Privacy Policy

This policy explains how Hipertek Elektronik ve Makina Sanayi Ticaret Limited Şirketi, which trades as Hipertech, handles personal data collected through the website at hipertech.co. It is the information notice (aydınlatma metni) required by Article 10 of the Turkish Law on the Protection of Personal Data No. 6698 (Kişisel Verilerin Korunması Kanunu, KVKK), and it also gives the information required by Articles 13 and 14 of the EU General Data Protection Regulation (EU) 2016/679 (GDPR) where that Regulation applies.

In this policy, "Hipertech", "we" and "us" mean the company named in section 1. This policy is information. You are not asked to accept it, and using the site is never treated as consent to anything.

1. Who is responsible for your data

The data controller is HİPERTEK ELEKTRONİK VE MAKİNA SANAYİ TİCARET LİMİTED ŞİRKETİ, the company that trades under the name Hipertech.

• Registered trade name: HİPERTEK ELEKTRONİK VE MAKİNA SANAYİ TİCARET LİMİTED ŞİRKETİ
• MERSİS number: 0463038996600015 (head office); 0463038996600016 (Zeytinburnu branch)
• İstanbul trade registry number: 552142-0, registered with the İstanbul Ticaret Odası on 21 April 2005
• Head office: İnönü Mah, Cumhuriyet Cad. No:99 Kat:6 D:15, 34373 Şişli / İstanbul, Türkiye
• Factory: Maltepe Mah. 330. Sk. No: 9, Zeytinburnu / İstanbul, Türkiye
• Telephone (head office): +90 (0212) 892 44 63
• Telephone (factory): +90 (0212) 675 24 06, +90 (0212) 613 27 86
• Email: info@hipertech.com.tr

Questions and requests about personal data go to info@hipertech.com.tr, with "Personal data" in the subject line, or by post to the head office. They are passed to the people at Hipertech responsible for data protection.

Hipertech is established in Türkiye, so it has no data controller's representative within the meaning of Article 10 of Law No. 6698.

Registration in the Data Controllers' Registry (VERBİS): [TO BE CONFIRMED: Hipertech's VERBİS registration status].

2. What this policy covers

This policy covers personal data processed through hipertech.co: the pages you read, the contact form, and email you send us after finding us here.

It does not cover:

• personal data processed by HBO Group, the separate company that operates hyperbaric centers in Türkiye. A person treated at one of those centers receives a notice from the center treating them.
• personal data processed by other websites this site links to, including coralwellness.co, uhms.org, LinkedIn, Instagram, Facebook and WhatsApp. Each publishes its own notice.
• personal data that arises once a commercial relationship exists: contracts, deliveries, installation, maintenance and training records. Those are covered by the notices that accompany that relationship.

3. What we collect

What you send us. If you write to us through the contact form or by email, we process what you put in the message: your name, your email address, and, if you choose to give them, your telephone number, your organisation and your country. The content of the enquiry is processed with it. The form also contains a hidden field that people never see; it exists to catch automated spam and anything typed into it is discarded. If you reach us instead through WhatsApp, LinkedIn, Instagram or Facebook, that platform handles your message under its own notice, and we treat what you send us as an enquiry.

Please do not send health data. Hipertech manufactures equipment. It is not a treatment provider and has no reason to hold information about anyone's health. Do not put details of a patient, a diagnosis or a course of treatment into an enquiry. Health data is a special category of personal data under Article 6 of Law No. 6698 and Article 9 of the GDPR. If any reaches us through this website, it is deleted rather than kept.

What the server records. Every request to a website leaves a technical record: the IP address the request came from, the date and time, the page requested, the browser's user-agent string and the referring page. Our hosting provider writes these to a log. To protect the contact form from abuse, the IP address of each submission is also held briefly in memory to limit how many enquiries can be sent from one address in a short period.

How the site is used. We measure how the site is used in two ways, described in section 9. Cookieless statistics and performance measurement record the pages viewed, the referring site, the country (derived from the IP address, which is not stored for this purpose), the device type, the browser and the operating system, and page-loading times. If, and only if, you agree to analytics cookies, Google Analytics also records a pseudonymous identifier for your browser and how you move through the site.

Your cookie choice. When you choose which cookies to allow, we record that choice.

