Privacy Notice

The Turkish version of this text is authoritative. This translation is provided for information purposes. In case of any discrepancy, the Turkish text shall prevail.

This notice has been prepared to explain how we process your personal data, in accordance with Article 10 of Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

1. Data controller

FIX’s Kayseri office is a branch of FIX. The office in the USA bearing the FIX name is a separate company, and the personal data described in this notice is not transferred to that company.

2. Who does this notice cover?

• Persons who fill in the forms on our website (pre-assessment, contact),
• Persons who write to our WhatsApp line or whose request we respond to via WhatsApp,
• Persons who use the AIx® Incentive Robot,
• Persons who fill in Meta (Facebook/Instagram) ad forms,
• Company representatives we contact for the first time by e-mail or LinkedIn,
• Representatives and employees of our clients, suppliers and business partners,
• Visitors to our website.

There is a separate privacy notice for our job applicants: Privacy Notice for Job Applicants. Our employees are informed separately when they join.

3. What data do we process, for what purposes and on what legal bases?

3.1 Requests received via forms, WhatsApp and the AIx® Incentive Robot

Data processed:

• Identity: first name, surname.
• Contact: phone number, e-mail address; your profile name on WhatsApp.
• Company information: company name; your answers to questions such as sector, employee range, turnover range, export status and the service you are interested in; your answers to the investment and activity questions in the AIx® Incentive Robot and the programme matches the robot shows.
• Correspondence content: your form message and your WhatsApp correspondence.
• Marketing/attribution information: the identifier of the ad or source that brought you to our site (e.g. Google Ads or Meta click identifier, source, medium, campaign name, keyword, ad content, the page opened through that link).

Purposes:

• Responding to your request, calling you or writing to you,
• Pre-assessing the services and support programmes suitable for your company,
• Conducting meetings and the proposal process,
• Prioritising requests: an automated pre-assessment score is calculated from your answers. This score determines whether our specialist or our WhatsApp assistant responds to your request first. The score does not prevent you from receiving services and does not by itself produce a decision against you; every request receives a response.
• Measuring which ads and channels result in requests,
• Recording the contact details you share in the first step of the pre-assessment form even if you do not complete the form, contacting you once by phone or WhatsApp so that you can complete your application, and sending a one-time code to verify your e-mail address.

Legal bases:

• Taking the necessary steps prior to the establishment of a contract, at your request (KVKK Article 5(2)(c)),
• Our legitimate interests, such as responding to requests in an orderly and prompt manner and measuring our services and ads, provided that such interest does not harm your fundamental rights and freedoms (KVKK Article 5(2)(f)).

WhatsApp assistant: The first responses on our WhatsApp line are given by an assistant that asks predefined questions and interprets free-text answers with the help of artificial intelligence. Conversations are recorded and can be viewed by our specialists. Voice messages are not transcribed and their content is not processed; in that case, the assistant asks you to send your message in writing. You can end the conversation at any time by writing "çıkmak istiyorum" (I want to leave); your number is kept on an opt-out list so that no further messages are sent to you.

AIx® Incentive Robot: The robot’s programme matching works with rules prepared by FIX; artificial intelligence is not used. When you enter your contact details to share the robot’s results with our specialist, your answers and the matches are recorded in FIX’s e-mail inbox and in our WhatsApp assistant’s database. If you tick the "WhatsApp üzerinden bilgilendirilmek istiyorum" (I would like to be informed via WhatsApp) box on the form, we will also write to you via WhatsApp; if you do not tick it, we will not.

3.2 Meta ad forms

When you fill in ad forms on Meta (Facebook/Instagram), your name, phone, e-mail and your answers to the form questions are forwarded to us. The purposes and legal bases are the same as in 3.1. The form is collected by Meta; Meta’s privacy policy applies to Meta’s own processing.

3.3 Company representatives we contact for the first time by e-mail or LinkedIn

Data processed: first name, surname, business e-mail address, phone (if available), job title, the company you work for, the link to your public professional profile (e.g. LinkedIn), your reply to our message.

Source: public professional sources (company websites, professional networks such as LinkedIn; public profile information on LinkedIn is obtained via Apify) and the business contact data provider Lusha.

