Privacy and cookies

Version: 2026-10-26

This statement explains which personal data is processed when you visit www.2winscada.com, submit the request form, email us or, as our customer, use our support system and customer portal (support.2winscada.com). It also covers the requirements of the EU General Data Protection Regulation (GDPR) for visitors in the European Economic Area (EEA). The information required by Turkish Law No. 6698 on the Protection of Personal Data (KVKK) is in the privacy notice.

Privacy statement

Controller

Turkuvaz İnovasyon A.Ş., Yıldırım Beyazıt Mah. Aşık Veysel Bul. No: 63-O, Melikgazi/Kayseri, Türkiye (Erciyes Teknopark, Mekanik Kuluçka), info@turkuvazinovasyon.com.

When you visit the website

For each request, our server records the IP address, the time, the path of the requested page (without query parameters), the response code, the referring page and browser information.
If an error occurs, the IP address and the full request may be written to the server's error log.
These records are deleted after 14 days.
To limit abuse, your IP address is also processed briefly in server memory; this does not create a permanent record.

The legal basis is our legitimate interest in operating the website securely (Article 6(1)(f) GDPR).

When you submit the request form

Data processed:

request type, full name, company, email,
optionally phone, sector, approximate tag count and the protocols you use,
your description of your needs,
technical information: page language, version of the privacy notice shown, submission time, the page where the form was opened, campaign parameters if present (utm_source, utm_medium, utm_campaign) and the domain of the referring website.

The time the form was opened is used only to detect automated submissions and is not stored.

We process this data to answer your request, plan a demo meeting and prepare a quote. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). If you submit the form on behalf of a company, the legal basis is our legitimate interest in communicating with your company (Article 6(1)(f) GDPR). Your data is not used for marketing and is not sold to third parties.

When you email us

We process your email address, your name and the content of your message to answer you. The legal basis is taking steps before entering into a contract (Article 6(1)(b) GDPR) or our legitimate interest in answering your inquiry (Article 6(1)(f) GDPR). Correspondence goes through Hostinger International Ltd. (Larnaca, Republic of Cyprus), which provides our email service as a processor. Hostinger's data processing addendum of 29 September 2026 contains the EU standard contractual clauses for transfers to its sub-processors outside the EU (which include service providers in the USA); you can read it at https://www.hostinger.com/legal/dpa. We keep correspondence for 2 years from the last message and then delete it from our mailbox. Correspondence that leads to a contract is kept for the period set by the Turkish Commercial Code (10 years); the legal basis for this is our legitimate interest in complying with the legal obligation that applies to us (Article 6(1)(f) GDPR). Please do not send special categories of personal data (for example health information) by email.

Support requests and the customer portal (support.2winscada.com)

We provide technical support to our customers through messages sent to our support email address and through the customer portal at support.2winscada.com. The support system runs on the open-source software Zammad, on servers in our company's office in Türkiye.

Data processed:

name, email address, company and, if you provide it, phone number,
the subject of your request, the correspondence and the files you send (for example screenshots and log files),
internal notes added by our support team and request details (ticket number, status, dates, request type),
your portal account: email address, name, company, a one-way hash of your password and the time of your last sign-in,
technical records: IP address, time, browser information, sign-in attempts and the devices you signed in from (browser, operating system, IP address); audit records on account security (for example a change of your password by someone else or an authorized employee switching to your account; account ID and name, action, time, source IP address),
for paid services (hourly services and prepaid service hour packages), time records: the subject of the service, the date of the work, the time worked and the work class (remote or on site; within or outside office hours, or on a public holiday).

We process this data to answer your support request, solve license and installation problems and keep track of support cases. The legal basis is the performance of the contract between you or your company and us (Article 6(1)(b) GDPR). If you write as an employee of a company that is our customer, the legal basis is our legitimate interest in supporting our customer (Article 6(1)(f) GDPR). The legal basis for the technical records is our legitimate interest in operating the system securely (Article 6(1)(f) GDPR).

We process the time records of paid services to invoice the service and to keep track of the hours deducted from a prepaid service hour package. The legal basis is the performance of the contract between you or your company and us (Article 6(1)(b) GDPR); if you are an employee of a company that is our customer, it is our legitimate interest in performing our contract with our customer (Article 6(1)(f) GDPR). After each month has closed, a monthly service hours report with detail and summary lines per customer is prepared from the time records. The report contains your company name (or, if the ticket is not linked to a company, the email address or customer number of the requester), the ticket number, the date of the work, the work class and its coefficient, the actual and the invoiced hours, the hours deducted from the package, the hourly rate, the currency and the amount, as well as automatic notes on the calculation (for example a warning about a missing or changed tariff); it does not contain any correspondence, the subject of the service or the identities of our employees. As a commercial document supporting the invoice, the report is kept separately from the support system and is not disclosed outside our company except where the law requires it (for example in a tax audit). The legal basis for keeping the report is our legitimate interest in complying with a legal obligation that applies to us (Article 6(1)(f) GDPR).

