Additional Information for Users Covered by the GDPR

Effective: (date of publication)

1. Who this text applies to

• Under Article 3(2) of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the GDPR also applies to processing by a controller not established in the Union where the processing relates to offering goods or services to data subjects in the Union.
• Because Ufkon lets companies established in an EU or EEA country join as installers (EPC), suppliers or engineering firms, Ufkon accepts that the GDPR may apply to the employees and representatives of those companies who are in the EU/EEA, and prepares this text for them.
• The core information on how your personal data is processed (data processed, purposes, recipients, retention periods) is in the KVKK Privacy Notice. This text only gives the additional information the GDPR requires.

2. Controller and EU representative

• Article 27 GDPR provides that a controller covered by Article 3(2) designates in writing a representative in the Union; Article 27(2) exempts certain processing. If a representative is designated, their identity and contact details will be published in this section.

3. Legal bases (Article 6(1) GDPR)

• You may withdraw your consent at any time (Article 7(3)); withdrawal does not affect the lawfulness of processing before it. You can manage your marketing consent on the Privacy and my data page of your panel.

4. Your rights (Articles 15 to 22 GDPR)

• Access (Article 15): to learn whether your data is processed and to get a copy.
• Rectification (Article 16): to have inaccurate or incomplete data corrected.
• Erasure (Article 17): to have your data erased where the conditions are met.
• Restriction of processing (Article 18): for example, while you contest the accuracy of your data, to have processing restricted. Once your request is verified, processing for marketing stops immediately: your marketing consents are recorded as withdrawn and no new consent is taken while the restriction applies. Our team decides the further scope of the restriction, meaning which data is held back from which processing, case by case for your request and tells you in writing. You will be informed before a restriction is lifted.
• Data portability (Article 20): to receive the data you provided to us, processed by automated means on the basis of consent or a contract, in a structured, commonly used and machine-readable format. Ufkon provides this data as JSON.
• Objection (Article 21): to object, on grounds relating to your particular situation, to processing based on legitimate interests; and to object at any time to direct marketing.
• Automated decisions (Article 22): the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, and the safeguards related to that right. Some limits on the platform are applied automatically (for example, unlock limits based on a trust score); if you think such a limit affects you, write to destek@ufkon.com to ask for the decision to be reviewed by a member of our staff.

5. How to make a request and time limit

• You can make your request through the request form by selecting GDPR, or by writing to info@ufkon.com. If your company is registered in an EU/EEA country, the form handles your request under the GDPR automatically.
• Under Article 12(3) GDPR, information on the action taken on your request is provided without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests; you will be informed of any extension, with the reasons, within one month.
• You may make a request under the GDPR in Turkish or English (English form: /en/data-request).
• We may ask for additional information to confirm your identity.

6. Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

• If you consider that the processing of your data infringes the GDPR, you have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement.
• For processing in Turkey, your right to apply to the Turkish Personal Data Protection Board is preserved (KVKK Privacy Notice).

7. Where data is processed and transfers

• The platform server, database and email sending run at a hosting service provider in Germany (EU).
• The controller is established in Turkey; operating the platform, support and review work are carried out from Turkey, and the data is accessed from Turkey for these purposes.
• Cloudflare, Inc. (based in the USA) is used for bot protection (KVKK Privacy Notice, section 6).
• The safeguard relied on for these transfers and access under Chapter V GDPR (Articles 44 to 49) will be stated in this section once the legal assessment is complete.

8. Retention periods

• Retention periods are as set out in section 7 of the KVKK Privacy Notice; when a period ends, the data is erased, destroyed or anonymised.

9. Changes

• When this text changes, the new version is published on this page with its version number and effective date; earlier versions can be read in the version history.