Privacy Notice

Identity of the data controller

The organization acting as data controller under this notice is GCS SİBER GÜVENLİK TEKNOLOJİLERİ VE DANIŞMANLIK HİZMETLERİ LİMİTED ŞİRKETİ, with MERSIS number 0389 1881 2100 0001 and registered address BARBAROS MAH. BEGONYA SK NİDAKULE ATAŞEHİR BATI NO:1 İÇ KAPI NO: 2 ATAŞEHİR / İSTANBUL.

For processes within the scope of the KVKK, you can contact us at [email protected].

Purposes of processing personal data

Your personal data is processed within the scope of evaluating applications submitted via our website, conducting contract negotiations, planning service delivery and performing the contract.

In addition, processing is carried out to ensure the security of the website, to fulfill legal obligations and to protect the rights and interests of Red in Pulse.

• Receiving, evaluating and responding to requests submitted via the discovery call form.
• Conducting pre-contract negotiation and proposal-preparation processes.
• When a contract is signed, planning, executing and reporting the offensive-security service.
• Evaluating expert-network applications and matching within the expert pool.
• Managing content-subscription requests and providing content delivery (if any).
• Receiving, evaluating and concluding applications under the KVKK.
• Technical operation of the website, ensuring its security and protecting cybersecurity (attack detection, log review).
• Fulfilling legal obligations in response to legislation or a request from an authorized body.

The processing purposes are defined as specific, explicit and legitimate; data is not processed beyond these purposes. In the event of a change of purpose, the disclosure obligation is fulfilled separately (Disclosure Communiqué Art. 5/2).

Categories of personal data processed

Your personal data is processed in the following categories, limited to the purpose of the relevant process.

• Identity data: first name, last name.
• Contact data: email, phone, the name of the organization you work for, your title.
• Professional-experience data: in expert-network applications, experience, area of expertise, certification and reference information.
• Customer/request transaction data: the scope, need and decision-context information you share during the discovery call.
• Transaction-security data: IP address, session information, website log records, cookie-preference records.
• Contract and delivery data: when a contract is signed, project scope, evidence-object delivery information and reporting records (only during the contract term).

As a rule, special categories of personal data (KVKK Art. 6) are not processed; if required by the contract, a separate disclosure is made and a lawful processing condition is ensured.

Recipient groups to which data is transferred and the transfer purpose

Your personal data may be transferred to the following recipient groups, only limited to the purpose of the relevant process, within the framework of Articles 8 and 9 of the KVKK.

• Suppliers and service providers: website hosting, email service, CRM, office software, analytics tools (bound by contract).
• Lawyers, financial advisors and auditors: within the scope of legal advice, financial obligations and audit processes.
• Authorized public institutions: in cases expressly stipulated by legislation and to fulfill a legal obligation.
• Business partners involved in contract performance: where mandatory for delivering the contracted offensive-security service, under confidentiality and security obligations.
• Communication and operations infrastructure: email, calendar, document and code-hosting services (provider list: [to be completed]).
• Analytics and observability services: site-traffic measurement, error tracking (provider list: [to be completed]).

Transfers abroad

For transfers abroad, the provisions of Article 9 of Law No. 6698 (as amended by Law No. 7499, in force as of 01.06.2024) and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (10.07.2024) apply.

Our transfers abroad are made primarily to countries with adequate protection declared by the Board; where this is not possible, standard contractual clauses accepted by the Board (SCC-1/2/3/4) are signed and the transfer is notified to the Board. Where these are not possible, explicit consent is obtained separately.

Collection method and legal basis

Your personal data is collected by automated or partly automated means through the discovery-call form on our website, the expert-network application form, email and telephone channels, and the cookie and log infrastructure.

During contract performance, data may also be collected through the channels and formats specified in the contract; such collection is subject to the contract terms.

The legal bases are determined according to the processing purpose from the provisions of Article 5/2 of the KVKK.

• Being directly related to the conclusion or performance of a contract (Art. 5/2-c): contract negotiation, proposal, service-delivery processes.
• Being mandatory for the fulfillment of a legal obligation (Art. 5/2-ç): tax, commercial law, KVKK retention obligations.
• Being mandatory for the establishment, exercise or protection of a right (Art. 5/2-e): legal dispute and defense processes.
• Being mandatory for the legitimate interest of the data controller (Art. 5/2-f): site security, fraud prevention, protecting content quality. In processing under this clause, the balance of not harming the data subject's fundamental rights and freedoms is observed.
• Explicit consent (Art. 5/1): marketing-purpose content delivery, non-mandatory cookies and special-category data processing - explicit consent is always obtained via a separate form (Board Principle Decision 2026/347).

Your rights as a data subject

Under Article 11 of the KVKK, by applying to the data controller you may exercise the following rights.

• To learn whether your personal data is being processed.
• If it has been processed, to request information about it.
• To learn the purpose of processing and whether it is used in accordance with that purpose.
• To learn the third parties to whom the data is transferred, domestically or abroad.
• To request correction if it has been processed incompletely or inaccurately.
• To request deletion or destruction within the conditions set out in Article 7 of the KVKK.
• To request that correction, deletion or destruction operations be notified to the third parties to whom the data has been transferred.
• To object to a result arising against you as a result of the data being analyzed exclusively by automated systems.
• To request compensation if you suffer damage due to unlawful processing in breach of the KVKK.

Application channels

To exercise your rights under Article 11 of the KVKK, you may apply through the following channels within the framework of the Communiqué on the Procedures and Principles for Applying to the Data Controller (Official Gazette 30356).

• Written application: with a wet-signed petition, in person or via a notary to BARBAROS MAH. BEGONYA SK NİDAKULE ATAŞEHİR BATI NO:1 İÇ KAPI NO: 2 ATAŞEHİR / İSTANBUL.
• Registered electronic mail (KEP): via [KEP adresi] with a secure e-signature or mobile signature.
• Email registered in our system: from the email address you previously notified to our system, to [email protected].

In your application, you must fully provide your name and surname, ID number (for foreigners, nationality + passport details), notification address, an email, phone or fax for notification if any, the subject of the request and information regarding the processing subject to your request (Communiqué Art. 5).

Your application is concluded within thirty days at the latest, depending on the nature of your request, pursuant to Article 13 of the Law and Article 6 of the Communiqué. It is free of charge unless the process requires a separate cost; otherwise the fee tariff set out in Article 7 of the Communiqué may apply (the first ten pages free; the amount in the Communiqué for each subsequent page).

If your application is rejected, the response is found insufficient, or no response is given within the time limit, you have the right to file a complaint with the Personal Data Protection Board within thirty days of the response being served on you and in any case within sixty days of the application date (KVKK Art. 14).