Privacy Policy

As Upcores Mühendislik Anonim Şirketi (“Upcores”), we highly value the privacy and protection of Personal Data of our Website Users (“Data Subject”) at www.upcores.com (“Upcores Website”). To ensure a safe and complete service experience, we have integrated Privacy Policy (“Policy”) with our Cookie Policy and recommend users to review both together. This Policy is prepared in compliance with Law No. 6698 on the Protection of Personal Data (KVKK) of the Republic of Türkiye, the General Data Protection Regulation (GDPR) of the European Union, and relevant U.S. data privacy laws including the California Consumer Privacy Act (CCPA/CPRA) and similar state regulations. It aims to inform users and outline the principles, purposes, and conditions of Personal Data processing by Upcores.

Data Controller

Company Name: Upcores Mühendislik Anonim Şirketi
Tax Number: 8930613499
Tax Office: Sarıgazi Vergi Dairesi Müdürlüğü
Address: Dudullu OSB Mahallesi, İMES Sanayi Sitesi, C Blok, C-306 Sokak, No: 11, Ümraniye/İstanbul, 34775
Phone: +90 544 959 60 80
Email: hello@upcores.com
Website: www.upcores.com

What Personal Data is Processed

Personal Data includes but is not limited to Identity Information, Contact Information, User Information, Transaction Security Information, Financial Information, Marketing Information, and Request Management Information. Anonymized data are not considered Personal Data as per Article 7 of the Law.

Personal Data directed towards site visitors are processed based on the following legal grounds:

  • Personal Data made public by the Data Subject
  • Processing necessary for the establishment or performance of a contract
  • Processing necessary for the establishment, exercise, or protection of a right
  • Processing necessary for legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the Data Subject
  • Processing necessary for the data controller to fulfill a legal obligation

Customer-related processed data include:

  • Identity and contact information
  • Access, IP, and external access logs and records

Legal Basis under GDPR and U.S. Privacy Laws

Upcores processes Personal Data under the following additional bases:

GDPR (Article 6):

  • Consent of the Data Subject
  • Processing necessary for the performance of a contract
  • Processing required for compliance with legal obligations
  • Processing necessary to protect vital interests
  • Processing necessary for legitimate interests pursued by Upcores, provided these do not override fundamental rights and freedom

U.S. Privacy Laws (CCPA/CPRA and equivalents):

  • Processing is limited to legitimate business purposes such as providing requested services, ensuring security, maintaining service quality, and fulfilling legal or contractual obligations.
  • Upcores does not sell or share Personal Data for monetary or marketing gain without explicit consent.

How and Why Personal Data is Processed

Personal Data is collected via the Upcores Website and processed for the following purposes:

  • Ensuring legal, technical, and commercial security for both Upcores and its business partners
  • Enhancing user experience and service quality on the Upcores Website
  • Conducting necessary operations by relevant business units to execute commercial activities
  • Customizing and improving products and services offered to users

Express Consent

With the explicit consent of the Data Subject, Upcores may process Personal Data for purposes including profiling, improving user experience, direct marketing, and creating personalized promotions. This may include monitoring user interactions on the Upcores Website.

Explicit Consent and International Data Transfers

Upcores may process and, where necessary, transfer Personal Data to third-party service providers, business partners, and affiliates to ensure the proper operation of its digital infrastructure, website, communication systems, analytics tools, and other service platforms. These third parties may be located within Türkiye or abroad.

Pursuant to Article 9 of Law No. 6698 on the Protection of Personal Data (KVKK), Personal Data may be transferred abroad only with the explicit consent of the Data Subject, unless one of the legal exceptions defined under the Law applies. In this context, Data Subjects acknowledge that certain data may be stored, processed, or accessed through third-party systems (including hosting, cloud storage, analytics, and communication providers) that are established outside Türkiye.

Where such transfers are required for the continuity of Upcores’ services, Upcores ensures that appropriate contractual and technical safeguards are implemented in compliance with KVKK, the EU General Data Protection Regulation (GDPR), and applicable U.S. state privacy laws. These safeguards include, where applicable, Standard Contractual Clauses (SCCs), written undertakings approved by the Turkish Data Protection Authority, or other mechanisms ensuring an adequate level of protection.

By accepting this Policy and submitting Personal Data through the Upcores Website or associated forms, the Data Subject provides explicit consent to:

  • The processing of their Personal Data for the purposes defined in this Policy;
  • The transfer and storage of such data to third-party processors, including those located outside Türkiye, for the lawful operation of Upcores’ services.

Data Subjects retain the right to withdraw their explicit consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

How Personal Data is Transferred

Your Personal Data, within the purposes listed above and in compliance with applicable laws, may be transferred to our foreign investors, shareholders, management, business partners, suppliers, and service providers, or to regulatory and supervisory authorities within Türkiye or abroad, when permitted by law and aligned with Upcores’ legitimate business purposes.

Rights of the Data Subject Under Article 11 of the KVKK

Under Article 11 of the KVKK, Data Subjects have the following rights:

  • To inquire whether their Personal Data has been processed
  • To request information regarding the processing of Personal Data
  • To learn the purpose of processing and whether it is used accordingly
  • To know the third parties to whom Personal Data is transferred
  • To request correction of incomplete or inaccurate data
  • To request deletion or destruction of data under certain conditions
  • To object to outcomes derived from automated processing
  • To request compensation for damages resulting from unlawful processing

Additional Rights under GDPR

For Data Subjects located in the EEA or UK, the following rights are also recognized:

  • The right to data portability
  • The right to restriction of processing in specific cases
  • The right to withdraw consent at any time
  • The right to lodge a complaint with a supervisory authority

Additional Rights under U.S. Privacy Laws

Residents of the United States (where applicable) may have additional rights under state privacy laws, including:

  • The right to access or delete Personal Data
  • The right to opt out of data sale or sharing
  • The right to limit use of sensitive personal information
  • The right to non-discrimination for exercising privacy rights

Requests may be submitted using the contact methods below.

Requests and Applications

Data Subjects can exercise their rights by submitting a request form via one of the following methods:

  • By form: Submit your request directly through the online form here.
  • By email: Send a signed electronic copy and identification documents to hello@upcores.com
  • By post: Send a wet-signed request and identification documents to Dudullu OSB Mahallesi, İMES Sanayi Sitesi, C Blok, C-306 Sokak, No: 11, Ümraniye/İstanbul, 34775

Requests will be evaluated, and a response will be provided within 30 days as required by law.

Updates to this Policy

Upcores reserves the right to update this Policy in accordance with legislative changes or internal revisions. The updated version will always be published at https://upcores.com/pages/privacy-policy.

This Policy fulfills the information obligation under Law No. 6698 (KVKK), GDPR, and U.S. privacy laws. For data protection requests, please access the relevant Data Subject Request Form provided on the Upcores Website.