Privacy Policy and Disclosure Statement

1. Data Controller

Your personal data is processed by AIOR TECHNOLOGY LIMITED COMPANY as data controller. Full identity, address, registered e-mail and contact details are in the "Service Provider Details" section at the end of this page.

This text fulfils the disclosure obligation under article 10 of Law no. 6698 and follows the same principles as AIOR's Personal Data Protection Policy in force.

2. Personal Data We Process

We do not request special categories of personal data (health, biometric, religion, membership, etc.); our service processes do not require them. Please do not include such data in support records or forms.

3. Purposes of Processing

• Formation and performance of the contract: taking the order, provisioning, managing and renewing the service.
• Support and incident management: tracking, resolving and measuring the quality of requests and faults.
• Meeting invoicing, collection and accounting obligations.
• Information security: preventing unauthorised access, detecting abuse and attacks, keeping logs.
• Legal obligations: hosting-provider duties under Law no. 5651, tax legislation, duly made requests from competent authorities.
• Only with your consent: newsletters, campaign and promotional commercial electronic messages, and optional analytics.

4. Legal Bases

• Necessary for the formation or performance of a contract (art. 5/2-c): ordering, provisioning, support, invoicing.
• Compliance with a legal obligation (art. 5/2-ç): log retention, tax and record-keeping duties.
• Legitimate interests (art. 5/2-f): infrastructure security, prevention of fraud and abuse, measuring service quality.
• Establishment, exercise or protection of a right (art. 5/2-e): dispute and claim management.
• Explicit consent (art. 5/1): non-essential cookies and promotional commercial electronic messages. You may withdraw consent at any time.

5. Collection Methods

Data is collected through order and contact forms on aior.com, the client area, support records, e-mail and phone communication, contract and invoicing processes, and system logs — by automated and non-automated means.

6. Transfers and Sub-processors

• Data is shared only to the extent necessary to provide the service and on a legal basis: data centre and cloud providers, domain registries, payment institutions, e-mail and communication infrastructure providers, and our accountant.
• Data processing agreements are signed with service providers; their access is limited to business need and duration.
• Transfers abroad are made under article 9 and decisions of the Data Protection Board; where required, standard contractual clauses or undertakings are used.
• Data is never sold or rented to third parties for advertising purposes.

7. Retention and Destruction

• Contract and invoice records are kept for the limitation and retention periods required by applicable legislation.
• Traffic and access logs are retained for the period required by Law no. 5651 and its secondary legislation.
• Support records are kept during the service relationship and for a reasonable evidential period thereafter.
• Consent-based marketing data is kept until consent is withdrawn; it is deleted without delay upon withdrawal.
• Expired data is deleted, destroyed or anonymised; destruction activities are recorded.

8. Data Security Measures

• Technical: encryption in transit and at rest, role-based access control, multi-factor authentication, firewall and WAF, intrusion detection, patch management, logging and monitoring, regular vulnerability scanning.
• Organisational: confidentiality undertakings, least-privilege principle, staff awareness training, supplier assessment, personal data processing inventory and periodic internal audit.
• Backup and restore capabilities are tested regularly.

9. Data Breach Management

• On detection of a personal data breach, notification is made to the Personal Data Protection Board as soon as possible and in any case within 72 hours.
• Affected data subjects are informed as soon as possible.
• Every breach is recorded; root-cause analysis is performed and corrective action is applied.

10. Data on Systems You Host

If you process third-party personal data in your own website, application or database on our hosting, you are the data controller and AIOR acts as a processor. AIOR accesses such data only to provide the service and for technical intervention at your request; a data processing agreement is signed where required.

11. Your Rights and How to Apply

Under article 11 you have the right to learn whether your data is processed; to request information if it is; to learn the purpose and whether it is used accordingly; to know the third parties to whom it is transferred domestically or abroad; to request rectification if incomplete or inaccurate; to request erasure or destruction where conditions are met; to request that rectification/erasure be notified to third parties; to object to an adverse outcome produced solely by automated analysis; and to claim compensation for damages arising from unlawful processing.

• You may submit requests to [email protected], to [email protected] via registered e-mail, or in writing to our company address.
• Your request is concluded free of charge within 30 days at the latest; where the process incurs an additional cost, the fee in the tariff set by the Board may be charged.
• So that we can verify your identity, please clearly state your name, contact details and the subject of your request.
• If your request is rejected or not answered in time, you retain the right to complain to the Personal Data Protection Board.

12. Cookies

Cookie categories used on our site, retention periods and consent management are explained on the Cookie Preferences page. No cookie other than strictly necessary ones runs without your explicit consent; you can change your preferences at any time.

13. Changes

This text is updated when legislation or processes change; the current version is published on this page with its effective date. For material changes, consent is re-obtained where required for consent-based processing.

Service Provider Details

Legal name

AIOR TEKNOLOJİ LİMİTED ŞİRKETİ

Address

Geçit Mahallesi 6. Gümüş Sokak No: 6, Balkar Plaza A Blok Kat: 1 Daire: 2, Osmangazi / Bursa / Türkiye

Tax office / Tax ID

Osmangazi V.D. — 0102359120

MERSIS

0010235912000001

Trade registry no

137841

E-mail

[email protected]

Registered e-mail (KEP)

[email protected]

Phone

+90 850 309 80 80

All official registry data:Company details·BTK hosting-provider registry

Related Documents

• Service Management System PolicyAIOR-HYS-PLT-05
• Terms of Service
• Service Level Statement
• Acceptable Use Policy
• Cookie Preferences
• Company details (official registry)