Privacy Policy

HAFETECH operates through the entities listed below. The entity you deal with is the data controller for your personal data. In most cases this is the entity that contracts with you or the office you contact. Where entities jointly decide how data is used, they share responsibility for it.

Registered addresses for each entity are listed on our Company Information page at https://hafetech.net/legal. For general privacy questions, you can also write to [email protected].

This policy applies to personal data we process as a controller in connection with this website, business communications, client relationships, supplier relationships, and recruitment.

It does not cover personal data we process on behalf of our clients when we build or operate software for them. In those cases we act as a data processor, the client is the controller, and the client's own privacy notice applies.

Our products publish their own privacy notices on their websites. MCPCore and Kargorasyon are operated by HAFETECH. AviClass is operated by AVICENNA TECH. Please refer to the notice on each product website for details about data processed inside that product.

We do not intentionally collect special categories of personal data, such as health, religious, biometric, or political data, through this website. Please do not send us such data unless we specifically ask for it and explain why.

We only use personal data for clear and legitimate purposes. The legal basis depends on the purpose and on the law that applies to you.

Under Turkish law these bases correspond to the conditions in Article 5 of Law No. 6698, including the performance of a contract, legal obligations, the establishment or protection of a right, legitimate interests, and explicit consent. Under Indonesian law they correspond to the bases in Article 20 of Law No. 27 of 2022.

This website uses only strictly necessary storage by default. Analytics cookies from Google Analytics are set only after you accept them in the cookie banner. You can change your choice at any time through the Cookie Settings link in the footer.

Full details are available in our Cookie Policy at https://hafetech.net/legal/cookies.

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share personal data only in the following situations:

• With our affiliated entities in Türkiye, the United States, and Indonesia, when needed to respond to you or deliver a project.
• With service providers that host our website, provide email and productivity tools, measure website usage, or support accounting and payments. They may only use the data to provide services to us and are bound by confidentiality and data protection terms.
• With professional advisers such as lawyers, accountants, and auditors, under duties of confidentiality.
• With courts, regulators, law enforcement, or other public authorities, when required by law or to protect our rights.
• With a buyer or successor in the event of a merger, acquisition, or sale of assets, subject to equivalent protections.

Because we work across three countries and use cloud services, your personal data may be transferred to and stored in countries other than your own, including Türkiye, the United States, Indonesia, and member states of the European Union.

When we transfer personal data, we use the safeguards required by the applicable law. For data originating in Türkiye, transfers are made in line with Article 9 of Law No. 6698, for example on the basis of standard contracts approved by the Personal Data Protection Board and notified to the Authority where required. For data originating in the European Economic Area or the United Kingdom, we rely on adequacy decisions or standard contractual clauses. For data originating in Indonesia, we transfer data only to countries or recipients that provide an adequate level of protection or appropriate safeguards, or with your consent, as provided in Article 56 of Law No. 27 of 2022.

We keep personal data only for as long as we need it for the purposes described above, or for as long as the law requires.

When a retention period ends, we delete, destroy, or anonymize the data. In Türkiye this is carried out in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls based on least privilege, multi-factor authentication for internal systems, logging, and regular reviews. More information is available on our Security page at https://hafetech.net/legal/security.

No system is completely secure. If a personal data breach occurs, we will notify the competent authorities and affected individuals as required by law, including within 72 hours where Turkish or European rules apply and within 3 x 24 hours where Indonesian rules apply.

Depending on where you live, you may have some or all of the following rights:

• To know whether we process your personal data and to receive a copy of it
• To have inaccurate or incomplete data corrected
• To have your data deleted or anonymized
• To restrict or object to certain processing, including processing based on legitimate interests
• To receive your data in a portable format
• To withdraw consent at any time, without affecting processing that took place before
• To know the recipients and countries to which your data has been transferred
• To object to decisions made solely by automated means that significantly affect you
• To claim compensation for damage caused by unlawful processing

We do not make decisions about you based solely on automated processing.

Hafe Yazılım Limited Şirketi is the data controller for individuals in Türkiye under the Law on the Protection of Personal Data No. 6698 (KVKK). Our information notice prepared under Article 10 of KVKK is available in Turkish at https://hafetech.net/legal/kvkk.

You may submit requests under Article 11 of KVKK in writing or by email to [email protected], in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. We will respond free of charge within 30 days at the latest. If your request is rejected, our response is insufficient, or we do not respond in time, you may file a complaint with the Personal Data Protection Board.

HAFETECH LLC is the data controller for individuals in the United States. The categories of personal data we collect, their sources, the purposes of use, and the categories of recipients are described in sections 3 to 6 of this policy.

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act and similar state laws. We do not knowingly collect sensitive personal information through this website.

To the extent state privacy laws such as the California Consumer Privacy Act apply to us, residents of those states may request to know, correct, or delete their personal information and may appoint an authorized agent to make a request. We will verify requests before acting on them and will not discriminate against anyone for exercising their rights.

Do Not Track and Global Privacy Control: there is no common industry standard for Do Not Track signals, so this website does not change its behavior when it receives one. If your browser sends a Global Privacy Control signal, we treat it as a decision to reject analytics cookies. Third parties do not track visitors across other websites through this site.

Wyoming does not currently have a comprehensive consumer privacy law. We comply with applicable federal law and the breach notification laws of the states where affected individuals live.

AVICENNA TECH is the data controller for individuals who contact our Indonesia office or do business with it. We process personal data in accordance with Law No. 27 of 2022 on Personal Data Protection (UU PDP) and its implementing regulations, including Government Regulation No. 33 of 2026, which takes effect on 16 January 2027.

As a data subject in Indonesia, you have the rights listed in section 10, including the right to access, correct, delete, and restrict processing of your data and to withdraw consent. Requests can be sent to [email protected]. We will act on them within the time limits set by Indonesian law, which for some requests is 3 x 24 hours.

Personal data of children is processed only with the consent of a parent or legal guardian.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation or its equivalent may apply to our processing of your data. The legal bases we rely on are listed in section 4.

We will respond to requests within one month, which may be extended by two further months for complex requests. You also have the right to lodge a complaint with the data protection authority in the country where you live or work.

Send your request to the office that handles your data, or to [email protected] if you are not sure. Please tell us which right you want to exercise and include enough information for us to identify you. We may ask for additional information to verify your identity before we respond.

Requests are free of charge. Where a request is clearly unfounded or excessive, or where the law allows it, we may charge a reasonable fee or decline the request and explain why.

This website and our services are intended for businesses and adults. We do not knowingly collect personal data from children under 18 through this website. If you believe a child has sent us personal data, please contact us and we will delete it.

We may update this policy to reflect changes in our practices or in the law. The date at the top of this page shows when it was last updated. If we make significant changes, we will make them clear on this website.

For any question about this policy or our handling of personal data, contact the relevant office at [email protected], [email protected], or [email protected], or write to [email protected].