We do not ask for, and do not knowingly collect, special categories of personal data. We do not take decisions about you by automated means alone, and we do not profile you.

4. Why we use your data, and on which legal ground

Each purpose below names the specific legal ground relied on under Law No. 6698 and, where the GDPR applies, under that Regulation.

Answering your enquiry

To read, answer and follow up an enquiry sent through the form or by email, and to prepare information or a quotation you ask for.

• Under Law No. 6698: where you ask on your own account about a possible contract with us, Article 5(2)(c), processing directly related to the formation or performance of a contract. Where you write on behalf of an organisation, or with a general question, Article 5(2)(f), our legitimate interest in answering business enquiries addressed to us, which does not override your fundamental rights and freedoms.
• Under the GDPR: Article 6(1)(b), steps taken at your request before entering into a contract, or Article 6(1)(f), the same legitimate interest.

Keeping business records

Where an enquiry leads to a contract, the correspondence becomes part of our commercial records, which Turkish law requires us to keep.

• Under Law No. 6698: Article 5(2)(ç), compliance with a legal obligation.
• Under the GDPR: Article 6(1)(c), compliance with a legal obligation.

Keeping the website running and secure

To deliver pages, detect and block abuse and attacks, limit how often the contact form can be used from one address, and investigate faults.

• Under Law No. 6698: Article 5(2)(f), our legitimate interest in operating a secure website.
• Under the GDPR: Article 6(1)(f), the same legitimate interest.

Cookieless statistics and performance measurement

To count visits and page views, see which pages are useful, and find pages that load slowly. This uses no cookies and stores nothing on your device that identifies you.

• Under Law No. 6698: Article 5(2)(f), our legitimate interest in understanding, in aggregate, how the site is used.
• Under the GDPR: Article 6(1)(f), the same legitimate interest.

Analytics with your consent

To understand in more detail how visitors use the site through Google Analytics, loaded through Google Tag Manager. This happens only if you opt in through the cookie banner, and stops when you withdraw your consent.

• Under Law No. 6698: your explicit consent (açık rıza), Article 5(1).
• Under the GDPR: your consent, Article 6(1)(a).

Remembering your choices

To remember the language you chose and your cookie choices, and to be able to show which choice you made.

• Under Law No. 6698: Article 5(2)(f) for the language setting; Article 5(2)(ç) for the record of your consent.
• Under the GDPR: Article 6(1)(f) for the language setting; Article 6(1)(c) for the record of your consent.

Legal claims and requests from authorities

To establish, exercise or defend legal claims, and to answer a court or an authorised public body.

• Under Law No. 6698: Article 5(2)(e), establishing, exercising or protecting a right, and Article 5(2)(ç), compliance with a legal obligation.
• Under the GDPR: Article 6(1)(f) and Article 6(1)(c).

5. How the data is collected

Personal data is collected through the website by wholly or partly automated means: the form you submit, the email you send, the request log written as a page is served, the measurement described in section 9, and the cookie choice you make.

We do not buy personal data, do not collect it from other sources, and do not add data obtained from third parties to what you send us.

6. Who receives your data

Inside Hipertech, an enquiry is read by the people who need it to answer you: sales and engineering, and Hipertech Academy where it concerns training or maintenance. Technical logs and statistics are seen by the people who run the website.

Outside Hipertech, personal data reaches the following service providers, which act as data processors on our instructions and for no purpose of their own:

• Vercel Inc., United States: hosting, the content delivery network that serves the pages worldwide, the request logs described in section 3, the server function that receives the contact form (which runs in the United States), and the cookieless statistics and performance measurement (Vercel Web Analytics and Speed Insights).
• Resend (Plus Five Five, Inc.), United States: the email delivery service that carries a submitted enquiry from the website to our inbox. Our account sends from Resend's European (Ireland) region. Resend sees the enquiry in transit.
• Google (Google Workspace): the email service that hosts our inbox at hipertech.com.tr. Every enquiry and email you send us is stored there. Google stores data in data centres in the United States and other countries.
• Google (Google Analytics and Google Tag Manager): analytics, only if you have consented to analytics cookies. We use it for statistics only, not for advertising.
• Cloudflare, Inc., United States: the domain name service (DNS) for hipertech.co. If traffic to the site is routed through Cloudflare's network, it also processes the request data described in section 3 to deliver the site and protect it from attack.
• Sanity.io AS, Norway: content management for the site's editorial text and images. It does not receive enquiries or visitor data.

