Privacy & Data Protection Policy
Last updated: October 2026 | Compliant with GDPR (EU) and KVKK (Law No. 6698, Turkey)
1. Introduction and Data Controller
ValuePath ("we," "our," or "us") is fully committed to protecting and respecting your privacy. This Privacy Policy outlines how we collect, use, store, process, and protect your personal data when you visit our website or interact with our enterprise consultancy services.
In compliance with the **EU General Data Protection Regulation (GDPR)** and the Turkish **Personal Data Protection Law No. 6698 (KVKK)**, ValuePath acts as the **Data Controller** (Veri Sorumlusu). If you have questions regarding your data rights, you can reach out directly via our contact channels.
2. Categories of Personal Data We Collect
We collect personal data that you explicitly provide to us, as well as automated technical telemetry when browsing:
- Identity and Contact Data: Full name, corporate email address, telephone number, and company name submitted through our consultation forms.
- Technical and Device Data: IP address, browser type, operating system, time zone settings, and referral URLs gathered via secure cookies and server logs.
- Interaction Data: Correspondence logs when you communicate with our enterprise architects or support desks.
3. Legal Bases and Purposes of Processing
We process your personal data under strict lawful bases defined by GDPR Article 6 and KVKK Article 5 & 6:
- Explicit Consent (Açık Rıza): When you submit forms or subscribe to insight newsletters.
- Performance of a Contract: To deliver requested enterprise cloud architecture, security audits, or scheduled consultations.
- Legitimate Interests: To secure our infrastructure, monitor web performance, and prevent fraudulent submissions.
- Legal Obligations: Compliance with financial, tax, and regulatory mandates under applicable European and Turkish legislation.
4. International Data Transfers
As an enterprise platform operating across hybrid cloud environments, your data may be processed or stored on secure servers located within the European Union (EU) and Turkey. Any cross-border data transfers are safeguarded using standardized contractual clauses (SCCs) and robust technical controls (such as end-to-end encryption and zero-trust mechanisms) ensuring equivalent legal protection under both GDPR and KVKK frameworks.
5. Your Data Subject Rights
Under GDPR (Chapter III) and KVKK (Article 11), you hold comprehensive rights regarding your personal data, including:
Right to Access & Rectification
Request confirmation of whether we process your data, obtain a copy, or ask for corrections to inaccurate information.
Right to Erasure ("Right to be Forgotten")
Request the deletion or destruction of your personal data where there is no compelling reason for its continued processing.
Right to Restriction & Objection
Object to processing based on legitimate interests or request restricted processing under specific scenarios.
Data Portability & Complaints
Receive your data in a structured format or lodge a complaint with supervisory bodies (e.g., the Turkish Personal Data Protection Authority - KVKK, or EU Data Protection Authorities).
6. Contact and Data Requests
To exercise any of your statutory rights under GDPR or KVKK, or for any privacy-related inquiries, please submit a formal written request via our main portal or contact our data protection representatives. We respond to all verified requests within thirty (30) days in accordance with statutory deadlines.