A portal account can be created by our invitation or while support emails are processed; this applies not only to the sender of a message but also to the people in its To and CC fields. Accounts created this way have no password; to use the portal you set one through a link sent to your email address. You cannot register yourself. In the portal you only see your own requests, not those of colleagues in the same company.

Messages you send to our support address, the replies we give by email and the emails sent by the system are delivered through our email provider Hostinger (see above). Incoming messages are deleted from the mailbox at Hostinger as soon as they have been taken into our support system; after an outage, or if a message is very large, they may stay there longer. To reduce the data sent by email, our automatic replies and portal notifications only contain the ticket number and a link to the portal, not the content of messages or attachments, and no automatic full quote of your earlier message is added to our replies. When the correspondence and attachments are handled through the portal and our support team also replies in the portal, this content is not sent by email. When you sign in to the portal from a new device, a notification email containing the device type and IP address is sent to protect your account.

Retention:

Support tickets and attachments: closed tickets are deleted automatically 2 years after the latest of the closing, the last correspondence and the last update of the ticket, internal notes included. For a reopened ticket, the period is assessed again once it is closed. Tickets that must be kept because of a legal dispute or a legal obligation are kept for as long as this requires.
Customer accounts: customer accounts whose last support ticket has been deleted are checked and deleted; the records of devices used to sign in are deleted with the account.
Time records: time records in the support system are deleted together with the ticket they belong to.
Service hours reports: monthly reports used as supporting documents for billing are kept for 10 years from the end of the calendar year in which they were created, under Article 82 of the Turkish Commercial Code. Once the report file has been transferred to an area with restricted access on the backup server in our office in Türkiye, the copy on the support server is deleted. Reports are deleted within 3 months after their retention period expires.
Technical records: web server access logs are kept for 14 days and the system's activity stream for 3 months. Audit records on account security are kept until the end of their 12-month retention period, even if the account is deleted. Old application log entries are deleted as the configured size limit is reached.
Backups: encrypted backups of the support system are kept on the backup server in our office in Türkiye. In the normal backup retention cycle, backup copies of deleted data are removed within 71 days; technical problems may extend this period.
Copies at the email provider: copies remaining in the provider's own logs and backups are deleted according to the provider's retention schedule.

Where and for how long

The website, the form and request records are processed on servers in our company's office in Türkiye. Encrypted backups are kept on the backup server in the office and on an encrypted disk stored outside the office, in Türkiye.
There is no EU Commission adequacy decision for Türkiye. When you submit the form, you send your data directly to us. When you email us, the correspondence is processed on our email provider's servers (see above).
Requests: kept for 12 months from the date they are received, then deleted. Deleted records stay in encrypted backups for at most 6 more months and are then destroyed with those backups.
Temporary queue: a submitted request waits on the internet-facing server until it is transferred to our internal system, and is deleted there once transferred. Records that cannot be transferred are set aside for review and deleted automatically 30 days after they were set aside.
Submission receipt: to prevent the same request from being stored twice, the submission ID and a keyed hash (HMAC) of the content are kept for 7 days. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
Deletion record: for a deleted request, its ID, the deletion time and the reason are kept for 18 months, without the request content; the same details are also recorded by an internal email notification sent to our mailbox at Hostinger, where it is likewise kept for 18 months. This record ensures that a deleted request does not reappear after a restore from backup. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Recipients

Within our company, only our sales and operations staff have access to requests, only our support team has access to support tickets, and only our staff responsible for invoicing have access to service hours reports. Hostinger International Ltd. and its sub-processors provide our email service as processors; email correspondence and internal notifications are processed on their servers. The internal notification email sent for a new request does not contain the request content. Where the law requires it, data may be shared with competent public authorities. No automated decision-making or profiling takes place.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to have its processing restricted, and to receive your data in a portable format.

Right to object: You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Article 21 GDPR).

You can lodge a complaint with the data protection supervisory authority in your country. To exercise your rights: info@turkuvazinovasyon.com.

Filling in the form is voluntary. If the required fields are not filled in, we cannot receive your request through the form; you can also email us.

www.2winscada.com

This website does not use cookies.
There are no analytics, advertising or tracking tools, external scripts, CAPTCHA or embedded videos.
If you choose the light or dark theme yourself, the choice is stored only in your browser (localStorage) and is not sent to the server.
While the form is being submitted, only a submission ID is kept in the browser session (sessionStorage) until the server responds. It prevents the same request from being stored twice. Form content is not stored in your browser.

Customer portal (support.2winscada.com)

When you sign in, the portal uses a strictly necessary session cookie to recognize your session (its name starts with _zammad_session_). The cookie only holds a random session ID; the session data is kept on our server. The cookie is only sent over encrypted connections and cannot be read by scripts on the page.
The cookie is deleted when you close your browser. If you tick "Remember me" when signing in, it is kept for at most 1 year; if you do not use the portal for 7 days, your session ends anyway and you have to sign in again.
The portal keeps your interface preferences in your browser's local storage (localStorage) and temporary interface data in session storage (sessionStorage); session storage is cleared when you sign out.
This cookie and storage are strictly necessary for the portal to work; they serve no analytics, advertising or tracking purpose. The portal does not load external scripts or tracking tools.