Article 12 of Law No. 6698 and, where it applies, Article 28 of the GDPR require a written data processing agreement with each processor, setting out the subject matter, purpose and duration of the processing and the security measures taken. We treat a concluded agreement as a precondition for any of these services processing personal data on our behalf.

We may also disclose personal data to legal advisers and auditors bound by confidentiality, and to courts and public authorities where the law requires or allows it.

We do not sell personal data, do not disclose it to advertising networks, and do not pass it to anyone for their own marketing.

7. Transfers outside Türkiye and the European Economic Area

Several of the providers in section 6 process data outside Türkiye, mainly in the United States and the European Union.

Under Law No. 6698. Article 9 of Law No. 6698, as amended by Law No. 7499 with effect from 1 June 2024, allows a transfer abroad where a condition in Article 5 or 6 is met and the destination is covered by an adequacy decision of the Personal Data Protection Board, or, failing that, an appropriate safeguard under Article 9(4) is in place. As at the date of this policy, the Board has published no adequacy decision. For our service providers abroad, the safeguard we rely on is the standard contract issued by the Board under Article 9(4)(c), which must be notified to the Personal Data Protection Authority within five business days of signature. Notification to the Authority: [TO BE CONFIRMED: for each provider outside Türkiye, the date its Article 9(4) standard contract was notified to the Authority].

An occasional transfer that a specific enquiry or contract requires, for example sending a quotation to your organisation abroad, may instead rely on one of the derogations in Article 9(6), such as the transfer being necessary for a contract with you.

Under the GDPR. If you are in the European Union and write to us, you are sending your data directly to a company established in Türkiye. Where we pass EU personal data on to a provider in the United States, we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Article 46(2)(c) of the GDPR). You can ask us for a copy of the relevant safeguard using the contact details in section 1.

8. How long we keep your data

These are Hipertech's retention periods:

• Enquiries and the correspondence that follows them: three years after our last contact with you, if no contract follows. Chamber procurement often runs over several years, and this lets us pick up a conversation where it stopped.
• Correspondence that leads to a contract: it becomes part of our commercial records and is kept for ten years, as Article 82 of the Turkish Commercial Code No. 6102 requires.
• Health data sent to us by mistake: deleted as soon as it is noticed.
• Server and security logs: no longer than twelve months. Our hosting provider's own logs are generally kept for a much shorter period.
• The contact-form rate limit: the IP address is held in memory for ten minutes, then discarded.
• Cookieless statistics and performance data: kept in aggregated form, which does not identify you.
• Google Analytics data (only with your consent): no longer than fourteen months.
• Your cookie choice: twelve months, after which the banner asks again.
• Requests you make about your personal data, and our answers: three years, so that we can show how a request was handled.

Where a legal claim or an investigation is pending, we may keep the data concerned until it is resolved. When a period ends, the data is deleted, destroyed or anonymised, as Article 7 of Law No. 6698 requires.

9. Cookies and similar technologies

A cookie is a small text file a website stores in your browser. We use as few as we can, and nothing beyond the strictly necessary is set unless you opt in.

Strictly necessary cookies are needed to deliver the site as you use it, so we set them without asking, as the Personal Data Protection Board's Guide on Cookie Practices allows.

Cookieless measurement. Vercel Web Analytics and Speed Insights set no cookies and store no identifier on your device. Visits are counted from the request itself, and page-loading times are measured in your browser and sent to Vercel without anything that identifies you.

Analytics cookies are set only after you choose to allow them in the cookie banner. Rejecting them is as easy as accepting them, and the site works the same either way. Until you opt in, Google Tag Manager and Google Analytics are not loaded and the site makes no request to Google.

Changing your mind. You can change or withdraw your choice at any time through the cookie settings link at the foot of every page. Withdrawing consent stops further analytics; it does not affect what was lawfully collected before. You can also delete cookies through your browser settings.

We do not use advertising cookies, and we do not embed third-party content, such as maps or videos, that sets cookies of its own.

