Last updated: 11.06.2026
This is a convenience translation. The Turkish version of this clarification text is the legally binding version under Turkish Personal Data Protection Law No. 6698 (“KVKK”).
1. Data Controller
Under KVKK, your personal data is processed by Normitic Belgelendirme A.Ş. (“Normitic”) acting as data controller.
- Entity: Normitic Belgelendirme A.Ş.
- Address: Bayar Cd., Gülbahar Sk., Ege Yıldız Sitesi No:13, A Blok, Daire:22, Kozyatağı, Kadıköy, İstanbul / Türkiye
- E-mail: bilgi@normitic.com · Phone: +90 216 471 29 69
2. Personal Data Processed
- Identity data (name, surname, title, signature)
- Contact data (e-mail, phone, address, organisation)
- Customer transaction data (application, quotation, contract, certification and audit records)
- Professional data (roles and competencies of personnel interviewed during audits)
- Legal transaction data (appeal and complaint records)
- Transaction security data (website usage records)
3. Purposes of Processing
- Planning and delivering certification, audit, surveillance, training and analysis services
- Managing application, quotation and contract processes
- Meeting obligations under ISO/IEC 17021-1 and accreditation rules (TÜRKAK, ANAB)
- Verifying certificate validity and operating the public certificate-search service
- Handling appeals and complaints
- Fulfilling legal obligations and responding to competent authorities
- Responding to contact requests
4. Legal Bases
Your personal data is processed on the legal bases set out in Article 5 of KVKK: explicit provision in law; necessity for the establishment or performance of a contract; the controller's legal obligations; establishment, exercise or protection of a right; and the controller's legitimate interests, provided your fundamental rights are not harmed. Where none of these apply, your explicit consent is sought.
5. Transfers
Your data may be transferred, in accordance with Article 8 of KVKK, to the Turkish Accreditation Agency (TÜRKAK) within the scope of accreditation audits and reporting, to legally authorised public institutions, and to our service providers. International transfers — including activities under ANAB (ANSI National Accreditation Board) accreditation and processes conducted with our group company Denetik Certification, LLC (USA) — are carried out in compliance with Article 9 of KVKK.
6. Collection Method
Your data is collected through website forms, e-mail and phone correspondence, application and contract processes, and on-site or remote audit activities, by partially automated and non-automated means.
7. Retention and Confidentiality
Personal data is retained for the periods required by applicable legislation and accreditation rules, and is then deleted, destroyed or anonymised. As an independent certification body, all information obtained during audit activities is protected under the confidentiality requirements of ISO/IEC 17021-1.
8. Your Rights (Article 11 of KVKK)
- To learn whether your personal data is processed
- To request information if it has been processed
- To learn the purpose of processing and whether data is used accordingly
- To know the third parties to whom data is transferred, in Türkiye or abroad
- To request correction of incomplete or inaccurate data
- To request deletion or destruction under Article 7 of KVKK
- To request notification of corrections and deletions to third-party recipients
- To object to results arising exclusively from automated analysis
- To claim compensation for damages caused by unlawful processing
9. How to Apply
You may submit requests regarding your rights — together with documents verifying your identity — in writing to our address above or to bilgi@normitic.com, in accordance with the Communiqué on Application Procedures to the Data Controller. Applications are concluded free of charge as soon as possible and within thirty (30) days at the latest; where processing incurs an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.