Privacy and Security Policy
1. Introduction
Gerçeği Arayanlar places the highest importance on customer privacy and data security. This policy explains how your data is collected, processed, protected, and used.
2. Privacy Principles
2.1 Data Minimization
Only necessary personal data is collected. We do not request unnecessary data.
2.2 Purpose Limitation
Your data is processed only for the purposes disclosed to you.
2.3 Transparency
Our processing practices are explained openly and clearly.
2.4 User Control
You control your personal data and may request access, correction, or deletion at any time.
3. Technical Security Measures
3.1 Encryption
- Encryption in transit: All communications use SSL/TLS 1.2 or higher
- Encryption at rest: Sensitive data (payment, identity) is encrypted with AES-256
3.2 Access Controls
- Access to personal data is limited to personnel who need it for their role
- Multi-factor authentication (MFA) is used
- All access is logged and reviewed regularly
3.3 Network Security
- Firewall protection and intrusion detection remain active
- Regular penetration testing and security audits are performed
- Protection against DDoS attacks is maintained
3.4 Backups
- All data is backed up daily
- Backups are encrypted and stored in a separate location
- A disaster recovery plan is in place
3.5 Software Security
- The web application is regularly scanned for security issues
- Dependencies are monitored for vulnerabilities
- Security patches are applied promptly
4. Operational Security Measures
4.1 Staff Training
All personnel involved with data security receive regular KVKK and security training.
4.2 Confidentiality Agreements
Contracts with processors include security obligations under KVKK Arts. 12 and 28.
4.3 Incident Management
In the event of a data breach or security incident:
- The incident is analyzed within 24 hours
- Affected individuals and competent authorities are notified as required
- Corrective and preventive measures are taken
4.4 Access Logs
All data access and changes are logged. Logs are retained for at least 1 year.
5. Third-Party Service Providers
Gerçeği Arayanlar works with third parties in the following categories:
| Service | Purpose | KVKK Compliance |
|---|---|---|
| Web hosting | Data storage | KVKK Art. 28 processor agreement |
| Email service | Customer communication | KVKK Art. 28 processor agreement |
| Analytics (Google Analytics) | Site usage analysis | Limited data with IP masking |
| Cargo companies | Delivery | Delivery address transfer |
KVKK compliance commitments are obtained from all third parties.
6. Protection of Children
Gerçeği Arayanlar does not process personal data of persons under 18. Our content is intended for adults. If you are under 18, please do not use this site.
7. External Links
Our website may contain external links. The privacy policies of those sites are not under Gerçeği Arayanlar’s control. Review their policies before visiting.
8. Legal Disclosure
Gerçeği Arayanlar may share personal data with competent authorities pursuant to legal requests and court orders. You may not be notified in advance where the law so requires.
9. Retention and Deletion
| Data Type | Retention | Reason |
|---|---|---|
| Purchase records | 6 years | Tax and accounting laws |
| Payment information | 6 years | Required by banking and tax rules |
| Customer service records | 3 years | Dispute resolution |
| Marketing data | Until consent is withdrawn | Legal basis is consent |
| Technical logs | 12 months | Security analysis |
After retention ends, data is securely deleted.
10. Cross-Border Transfers
Personal data is ordinarily processed in Türkiye. For international transfers under KVKK Art. 8:
- The destination country must provide “adequate protection”, or
- Standard Contractual Clauses must be executed
11. Changes
This policy may be updated from time to time. You will be notified of material changes by email where appropriate.
Last updated: August 2026
Questions: hello@gercegiarayanlar.com