Privacy Notice and Privacy Policy (KVKK)

Identity of the Data Controller

Pursuant to Law No. 6698 on the Protection of Personal Data (the "Law" or "KVKK") and related legislation, your personal data is processed by Maresign Dijital Güven Teknolojileri Limited Şirketi (the "Company") in its capacity as data controller, within the scope and on the legal grounds explained below.

MERSIS No: 0612184635900001 · Notification address: Caferağa Mah. Şifa Sk. No: 19, Kadıköy / İstanbul · Office: Metropol İstanbul, B Blok No: 22, Ataşehir / İstanbul · Email: digital@maresign.com · Telephone: +90 850 305 40 15

What Personal Data We Process and For What Purposes

Where you complete the quotation and purchase request form on our website, the identity data (name, surname), contact data (email address, telephone number) and customer transaction data (company information, content of the request) you share with our Company are processed for the purposes of evaluating your request and presenting you with a suitable quotation.

Your data will under no circumstances be used for marketing purposes, and no commercial electronic messages (newsletters, promotions and the like) will be sent to you.

Method and Legal Basis of Collection

Your personal data is obtained electronically and by partially automated means, through your completion of the form on our website. This processing activity is carried out on the legal basis set out in Article 5(2)(c) of the Law — namely that "processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract".

To Whom and For What Purpose Personal Data May Be Transferred

As a rule, your personal data is not shared with third parties. However, the following specific transfers may take place within the conduct of our processes.

Domestic transfers: Where mutual agreement is reached to initiate the qualified electronic certificate application process, your data is transferred — solely and strictly for the purpose of certificate production — to ArkSigner Yazılım ve Donanım San. Tic. A.Ş., an Electronic Certificate Service Provider licensed by the ICTA and acting as an independent data controller under Law No. 5070 on Electronic Signature. Identity verification procedures carried out at ArkSigner are conducted within the framework of that company's own privacy notice and legal obligations.

Cross-border transfers: Personal data you submit through the quotation and purchase request form on our website is processed on servers located in Türkiye and is not transferred abroad. Only where you give explicit consent in your cookie preference, limited usage data obtained through Google Analytics 4 measurement cookies (for example truncated IP address, device/browser information, session data) is transferred abroad via Google LLC infrastructure. This transfer is based on your explicit consent within the scope of Article 9 of the Law, and you may withdraw your cookie consent at any time. For details please see our Cookie Notice.

Retention and Periodic Erasure of Personal Data

Once your request has been concluded or the quotation process has ended unsuccessfully, your personal data will cease to serve its processing purpose within 12 months at the latest, unless a longer statutory retention or limitation period arises from legislation. In accordance with the Personal Data Retention and Destruction Policy prepared pursuant to the Regulation on Deletion, Destruction or Anonymisation of Personal Data, our Company identifies data whose retention period has expired and deletes, destroys or anonymises it ex officio within periodic erasure cycles of no more than six months.

Your Rights Under Article 11 of the Law and How to Exercise Them

As a data subject you have the right, under Article 11 of the Law, to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties to whom the data has been transferred in Türkiye or abroad; request rectification if the data has been processed incompletely or inaccurately; request deletion or destruction within the conditions set out in the Law; request that rectification or deletion be notified to third parties to whom the data has been transferred; object to a result arising against you from analysis carried out exclusively by automated systems; and claim compensation where you suffer damage due to unlawful processing.

You may submit requests concerning these rights to our Company by one of the following methods, in accordance with Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller: in person together with documents evidencing your identity, by written petition bearing a wet signature, or by the other methods provided for in the Communiqué.

Your applications will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of your request.

Cookies

Cookie use on our site falls outside the scope of this notice and is managed by a separate mechanism: measurement cookies (Google Analytics 4) operate only subject to the explicit consent you give in the cookie panel presented when you enter the site; the "Reject" option is offered with equal ease, and if you reject, no measurement cookie is placed on your device.

Effective date: 13 August 2026 · Rev. 3

Convenience translation. This English text is provided for information purposes only. The legally binding version of this Privacy Notice is the Turkish text published at maresign.com. In the event of any discrepancy between the two versions, the Turkish text prevails.