10. Your rights under Law No. 6698

Under Article 11 of Law No. 6698, you have the right to apply to us to:

• (a) learn whether your personal data is being processed;
• (b) request information about the processing, if it has been processed;
• (c) learn the purpose of the processing and whether the data is used in line with that purpose;
• (ç) know the third parties, in Türkiye or abroad, to whom the data has been transferred;
• (d) request correction where the data is incomplete or inaccurate;
• (e) request erasure or destruction of the data under the conditions in Article 7;
• (f) request that a correction, erasure or destruction be notified to the third parties to whom the data was transferred;
• (g) object to a result against you that arises from analysis of your data exclusively by automated systems;
• (ğ) claim compensation for loss caused by unlawful processing of your personal data.

Where we process data on the basis of your explicit consent, you can withdraw it at any time.

11. Your rights under the GDPR

If the GDPR applies to the processing of your data, you also have the rights set out in Articles 15 to 22 of the Regulation:

• access to your personal data and a copy of it (Article 15);
• rectification of inaccurate or incomplete data (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• notification of a rectification, erasure or restriction to the recipients of your data (Article 19);
• data portability, for data you gave us that we process by automated means on the basis of consent or a contract (Article 20);
• objection to processing based on our legitimate interests (Article 21);
• not to be subject to a decision based solely on automated processing that significantly affects you (Article 22). We take no such decisions.

Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal (Article 7(3)). You can also complain to the data protection supervisory authority of the EU member state where you live, work, or where the alleged infringement took place (Article 77).

Representative in the European Union under Article 27 of the GDPR: [TO BE CONFIRMED: the representative's name and address, or confirmation that none is designated].

12. How to make a request

You can make a request:

• by email to info@hipertech.com.tr, with "Personal data" in the subject line. Under Law No. 6698, an email application must come from an address you have previously given us and that is registered in our systems;
• in writing, signed, to the head office address in section 1;
• by registered electronic mail (KEP), secure electronic signature or mobile signature, to [TO BE CONFIRMED: Hipertech's KEP address, if the company holds one].

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, an application under Law No. 6698 must be made in Turkish and must state your name and surname (with your signature, if it is in writing); your Turkish identity number or, if you are not a Turkish citizen, your nationality and your passport or identity number; your address for notifications; your email address, telephone or fax number if you have one; and the subject of your request. Attach any documents that support it. Requests under the GDPR may be made in English.

We may ask you to confirm your identity before we answer, so that we do not disclose your data to someone else.

We answer as soon as possible and within thirty days at the latest. Answering is free of charge. Where answering requires a separate cost, the Board's tariff applies: a written answer is free up to ten pages, with one Turkish lira charged for each page after that, and an answer given on a recording medium costs no more than the medium. If the request arose from our mistake, any fee is refunded. Under the GDPR, a request is answered within one month, which may be extended by two further months for complex requests; we will tell you if that happens.

If we refuse your request, if you find the answer inadequate, or if we do not answer in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within thirty days of receiving our answer, and in any case within sixty days of your application. Under Law No. 6698, a complaint to the Board can only be made after applying to us first.

13. How we protect your data

Article 12 of Law No. 6698 and Article 32 of the GDPR require us to take appropriate technical and organisational measures to keep personal data secure. The site is served only over HTTPS, the contact form accepts submissions only from the site itself and limits how often it can be used, access to enquiries is limited to the people who need them, and our providers are chosen with their security in mind.

No transmission over the internet is completely secure. If you need to send us something confidential, ask us first how best to send it.

14. Children

This site is for hospitals, navies, commercial diving companies, research institutes and other professional buyers. It is not directed at children, and we do not knowingly collect personal data from anyone under eighteen. If you believe a child has sent us personal data, tell us and we will delete it.

15. Changes to this policy

The date at the top of this page is the date of the current version. When we change the policy, we publish the new version here with a new date.

Where a change is material, such as a new purpose, a new category of recipient or a new transfer abroad, we will show a notice of it on this page before the change takes effect. Continuing to use the site is never treated as agreement to a change, and where a change needs your consent, we will ask for it.

16. How to contact us about privacy

For any question about this policy or about your personal data, write to info@hipertech.com.tr with "Personal data" in the subject line, or to Hipertech at the head office address in section 1.