated at the top. We announce substantial changes separately on the site.
Annex: Website Privacy Notice
This annex details processing that takes place specifically through the tecmony.com domain.
A. Cookies
You will see a cookie consent notice on your first visit. Non-essential cookies do not run until you allow them. The categories we use:
| Category | What it does | Consent needed |
|---|---|---|
| Essential | Your language preference, your cookie choice, form security (Turnstile) | No — required for the site to work |
| Analytics | Understanding how pages are used (Microsoft Clarity) | Yes |
You can change your choice at any time through the settings link in the cookie notice, or clear cookies in your browser. There are no advertising cookies, tracking pixels or ad networks on this site.
B. Contact Form
When you submit the form, what you typed (name, email address, subject, message) is delivered to our corporate mailbox together with technical context — your IP address, browser information, the page you submitted from and the time of submission. We record the technical details so we can tell genuine enquiries apart from abuse and automated spam.
Form submissions are not stored in the website database; they are only delivered by email.
C. Bot Protection (Cloudflare Turnstile)
We protect the contact form against automated spam using Cloudflare Turnstile. To tell a person from a bot, Turnstile evaluates technical properties of your browser along with your IP address. You do not need to solve a puzzle or pick images. Turnstile does not use this assessment for advertising or profiling.
D. User Experience Analytics (Microsoft Clarity)
If you consent, we use Microsoft Clarity to understand how the site is used. The service processes the pages you visit, your click and scroll activity, browser and device information, approximate location at country or city level, and your IP address.
- Form fields are masked. Anything you type into a form — your name, email address, phone number — does not appear in recordings. Microsoft Clarity hides these fields by default and we have not changed that setting.
- Retention: session recordings are deleted automatically after 90 days.
- Processor: Microsoft Corporation — Microsoft Privacy Statement
- Opting out: decline the cookie notice, enable your browser’s Do Not Track setting, or block cookies.
- Users signed in as administrators are excluded from this analysis.
E. Server Logs
Our web server automatically records the IP address, timestamp, requested URL and browser information for every request. These logs exist to investigate security incidents and fix errors; they are not used for marketing.
F. External Links and Embedded Content
Our site links to our social media accounts and product pages. Once you follow such a link, the privacy policy of that platform applies; Tecmony is not responsible for the content or practices of those sites. Our homepage displays posts from our Instagram account; when that content loads, your browser connects to Instagram’s servers.
G. Children’s Data
Our services are aimed at corporate customers, not at children. We do not knowingly collect personal data from children.