Purpose: to introduce our services to your company by e-mail and LinkedIn message and, where appropriate, to schedule a meeting. An artificial intelligence service is used to prepare message drafts.

Legal basis: our legitimate interest in carrying out commercial promotion aimed at companies (KVKK Article 5(2)(f)). We send commercial electronic messages to company addresses within the framework of Law No. 6563 and the provision of the Regulation on Commercial Communication and Commercial Electronic Messages concerning merchants and tradespersons. These addresses are registered in the Message Management System (İYS). Every message contains a free means of opting out; sending is stopped upon opt-out notifications submitted via İYS or directly to FIX.

Objection: If you no longer wish to receive messages, it is sufficient to write "istemiyorum" (I do not want this) in reply to our message or to opt out via İYS. Your address is kept on an opt-out list solely to ensure that we do not write to you again.

3.4 Ad targeting with lookalike audiences (Meta)

The first name, surname, e-mail, phone and country of our clients, of persons who leave a request and of company representatives contacted as described in 3.3 are uploaded to the Meta ads manager to create a "lookalike audience" on Meta. During upload, the information is converted into a hash value in the browser by Meta’s tool. Meta matches these values with its own users and uses them to show our ads to people with similar profiles.

Purpose: to show our ads to company representatives with a high likelihood of being interested. Legal basis: our legitimate interest in running our ads effectively (KVKK Article 5(2)(f)). Objection: You may object to this use by the means set out in section 9; when you object, your information is removed at the next audience update.

Your e-mail or phone information is not sent to Google Ads.

3.5 Representatives and employees of our clients, suppliers and business partners

Data processed: identity (first name, surname; Turkish identity number (T.C. kimlik no.) where required by the application file), contact details, job title, signature circular, financial information (invoices, bank account details), personal data in contract and project documents (e.g. personnel information required for a support application), meeting notes.

Purposes: establishment and performance of the contract; preparation of grant, incentive and support applications and their submission to the relevant public institutions; invoicing and accounting; fulfilment of legal obligations; protection of rights in disputes; reporting a request that becomes a client to advertising platforms as a conversion (to Meta with the request identifier and contract value, and to Google Ads with the click identifier; name, e-mail and phone, which directly identify the person, are not sent in this report).

Legal bases: establishment or performance of the contract (Article 5(2)(c)), legal obligation (Article 5(2)(ç): Turkish Commercial Code, Tax Procedure Law, etc.), establishment, exercise or protection of a right (Article 5(2)(e)), legitimate interest (Article 5(2)(f)).

With regard to the personal data of their own employees that our clients provide to us for the application file, our client is also a data controller; informing these persons is our client’s obligation. If a support programme requires special categories of personal data (e.g. disability status), such data is processed only where one of the conditions in KVKK Article 6(3) exists and subject to the additional measures determined by the Personal Data Protection Board.

3.6 Website visitors

Data processed: IP address, browser and device information, pages visited, interactions such as clicks and scrolling, cookie identifiers.

Purposes and legal bases:

• Operation and security of the site (necessary cookies, server logs, and the Google reCAPTCHA and Cloudflare Turnstile checks on forms that tell automated submissions apart): legitimate interest (Article 5(2)(f)).
• Analytics and marketing tools: Google Analytics and Microsoft Clarity (measuring how the site is used; with Clarity, analysing site usability through session recording and heatmaps), Google Ads and Meta Pixel (measuring ad clicks and conversions, remarketing on Meta; including the random identifier set by FIX to match the visitor in Meta measurement, fix_ext_id) and FIX’s attribution cookies fix_atif, fix_gclid, fix_gbraid and fix_wbraid (recording which source and ad your request came from, attributing the ad conversion to the correct campaign; fix_atif carries the source, medium, campaign, keyword and ad content information, the Google Ads and Meta click identifiers and the path of the page opened through that link, and the other three carry the Google Ads click identifier). The legal basis depends on the region from which you visit the site. For visits from Türkiye and other countries, these tools run until you reject them; FIX bases this processing on its legitimate interest (Article 5(2)(f)) in measuring the use of its website and the results of its ads and in recording the source of requests. For visits from EU/EEA countries, the United Kingdom and Switzerland, these tools run only with the permission you give in the cookie panel; the basis is your explicit consent (Article 5(1)). In both cases, you can reject them or withdraw the consent you have given at any time. Use the “Reject all” button in the cookie panel or the “Cookie preferences” link at the bottom of the page. When you reject, the relevant tools stop and the cookies these tools set on our site’s domain, listed in the Cookie Policy, are deleted.
• YouTube thumbnails: in the reference sections with videos, video thumbnails are loaded as the page opens, before you click the play button, from Google’s i.ytimg.com server; this request sends your IP address and browser information to Google. The video is loaded only when you click. Legal basis: our legitimate interest in presenting our reference videos (Article 5(2)(f)).

