Privacy Notice

This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) to inform you about the personal data processed in connection with the Secure Mail email security service offered under the Oxisec brand, the kbgyazilim.com website and the management panel.

1. Data controller

The data controller is Atria Madencilik Turizm Yatırım Sanayi ve Ticaret Limited Şirketi (the “Company”, “Oxisec”). Full company details are on the Company information page.

2. Our two roles in the service

As data controller: for website visitors, people who contact us and panel account holders.

As data processor: for the email traffic of the organisations that are our customers. Email content, attachments, sender/recipient addresses and headers belonging to our customers’ staff and correspondents are processed on behalf of the customer (the data controller) and only on its instructions. Requests about such emails should first be sent to the organisation that owns the mailbox; if a request reaches us we forward it to that customer. Our obligations as processor are set out in the data processing section of the Terms of Service.

3. Data processed, purposes and legal grounds

Website visitors: IP address, browser and device information, pages visited and timestamps (server logs); session and language cookies. Purpose: operating and securing the site and preventing abuse. Legal ground: KVKK Art. 5/2-f (legitimate interest). See the Cookie Policy.

Contact requests: name, business email, message content and, when you write via WhatsApp, your phone number and WhatsApp profile details. Our contact form does not store data on our server; with your action the message opens in WhatsApp and reaches us through WhatsApp. Purpose: answering your request, preparing offers, planning demos and onboarding. Legal ground: KVKK Art. 5/2-c (entering into a contract) and 5/2-f (legitimate interest).

Panel account holders: name, username, email address, irreversible password hash, two-step verification data, linked domains, login times and IP addresses, audit logs of panel actions, invoicing and payment details. Purpose: creating and managing the account, providing the service, security, detecting unauthorised access, invoicing and legal obligations. Legal ground: KVKK Art. 5/2-c (performance of contract), 5/2-ç (legal obligation), 5/2-f (legitimate interest).

Security analysis: by the nature of the service, links and attachment hashes in emails are checked for malicious content, and machine learning and AI models are used to detect spam and phishing. AI analysis runs on the Company’s own servers in Türkiye; email content is not sent to third-party AI services.

4. How data is collected

Personal data is collected electronically through the website and the panel, automatically (server logs, cookies, the mail gateway) and from information you give us (forms, WhatsApp, email, contracts).

5. Transfers

Personal data may be transferred, limited to the purposes above and in line with KVKK Articles 8 and 9, to:

• Hosting: the servers running the service are on Amazon Web Services (Frankfurt, Germany), so email traffic and panel data are processed on servers outside Türkiye.
• Security lookups: link addresses and file hashes may be checked against Google Safe Browsing (USA) and abuse.ch URLhaus / MalwareBazaar (Switzerland); the administrator security assistant may use Brave Search (USA) for domain and threat research. No email content, sender or recipient data is sent in these lookups.
• Contact: when you write via WhatsApp, your message passes through WhatsApp (Meta Platforms) infrastructure.
• Website fonts: our site uses Google Fonts; when you open a page your browser sends your IP address to Google.
• Authorised public bodies and courts, on request and to the extent required by law.

Transfers abroad are made under the appropriate safeguards (standard contracts) or the exceptions provided in KVKK Article 9.

6. Retention

Personal data is kept for as long as the purpose requires and for the periods set by law, then deleted, destroyed or anonymised. How long customer emails are kept in quarantine and archive is set by the customer according to its plan. Panel account and invoice records are kept for the term of the contract and for the periods required by the Turkish Commercial Code and tax law. Server security logs are kept for a reasonable period limited to their purpose.

7. Your rights

Under KVKK Article 11 you may learn whether your data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties it is transferred to in Türkiye or abroad, request correction of incomplete or inaccurate data, request deletion or destruction under Article 7, request that these actions be notified to third parties, object to a result against you arising solely from automated analysis, and claim compensation for damage caused by unlawful processing.

8. How to apply

You can send your request, with information identifying you, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller from your registered email address to destek@kbgyazilim.com. Requests are answered free of charge within thirty days at the latest; if the action requires an additional cost, the fee set by the Personal Data Protection Board may apply.

Last updated: 22 October 2026

This is a translation; the Turkish version prevails.