1. Purpose and principles
Adsphere Dijital Yazılım ve Teknoloji Hizmetleri Limited Şirketi processes personal data lawfully and fairly, keeps information accurate where necessary, uses specified legitimate purposes and limits processing and retention to what is required. This policy reflects the existing company's policy for its global storefront.
2. Scope
The policy covers customers, prospective customers, website visitors, support users, supplier representatives, partners, office visitors and support line users. It applies to codesigning.online, its workspace, forms, support channels and relevant physical and digital records.
3. Data controller
Adsphere Dijital Yazılım ve Teknoloji Hizmetleri Limited Şirketi, a limited company registered in Türkiye. Address: 15 Temmuz Mah., University Boulevard, Gaziantep Metropolitan Municipality Science Center, No. 320, Şehitkamil / Gaziantep. Tax office: Şahinbey. Tax number: 0081925995. Telephone: +90 850 550 0127. Email: support@codesigning.online Requests may also be sent through the website contact form.
4. Definitions
Personal data are information relating to an identified or identifiable natural person. The data subject is the person concerned. Processing includes collection, recording, storage, alteration, disclosure and other operations. Explicit consent is informed, freely given consent for a specified matter. Special category data are the sensitive categories listed in Turkish law, including health, biometric and criminal conviction data.
5. Legal grounds
Processing relies, as applicable, on express legal provisions, contract formation or performance, legal obligations, establishing or defending rights, legitimate interests or explicit consent where required.
6. Processing purposes
The company provides software, SSL, code signing and security certificate services. Processing supports service delivery, customer relations, orders, payments, invoices, identity and transaction security, technical support, requests and complaints, website and workspace operation, information security, necessary logs, communications, legal duties, dispute evidence and service quality. Physical security and analytics processes apply where such systems are used.
7. Data categories
Information may include name and applicant identity; contact details; orders, support requests and certificate applications; payment and billing records; IP addresses, logs and access records; company, tax and authorized contact information; and relevant physical security or visitor records. Identity documents may be required during certificate authority validation. A Turkish identity number is not required to register a global storefront account. Collection remains limited to what the service requires.
8. Collection methods
Data may be collected through the website, customer workspace, application forms, contact forms, email, telephone, support systems, payments, physical applications, security systems, cookies and server logs, using automated or non-automated methods as applicable.
9. Retention principles
Records are kept for statutory periods or as long as required for contracts, accounting, tax, payments, security, support, dispute evidence and other legal requirements.
10. Storage environments
Data may be held in servers, hosting systems, databases, email, management panels, support systems, security tools, logs, computers, backups and relevant cloud tools. Non-electronic records may include paper applications, contracts, archives and physical security media. The existing company's policy states that data are principally stored on servers in Türkiye.
11. Sharing
Where necessary and lawfully permitted, data may be shared with payment providers such as PaynKolay, certificate authorities for validation, hosting and technical providers, relevant workspace or support suppliers, authorized public and judicial bodies and professional accounting or legal advisers. Sharing is limited to service provision, legal obligations, security, customer relations and business continuity, with appropriate safeguards.
12. Safeguards
Measures may include network and server security, access controls, strong passwords, logs, backups, malware protection, updates, HTTPS, monitoring, physical access controls, encryption and masking where appropriate. Organizational measures include confidentiality duties, restricted access, supplier obligations, reviews, data subject request processes, audits and incident response.
13. Special category data
Special category processing is not part of the ordinary service flow. If required, additional safeguards under Turkish law and regulatory decisions apply.
14. Grounds for destruction
Data are deleted, destroyed or anonymized when their purpose ends, retention expires, consent is withdrawn without another lawful basis, an eligible request is accepted or no legal or legitimate need remains.
15. Destruction methods
Deletion may remove access or records. Destruction may securely erase digital media or destroy physical records. Anonymization removes identifying information through suitable irreversible methods, aggregation or masking as appropriate.
16. Retention periods
The existing policy states: customer contracts and commercial relationships, ten years after the relationship ends; accounting and financial records, ten years; support and call center records, three years; contact forms and applications, two years; system and access logs, two years or longer where law or service requirements apply; camera records, three months; visitor records, two years. Marketing and analysis data are kept for the necessary purpose period. Destruction follows the first applicable destruction cycle after the retention period ends.
17. Periodic destruction
The company reviews destruction processes at least annually and performs necessary deletion, destruction or anonymization after applicable retention periods end.
18. Data subject rights
Under Article 11 of Turkish Law No. 6698, individuals may ask whether data are processed, obtain information, learn purposes and recipients, request correction or lawful deletion, request notification of relevant recipients, object to adverse results produced solely by automated analysis and seek compensation for unlawful processing, subject to applicable conditions.
19. Requests
Requests may be submitted in writing or by methods permitted by law, using the controller's email, contact form, telephone or postal address above. Identification may be required to protect the applicant's information.
20. Physical security
Where office cameras are used, records are limited to physical security, identifying incidents and legal evidence, retained for the applicable period and accessible only to authorized personnel.
21. Support processes
Contact, transaction and request information may be used to resolve issues, improve service quality, support customer satisfaction and retain necessary dispute evidence.
22. Cookies and analytics
Necessary cookies support sessions, authentication and secure service operation. The global storefront package does not include the Turkish site's advertising or analytics tags. If optional analytics tools are added, the company must provide applicable notices and respect required user preferences.
23. Regulatory compliance
The company monitors its obligations, including registration with the Turkish VERBIS system where legally required. Applicability depends on the criteria established by law.
24. Publication and updates
This policy is published on the website or other appropriate company channels and may be updated for legal or operational reasons. Updated text applies from publication.
25. Entry into force
The policy takes effect upon company approval and publication. Mandatory rights under other applicable laws are unaffected.