Detailed list: Cookie Policy.

4. How do we collect personal data?

• Forms on our website, the AIx® Incentive Robot and WhatsApp correspondence (electronic, partly automated),
• If a form on our website cannot reach us due to a connection or server error, the information you entered is stored only in your own device’s browser for up to 72 hours and is automatically resent to us once a connection is available; it is deleted from your device when the submission is completed or when this period expires. You can delete this record at any time by clearing your browser’s site data.
• Meta ad forms (electronic, via Meta),
• Phone calls, e-mail, meetings and contracts (oral, written, electronic),
• Cookies and similar technologies (automated),
• Public professional sources, Apify and Lusha (see 3.3).

5. To whom do we transfer personal data?

Your personal data may be transferred to the following recipient groups, limited to the purposes above and in accordance with KVKK Articles 8 and 9:

We do not sell your data.

6. Transfers abroad

The servers or headquarters of the providers listed in section 5 are located outside Türkiye: our website’s server is in the Netherlands, the bot database is in Germany (Frankfurt), and the other providers are mainly in the European Union and the United States of America. Your personal data is therefore transferred abroad.

As the Personal Data Protection Board has not yet issued an adequacy decision for any country, we carry out these transfers on the basis of the standard contracts announced by the Board under KVKK Article 9(4)(c). The standard contracts have been signed and notified to the Personal Data Protection Authority under KVKK Article 9(5).

7. How long do we retain it?

When the period expires, your data is erased, destroyed or anonymised in accordance with our Personal Data Retention and Destruction Policy.

8. Your rights (KVKK Article 11)

By applying to FIX, you have the following rights:

a) to learn whether your personal data is processed, b) to request information about it if it has been processed, c) to learn the purpose of processing and whether the data is used in accordance with that purpose, ç) to know the third parties to whom it is transferred domestically or abroad, d) to request rectification if it has been processed incompletely or inaccurately, e) to request erasure or destruction within the framework of the conditions in KVKK Article 7, f) to request that the operations carried out under sub-paragraphs (d) and (e) be notified to the third parties to whom the data has been transferred, g) to object to a result arising against you through the analysis of the processed data exclusively by automated systems, ğ) to request compensation for the damage if you suffer damage due to unlawful processing.

You may withdraw your consent for processing based on explicit consent at any time; withdrawal does not affect the lawfulness of prior processing.

9. How to apply

You may submit your application in Turkish, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by one of the following means:

• In writing: send your petition bearing your wet signature by post, courier, through a notary or by hand to the following address: FIX Danışmanlık Anonim Şirketi, Çukurambar Mahallesi 1480. Sokak No: 2A İç Kapı No: 70, Besa Kule İş Merkezi A Blok, 06510 Çankaya / Ankara. We kindly ask you to write "Kişisel Verilerin Korunması Kanunu Kapsamında Bilgi Talebi" (Request for Information under the Personal Data Protection Law) on the envelope.
• By registered electronic mail (KEP): fixconsultingdanismanlik@hs01.kep.tr

Your application must include your first name, surname, your signature for written applications, your Turkish identity number (if you are a foreign national, your nationality and passport number or identity number), your residential or business address for service of notices, your e-mail address for notifications if any, your phone or fax number, and the subject of your request. Please attach the information and documents relating to the application.

We conclude your application free of charge as soon as possible according to the nature of the request and within 30 days at the latest. If the procedure requires an additional cost, the fee in the tariff determined by the Board may be charged. If your application is rejected, if you find the response insufficient or if no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning of the response and, in any event, within 60 days of the application date (KVKK Article 14).