1. Data-protection framework
This page describes NEWLY's data-protection governance approach. It complements the Privacy Policy and does not replace service-specific notices or contracts.
NEWLY İLETİŞİM VE BİLGİ TEKNOLOJİLERİ ANONİM ŞİRKETİ is established in Türkiye and is a data controller when it determines why and how personal data is processed. In other contexts — for example, certain enterprise or cloud services — NEWLY may process data on documented instructions from a business customer and act as a processor or service provider.
2. Core principles
3. Controller, processor and business-customer roles
For NEWLY-operated websites, support channels, recruitment and direct customer relationships, NEWLY will generally determine the purposes and means of processing and therefore act as controller. For hosted or enterprise services where a customer determines the purpose of processing and NEWLY acts only on instructions, the contract and applicable data-processing terms determine the parties' roles.
Where required, controller-processor relationships should be covered by appropriate data-processing terms addressing instructions, confidentiality, security, subprocessors, data-subject assistance, deletion/return and audit or assurance obligations.
4. Technical and organisational controls
Security measures are selected according to the nature of the data, the service architecture and the risks presented by the processing. Controls may include:
- role-based access and least-privilege permissions;
- authentication, session controls and privileged-access restrictions;
- encryption in transit and, where appropriate, encryption at rest;
- logging, monitoring, backup and recovery controls;
- secure development, vulnerability management and patching;
- segregation of environments and controlled administrative access;
- vendor due diligence and contractual security requirements;
- confidentiality commitments and security awareness measures.
Specific security commitments for an enterprise service may be defined in that service's contract or security documentation.
5. Vendors, subprocessors and access governance
We may use third-party infrastructure and service providers to operate NEWLY services. We evaluate relevant providers based on the service, data involved and risk profile, and apply contractual and access controls appropriate to their role. Access to personal data should be limited to authorised personnel or service providers with a legitimate need for the relevant purpose.
6. Cross-border data transfers
Cross-border transfers are assessed under the rules that apply to the relevant processing. Under Türkiye's amended KVKK Article 9, transfers may rely on mechanisms recognised by Turkish law, including adequacy and appropriate safeguards such as standard contracts where their conditions are met. For transfers subject to the GDPR, mechanisms may include European Commission adequacy decisions, Standard Contractual Clauses and other Chapter V safeguards. UK transfers may require UK-specific mechanisms.
Where required, we consider supplementary technical or organisational safeguards in addition to the transfer instrument.
7. Security incidents and breach response
We maintain processes designed to identify, contain, investigate and remediate security incidents. Where a personal-data breach triggers notification duties, the relevant controller assesses the incident and notifies the competent authority and/or affected individuals within the time and conditions required by applicable law.
8. Data-subject requests
Requests are handled according to the law that applies and the role NEWLY has in the relevant processing. Where NEWLY acts as processor for a business customer, we may direct you to that customer or assist the customer in responding.
Requests may be sent to cs@newlysoft.com.tr. We may request information reasonably necessary to verify identity, protect other individuals and locate the relevant records.
Formal applications under Türkiye's KVKK are subject to the procedural rules issued by the Turkish Personal Data Protection Authority, including the prescribed application content and submission requirements.
9. Regulatory references
- Türkiye: Personal Data Protection Authority (KVKK) and Law No. 6698.
- EU/EEA: General Data Protection Regulation (GDPR) and competent national supervisory authorities.
- United Kingdom: UK GDPR / Data Protection Act framework and the Information Commissioner's Office (ICO), where applicable.
- California: California Consumer Privacy Act (CCPA), as amended, and CalPrivacy / California Attorney General, where applicable.
This list is not exhaustive. A local law may apply based on the location of the individual, the establishment involved, the service, and the nature of the processing.
10. Contact
NEWLY İLETİŞİM VE BİLGİ TEKNOLOJİLERİ ANONİM ŞİRKETİ
Nilüfer Caddesi No: 38E 1–5, 16285 Görükle, Nilüfer, Bursa, Türkiye
Phone: +90 850 302 49 04
Email: cs@newlysoft.com.tr