Skip to main content
2WinScada
Request a demo

Privacy notice

Version: 2026-10-26

This notice is provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) to inform people who visit www.2winscada.com, submit the request form, email us or, as our customer, use our support system and customer portal (support.2winscada.com).

Data controller

  • Company name: Turkuvaz İnovasyon Sistem Çözümleri Endüstriyel Otomasyon Yazılım Mühendislik Danışmanlık Sanayi ve Ticaret Anonim Şirketi (Turkuvaz İnovasyon A.Ş.)
  • Address: Yıldırım Beyazıt Mah. Aşık Veysel Bul. No: 63-O, Melikgazi/Kayseri, Türkiye (Erciyes Teknopark, Mekanik Kuluçka)
  • MERSİS number: 0871051609800016
  • Email: info@turkuvazinovasyon.com
  • KEP (registered electronic mail) address: turkuvazinovasyon@hs02.kep.tr

Personal data processed

  • Identity: full name.
  • Contact: email address, optional phone number.
  • Customer transaction: company, request type, sector, approximate tag count, protocols used, your description of your needs, the content of email correspondence, page language, version of the privacy notice shown, submission time, the page where the form was opened, campaign parameters if present and the domain of the referring website.
  • Support: company, the subject of the support request, correspondence and attachments (for example screenshots and log files), internal notes of our support team and request details (ticket number, status, dates, request type); portal account (email address, name, company, a one-way hash of the password, time of the last sign-in).
  • Finance: for paid services (hourly services and prepaid service hour packages), the subject of the service, the date of the work, the time worked and the work class; in the monthly service hours report, the company name (or, if the ticket is not linked to a company, the email address or customer number of the requester), the ticket number, the date of the work, the work class and its coefficient, the actual and the invoiced hours, the hours deducted from the package, the hourly rate, the currency, the amount and automatic notes on the calculation.
  • Transaction security: IP address, access time, path of the requested page, referring page and browser information; in case of an error, the full request; sign-in attempts, the devices used to sign in (browser, operating system, IP address), the session cookie in the support portal; audit records on account security (for example a change of your password by someone else or an authorized employee switching to your account; account ID and name, action, time, source IP address).

The time the form was opened is used only to detect automated submissions and is not stored.

Purposes of processing

  • To receive and assess your demo and quote request or your email, get back to you and prepare a quote.
  • To keep the website and the form secure, prevent abuse and prevent the same request from being stored twice.
  • To ensure that deleted requests do not reappear after a restore from backup.
  • To provide technical support to our customers, solve license and installation problems and keep track of support cases; to operate the customer portal and keep it secure.
  • To invoice paid services, keep track of the hours deducted from a prepaid service hour package and keep the commercial documents supporting the invoice for the period required by law.
  • To answer data subject requests and meet legal obligations.

The data is collected electronically, partly by automated means, through the request form, email, the support portal and server records.

  • Form and email data: the processing is directly related to the quote you requested and to entering into a possible contract (KVKK Article 5(2)(c)). If you send the form or the email on behalf of a company: our legitimate interest in communicating with your company (KVKK Article 5(2)(f)).
  • Support data: the processing is directly related to the performance of the contract between you or your company and us (KVKK Article 5(2)(c)). If you are an employee of a company that is our customer: our legitimate interest in supporting our customer (KVKK Article 5(2)(f)).
  • Time records and service hours reports: the processing is directly related to the performance of the contract between you or your company and us (KVKK Article 5(2)(c)); if you are an employee of a company that is our customer: our legitimate interest in performing our contract with our customer (KVKK Article 5(2)(f)); keeping the reports for the period required by law: compliance with our legal obligation (KVKK Article 5(2)(ç)).
  • Security records, submission receipt and deletion record: our legitimate interest, provided that it does not harm your fundamental rights and freedoms (KVKK Article 5(2)(f)).
  • Answering requests: meeting our legal obligation (KVKK Article 5(2)(ç)).

No processing in this scope relies on your explicit consent. Requesting a quote does not add you to a newsletter or marketing list.

