KVKK Privacy Notice.

Identity and contact

Full name, e-mail address, telephone number, the company you work for and your job title.

Customer transaction

Order and cart contents, subscription products and periods, payment reference code and bank transfer confirmation details, support and request correspondence.

Invoicing

Invoice name (trade name or full name), tax identification number (VKN) or Turkish national identity number (TCKN), tax office, invoice address.

Transaction security

IP address, browser and device information (user agent), sign-in and session records, API key usage records, audit records of account and administration operations. Your password is stored only as an irreversible hash.

Plant information

A plant's name, location, installed capacity and technical details are organisational data; however, personal data such as the name and contact details of the authorised person stated in a plant application is processed within the scope of this notice.

We do not collect credit card or debit card details; payments are made by bank transfer only. We do not process special categories of personal data (health data, biometric data, etc.) and we ask you not to send us such data.

• Providing the forecasting service: account creation, panel access, CSV/Excel downloads, API access and the sending of daily e-mail reports.
• Establishing and performing the contract: receiving the order, matching the payment to its reference code, starting and managing the subscription, customer support.
• Issuing invoices, keeping accounting records and fulfilling tax obligations.
• Assessing demo requests and contacting the person who made the request.
• Ensuring information security; preventing and detecting unauthorised access, the sharing of API keys and misuse of the service.
• Fulfilling legal obligations, responding to information requests from competent authorities and protecting rights in potential disputes.

Your personal data is processed on the basis of the following legal grounds listed in Article 5/2 of the KVKK:

• (c) Establishment or performance of a contract: opening the account, receiving the order, providing the subscription, matching the payment, conducting the support and demo process.
• (ç) Legal obligation: issuing invoices, the record-keeping and retention obligations under Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102, providing information to competent authorities.
• (e) Establishment, exercise or protection of a right: use of order, payment, session and audit records as evidence in the event of a dispute.
• (f) Legitimate interest: keeping information security records and preventing misuse, provided that this does not harm your fundamental rights and freedoms.

Should any processing falling outside the scope of these legal grounds become necessary (for example, sending messages for marketing purposes), your explicit consent will be obtained separately before that processing begins.

Your personal data is not sold and is not shared for advertising purposes. It may be transferred to the following groups of recipients, solely to the extent limited to the purposes above:

• Hosting and infrastructure service provider: The service runs on Amazon Web Services (AWS) infrastructure. The servers and the database are located in the AWS Frankfurt (eu-central-1) region; account and order e-mails are sent via AWS Simple Email Service (SES) from the Stockholm (eu-north-1) region. This constitutes a transfer of personal data abroad and is carried out in accordance with the procedures laid down in Article 9 of the KVKK and the related secondary legislation (for example, by relying on one of the appropriate safeguards, such as a standard contract).
• Certified accountants and accounting service providers: keeping invoice and accounting records, conducting e-invoice/e-archive processes.
• Banks: receiving and matching bank transfer payments and, where necessary, refunding them.
• Competent public institutions and organisations and judicial authorities: only where they are authorised by law and to the extent requested.

Your personal data is collected electronically through the forms on the website and in the panel (demo request, membership, order and invoice details, plant application) and through e-mail and telephone correspondence. Transaction security data is generated partly by automated means, through server logs, when you sign in, use the panel and send requests to the API. For the information kept in your browser, please see the Privacy and Cookie Policy.

Contract, invoice and accounting records

For the term of the contract and for 10 years after it ends (retention obligations under commercial and tax legislation).

Account and contact details

For as long as the account remains open; when the account is closed, the data connected with the contract is subject to the period above and the rest is deleted.

Security records

Session, IP, API usage and audit records: for a maximum of 2 years from the time they are created.

Demo requests that are not approved

1 year from the date of the request.

When the periods expire or the reason for processing ceases to exist, the data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. If there is an ongoing dispute or a request from a competent authority, the relevant records may be retained until that process is concluded.

Pursuant to Article 11 of the KVKK, you may exercise the following rights by applying to the Company:

• a)To learn whether your personal data is being processed,
• b)To request information about the processing if your personal data has been processed,
• c)To learn the purpose of the processing of your personal data and whether it is being used in accordance with that purpose,
• ç)To know the third parties, in Türkiye or abroad, to whom your personal data is transferred,
• d)To request the rectification of your personal data where it has been processed incompletely or inaccurately,
• e)To request the deletion or destruction of your personal data under the conditions laid down in Article 7 of the KVKK,
• f)To request that the operations carried out under sub-paragraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred,
• g)To object to a result arising to your detriment from the analysis of the processed data exclusively by automated systems,
• ğ)To claim compensation for the damage you suffer as a result of your personal data being processed unlawfully.

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests concerning your rights in Turkish and by one of the following means:

• In writing: by a petition bearing a wet-ink signature, delivered in person or by post to —,
• By registered electronic mail (KEP): to —,
• By e-mail: from your e-mail address previously notified to the Company and registered in our system, to info@megawattron.com; or by using a secure electronic signature or mobile signature.

Your application must contain your full name, your signature if the application is in writing, your Turkish national identity number (for foreign nationals, nationality and passport or identity number), your residential or workplace address for service, your e-mail address for notification if any, your telephone number and the subject of your request. Documents relating to the matter may be attached to the application.

Your application will be concluded free of charge as soon as possible, depending on the nature of the request, and within 30 days at the latest. If the operation entails an additional cost, the fee in the tariff set by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) may be charged. If your application is rejected, if you find the reply insufficient or if no reply is given in due time, you may lodge a complaint with the Personal Data Protection Board pursuant to Article 14 of the KVKK.