Personal Data Protection and Processing Policy

1. Purpose

The purpose of this policy is to set out the main principles for personal data processing by NERA REKLAM PAZARLAMA YAZILIM TEKNOLOJİ LİMİTED ŞİRKETİ (“the Company” or “Nera Innovations”) in line with Law No. 6698 on the Protection of Personal Data and related legislation.

Nera Innovations operates in AI-supported sales systems, B2B customer acquisition, sales automation, conversion optimisation, AI search visibility (GEO), digital marketing and software technology.

This policy explains the principles under which personal data is processed, protected, transferred and, where required, destroyed in those activities.

2. Scope

This policy covers personal data of Nera Innovations customers, prospective customers, business partners, suppliers, employees, employee candidates, company officers, website visitors and other natural persons contacted in the course of commercial activity.

Personal data may be processed by automatic means or, where it forms part of a data recording system, by non-automatic means.

3. Responsibilities

Nera Innovations employees, managers and persons involved in personal data processing are responsible for applying this policy within their duties and authority.

The Company is obliged to take the necessary technical and organisational measures for the protection of personal data.

4. Definitions

Personal Data: Any information relating to an identified or identifiable natural person.

Data Subject: The natural person whose personal data is processed.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data.

Data Processor: The natural or legal person who processes personal data on behalf of the data controller, based on the authority given by the controller.

Processing of Personal Data: Operations performed on data such as obtaining, recording, storing, using, transferring, classifying or deleting personal data.

Explicit Consent: Consent relating to a specific subject, based on being informed, and expressed of free will.

Anonymisation: Making personal data impossible to associate with an identified or identifiable natural person in any way.

5. Processing of personal data

5.1. Main principles. Nera Innovations processes personal data in line with: lawfulness and fairness; being accurate and, where necessary, up to date; processing for specified, explicit and legitimate purposes; being relevant, limited and proportionate to the purpose; and being stored only for the period laid down in law or required by the purpose.

5.2. Personal data that may be processed. Depending on the Company’s activities and the relevant process, the categories below may be processed. Not every category is processed for every data subject. Data processed is limited to what the activity requires.

Identity data: Name, surname, title.

Contact data: Corporate email address, phone number and correspondence address.

Professional data: Employer, role, department and professional position.

Customer transaction data: Service requests, proposal processes, contracts and customer communication records.

Digital interaction data: Website visits, user interactions and analytics obtained in line with applicable law.

Transaction security data: System access logs and technical data kept for security.

5.3. Purposes of processing. Where a legal condition for processing exists, personal data may be processed to: run customer and partner relationships; assess service requests and prepare proposals; run contract processes; carry out B2B sales development and corporate communication; operate AI-supported sales and marketing systems; analyse digital marketing and campaign performance; improve website performance and user experience; maintain information security; and meet legal and commercial obligations.

Commercial electronic messages, cookies and marketing processing follow the consents and other conditions required by law.

6. Legal grounds for processing

Nera Innovations processes personal data on the conditions in Article 5 of the KVKK that fit the relevant activity.

Those conditions include processing clearly provided for by law; being necessary for establishing or performing a contract; fulfilling a legal obligation; establishing, exercising or protecting a right; and the controller’s legitimate interests, provided the data subject’s fundamental rights and freedoms are not harmed.

Where the law requires explicit consent, that consent is obtained.

Special categories of personal data may be processed only where the conditions in Article 6 of the KVKK are met and the required security measures are in place.

7. Protection of personal data

Nera Innovations takes appropriate technical and organisational security measures to prevent unlawful processing and unauthorised access.

Depending on the nature of the processing, this includes access authorisation, system security, informing employees, contractual security with processors, and necessary audits.

Access to personal data is limited to authorised persons who need it for their duties.

8. Transfer of personal data

Personal data may be transferred, in line with applicable law and with the necessary security measures, to competent public authorities, service providers, business partners and suppliers to the extent required by the purposes of processing.

Where personal data must be transferred abroad, the conditions in Article 9 of the KVKK and appropriate transfer mechanisms are followed.

Transfers involving software, cloud infrastructure, CRM, analytics and marketing platforms are assessed separately.

9. Storage and destruction

Personal data is stored for the period laid down in law or required for the purpose of processing.

When the storage period ends and the conditions for processing no longer apply, data is deleted, destroyed or anonymised in line with applicable law.

Storage and destruction follow Article 7 of the KVKK and the related regulation.

10. Rights of the data subject

Under Article 11 of the KVKK, data subjects may apply to the data controller and have the following rights.

To learn whether their personal data is processed.

To request information if it has been processed.

To learn the purpose of processing and whether it is used in line with that purpose.

To know the third parties to whom it is transferred in Turkey or abroad.

To request correction of incomplete or inaccurate data.

To request deletion or destruction of personal data within the legal conditions.

To request that correction and deletion be notified to third parties to whom the data was transferred.

To object to a result against them arising from analysis by exclusively automatic systems.

To claim compensation if they suffer damage due to unlawful processing.

11. How to apply

Data subjects may send KVKK requests to NERA REKLAM PAZARLAMA YAZILIM TEKNOLOJİ LİMİTED ŞİRKETİ by the methods set out in the legislation.

Data controller: NERA REKLAM PAZARLAMA YAZILIM TEKNOLOJİ LİMİTED ŞİRKETİ.

Website: https://www.nerainnovations.com.

Application email: info@nerasocial.com.

Applications are concluded as soon as possible and within 30 days at the latest, according to the nature of the request, under Article 13 of the KVKK.

12. Application and updates of this policy

In protecting personal data, Nera Innovations follows current legislation and the decisions of the Personal Data Protection Board.

This policy may be updated in line with changes in law or in the Company’s data processing processes.