Privacy Policy

1. Scope

This policy applies to the Ufkon website (ufkon.com) and user dashboards and summarises how we protect your personal data. Which data is processed for which purpose and on which legal ground, to whom it is transferred and your rights are set out in detail in the KVKK Privacy Notice.

2. Anonymous project requests and the sharing principle

• When a project request is published, document-verified firms see only technical details such as province/district, approximate location, roof type and capacity.
• The province (only the region where few requests exist), project size band, subscriber type, installation site and publication day of a request may be shown, without name, contact details, district, address or description, in the "Live project requests" list that can be viewed without signing in. These details are kept at a level that cannot identify you on their own.
• Name, company name, phone, email, full address and documents are disclosed only to the document-verified firms that spend credits to unlock the project request, for that project only. Each firm unlocks a request once; firms in the same corporate group count as one. Once the investor closes the request, no new unlocks are possible.
• Before unlock, this information does not enter any screen, page source, link, preview image or log file seen by firms.
• After unlock, the investor and the firm can exchange text messages on the platform. Reported messages may be reviewed by authorised staff. The agreement is made off the platform, directly between the parties.
• Material request: a material request opened by an investor or an EPC firm is published on the same principle: approved suppliers and the public request list see only the product group, quantity, province (only the region in provinces with few requests) and delivery time. The name, phone, email, district and private note are disclosed only to the approved supplier that unlocks the request by spending credits, for this request only. Investors do not see suppliers' product catalogues.

3. Security measures

• Encryption: phone numbers, addresses, contact copies, national ID numbers, message contents, KVKK requests and two-factor keys are stored encrypted in the database. Searches on these fields use irreversible hashes (blind indexes). Passwords are stored as one-way hashes.
• Transport security: the site runs only over HTTPS; an HSTS header that makes browsers enforce secure connections and a content security policy are sent.
• Documents: kept in a non-public store; opened only through signed links that pass an authorisation check and are valid for a few minutes; every download is logged.
• Access rights: each user and staff member can access only the data their role requires; access to another workspace's data is blocked. Every view of investor contact details is logged (who and when, not the value itself).
• Staff: the admin panel is accessed with separate accounts and mandatory two-factor authentication. Staff actions are kept in audit records chained with hashes, so later alteration can be detected.
• Abuse protection: rate limits on login codes, messages and form submissions; bot protection (Cloudflare Turnstile) at critical steps; detection of fake and multiple accounts.
• Destruction: data whose retention period has ended is deleted or anonymised by a destruction job that runs automatically every month; erasure requests are carried out with the approval of two separate staff members.

4. Hosting and transfers abroad

The platform's server, database and email delivery run with a hosting provider in Germany (EU); Cloudflare is used for bot protection and, if you consent in the cookie banner, Google Analytics (Google LLC, USA) for visit statistics. These transfers rely on the standard contract under KVKK Art. 9/4-c. Details: KVKK Privacy Notice, "Transfers abroad".

5. Data breaches

If we learn that personal data has been obtained by others through unlawful means, we notify the Personal Data Protection Board without delay and within 72 hours at the latest, and inform the affected persons by email or dashboard notification as soon as reasonably possible. Breaches and the measures taken are recorded.

6. Retention periods

Data is kept only as long as the purpose of processing requires. Main periods: the contact copy and documents in a request, 12 months after the project request closes; on-platform messages, 24 months from the last message; invoice, payment and unlock records, 10 years. The full list is in the retention section of the KVKK Privacy Notice.

7. Cookies

Cookies strictly necessary for the site to work and stay secure, plus the theme, language and cookie choices you make, are used. Google Analytics cookies are set only if you click "Accept" in the cookie banner; you can withdraw consent via the "Cookie preferences" link at the bottom of every page. No advertising or tracking cookies are used. Details: Cookie Policy.

8. Commercial messages

Campaign and announcement messages are sent only with your separate and optional consent; you can withdraw it through the link in every message or in your dashboard (commercial messages consent).

9. Children

The platform is for persons aged 18 or over and for companies. Persons under 18 must not become members; if we notice such an account, we close it and delete its data.

10. Your rights and contact

For your rights under KVKK Art. 11 you can apply through the KVKK request form, info@ufkon.com or KEP (none). Requests are answered within 30 days at the latest and, as a rule, free of charge. For other questions: destek@ufkon.com.

11. Changes

When this policy changes, the new version is published on this page with its version number and effective date; earlier versions can be read in the version history. Effective: the date of publication. This English text is a courtesy translation; the Turkish version is the binding text.