Privacy Policy

Last updated: August 17, 2026

This policy explains how Nascella Teknoloji San. ve Tic. Ltd. Şti. ("Nascella", "we") processes your personal data as data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK").

1. Data Controller

2. Personal Data We Process, Purposes and Legal Bases

2.1. Contact form

• Data: Full name, company, e-mail address, phone number, subject, product of interest, message, any files you attach (logs, screenshots, etc.) and the IP address the form was sent from.
• Purpose: Responding to your request; handling quotes, demos and technical support; preventing automated (bot) abuse of the form.
• Legal basis: Necessity for entering into or performing a contract (KVKK Art. 5/2-c); our legitimate interests, provided they do not override your fundamental rights (Art. 5/2-f).
• The message and attachments are not stored in our database; they are delivered as e-mail to our corporate mail system (Microsoft 365). A record of the submission (full name, IP address and result) is kept for security purposes. Please avoid including other people's personal data in attached files.

2.2. Trial requests and downloads

• Data: E-mail address, requested product, request date and language, the IP address and country of the request, date and IP address of download link use.
• Purpose: Reviewing and approving trial requests, creating a personal download link, detecting unauthorized sharing or misuse of the link, pre-sales communication.
• Legal basis: Entering into a contract (Art. 5/2-c), legitimate interests (Art. 5/2-f).

2.3. Software update checks and file downloads

Installed Nascella software periodically asks our servers whether a new version is available.

• Data: Requesting IP address and country, product key, installed version, client software information, language and request time; for update downloads also the downloaded file.
• Purpose: Providing the update service, tracking license and version distribution, detecting fake clients, excessive requests and abuse.
• Legal basis: Performance of a contract (Art. 5/2-c), legitimate interests (Art. 5/2-f).

2.4. Website visits and security logs

• Data: IP address, visited page, date/time and browser information; technical details of a request when an attack attempt is detected.
• Purpose: Securing the website, detecting and blocking attacks, troubleshooting; fulfilling our obligations as a hosting provider under Turkish Law No. 5651.
• Legal basis: Explicitly required by law and compliance with a legal obligation (Art. 5/2-a, 5/2-ç); legitimate interests (Art. 5/2-f).
• IP addresses are anonymized before they are recorded in our application performance and error monitoring (Azure Application Insights).

2.5. Cookies

Apart from cookies that are strictly necessary for the website to work, no cookies are used without your consent. See our Cookie Policy for details.

3. Recipients of Personal Data

We share personal data only to the extent necessary for the purposes above, with the following recipients:

4. How We Collect Personal Data

Personal data is collected electronically, by automated or partly automated means, through the forms on our website, trial request screens, update requests from installed software, cookies and server logs.

5. Retention and Deletion

Personal data is kept for as long as necessary for the purpose it was collected for and for the periods required by law; it is then deleted, destroyed or anonymized.

6. Security Measures

We apply technical and organizational measures to prevent unlawful processing of and access to personal data, including:

• Customer and applicant data is classified as "Confidential"; only authorized staff can access it and access is logged.
• Two-factor authentication is mandatory for corporate cloud storage, e-mail and source code systems.
• Company computers are protected with full-disk encryption.
• Real customer data is never used in software development or testing.
• Website traffic is encrypted with HTTPS (TLS); security headers, attack detection and rate limiting are in place.
• Removable media (USB drives, external disks) are not used for personal data.
• Staff sign a confidentiality undertaking when they join; all access is revoked when they leave.

7. Your Rights

Under Article 11 of the KVKK you have the right to:

1. learn whether your personal data is processed,
2. request information about the processing,
3. learn the purpose of the processing and whether data is used accordingly,
4. know the third parties in Türkiye or abroad to whom your data is transferred,
5. request correction of incomplete or inaccurate data,
6. request deletion or destruction of your data under Article 7 of the KVKK,
7. request that corrections, deletions or destructions be notified to the third parties the data was transferred to,
8. object to a result against you arising exclusively from automated analysis of your data,
9. claim compensation for damages arising from unlawful processing.

If you are located in the European Economic Area, you may also exercise your rights under the GDPR by contacting us at the address below.

8. How to Contact Us

You can send your request in writing to our address above, via registered e-mail (KEP) to [email protected], or from an e-mail address registered with us to [email protected]. Please include your full name, contact details and a description of your request. We respond free of charge within 30 days at the latest.

9. Information for Visitors in the EEA and the UK

Nascella is established in Türkiye, and this policy is primarily based on the KVKK. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing of your personal data, the following also applies:

• Legal bases: performance of a contract or steps prior to entering into a contract (Art. 6(1)(b)) for contact and trial requests; our legitimate interests (Art. 6(1)(f)) in securing the website, preventing abuse and providing software updates; compliance with legal obligations (Art. 6(1)(c)); and your consent (Art. 6(1)(a)) for analytics cookies, which you can withdraw at any time via Cookie Settings.
• Your rights: access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21), and the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Complaints: you have the right to lodge a complaint with the data protection supervisory authority in your country of residence. We would appreciate the chance to address your concern first at [email protected].
• Hosting and transfers: our website and database are hosted in the European Union (Germany). Personal data is accessed by our team in Türkiye and shared with the service providers listed in section 3, some of which are located outside the EEA.
• Automated decisions: we do not make decisions based solely on automated processing that produce legal or similarly significant effects.