Transfers

  • Within our company, only our sales and operations staff have access to your request data, only our support team has access to support tickets, and only our staff responsible for invoicing have access to service hours reports. Service hours reports are not disclosed outside our company except where the law requires it (for example in a tax audit). Where the law requires it, the data may be shared with competent public authorities.
  • The website, the form and request records are kept on servers in our office in Türkiye; their encrypted backups are kept on the backup server in the office and on an encrypted disk stored outside the office, in Türkiye. Support records and the encrypted backups of the support system are kept in our office in Türkiye; the support system runs on the open-source software Zammad.
  • Email and transfers abroad: Hostinger International Ltd. (Larnaca, Republic of Cyprus) provides our email service as a data processor. Emails you send us, our replies and our internal notification emails are processed on servers of Hostinger and its sub-processors (which include service providers in the USA) outside Türkiye. The data transferred this way is your name, email address, phone number if given and the content of the correspondence; internal notifications do not contain request content. The purpose of the transfer is to handle the correspondence.
  • In our company's assessment, the transfer is necessary for taking pre-contractual measures at your request (KVKK Article 9(6)(b)). There is no standard contract under KVKK between Hostinger and us; Hostinger's data processing addendum of 29 September 2026 (https://www.hostinger.com/legal/dpa) contains only the EU standard contractual clauses.
  • Support emails: messages you send to our support address, the replies we give by email and the emails sent by our support system are also delivered through Hostinger. Incoming messages are deleted from the mailbox at Hostinger as soon as they have been taken into our support system; after an outage, or if a message is very large, they may stay there longer. Our automatic replies and portal notifications only contain the ticket number and a link to the portal, not the content of messages or attachments, and no automatic full quote of your earlier message is added to our replies. The security notification sent when someone signs in to the portal from a new device contains the device type and IP address. In our company's assessment, this transfer is necessary for the performance of the contract between you or your company and us (KVKK Article 9(6)(b)). When the correspondence and attachments are handled through the customer portal and our support team also replies in the portal, this content is not sent by email and therefore not transferred abroad this way.
  • Please do not send special categories of personal data (for example health information) by email or in a support request.

Retention and destruction

  • Requests: 12 months from the date they are received, then deleted. They can be deleted earlier at your request.
  • Backups: deleted requests stay in encrypted backups for at most 6 more months and are then destroyed with those backups.
  • Temporary queue: after the form is submitted, the request waits on the internet-facing server until it is transferred to our internal system, and is deleted there once transferred. Records that cannot be transferred are set aside for review and deleted automatically 30 days after they were set aside.
  • Submission receipt: the submission ID and a keyed hash (HMAC) of the content, 7 days.
  • Deletion record: the ID of a deleted request, the deletion time and the reason, without the request content, 18 months. The same details are also recorded by an internal email notification sent to our mailbox at Hostinger, where it is likewise kept for 18 months.
  • Server records: 14 days.
  • Support tickets and attachments: closed tickets are deleted automatically 2 years after the latest of the closing, the last correspondence and the last update of the ticket, internal notes included. For a reopened ticket, the period is assessed again once it is closed. Tickets that must be kept because of a legal dispute or a legal obligation are kept for as long as this requires. Customer accounts whose last support ticket has been deleted are checked and deleted; the records of devices used to sign in are deleted with the account.
  • Time records: time records in the support system are deleted together with the ticket they belong to.
  • Service hours reports: monthly reports used as supporting documents for billing are kept for 10 years from the end of the calendar year in which they were created, under Article 82 of the Turkish Commercial Code. Once the report file has been transferred to an area with restricted access on the backup server in our office in Türkiye, the copy on the support server is deleted. Reports are deleted within 3 months after their retention period expires.
  • Technical records of the support system: web server access logs are kept for 14 days and the system's activity stream for 3 months. Audit records on account security are kept until the end of their 12-month retention period, even if the account is deleted. Old application log entries are deleted as the configured size limit is reached.
  • Backups of the support system: encrypted backups of the support system are kept on the backup server in our office in Türkiye. In the normal backup retention cycle, backup copies of deleted data are removed within 71 days; technical problems may extend this period.
  • Email correspondence: 2 years from the last message, then deleted from our mailbox. Correspondence that leads to a contract is kept for the period the Turkish Commercial Code sets for business correspondence (10 years). Copies left in the provider's own backups are deleted under the provider's retention rules.

Your rights

Under KVKK Article 11 you have the right to:

  • learn whether your personal data is processed and, if so, request information about it,
  • learn the purpose of processing and whether the data is used for that purpose,
  • know the third parties in Türkiye or abroad to whom the data is transferred,
  • ask for the data to be corrected if it is incomplete or inaccurate,
  • ask for the data to be deleted or destroyed under the conditions of KVKK Article 7,
  • ask for correction, deletion and destruction to be notified to third parties to whom the data was transferred,
  • object to a result against you that arises from analysis exclusively by automated systems,
  • claim compensation if you suffer damage because of unlawful processing.

How to apply

You can apply, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, by:

We conclude your application free of charge within 30 days at the latest. If the action involves an additional cost, a fee may be charged according to the tariff set by the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).