Privacy Policy

This policy is written for the EU General Data Protection Regulation (GDPR). It is not a translation of our Turkish KVKK notice, which is a separate document.

1. Who is responsible for your data

The controller of your personal data is:

• CYBERNEX Electronics
• Address: Piri Mehmet Paşa Mah. Uğurböceği Sok. No:4 D:7, Mehmet Haseki İş Merkezi, Silivri, Istanbul, Türkiye
• Email: info@cybernexglobal.com
• Phone: +90 536 451 27 75

We are established in Türkiye, outside the European Union.

2. In short

• We collect personal data only through forms you submit and accounts you create.
• There are no analytics, advertising or tracking tools on this site. Only strictly necessary cookies are used (see our Cookie Policy).
• We do not store your IP address in readable form. To prevent abuse we keep a salted hash of it that changes every month, for no longer than 90 days.
• We do not sell your data, and we do not add you to a mailing list unless you opt in.
• If you have an account, you can download your data and delete your account yourself.

3. What we collect

Contact form: full name, email, phone (optional), company and country (optional), topic, your message and, if you choose one, a related product.

Quote request: full name, email, phone, company, country (some optional), the products and quantities you request, line notes and your project note. The list prices at the time of your request are stored with it.

Dealer application: company name, contact person, email, phone, country, city, website, field of business, estimated volume band, brands you work with, categories of interest and additional notes.

Account: email, password (stored only as an irreversible hash), full name, company, country, phone, preferred language, optional newsletter opt-in, solutions you save from CYRA (the options you selected and the recommended product codes) and, if you enable it, your two-step verification enrolment.

Records and security data:

• For every form submission, the version of the privacy notice you confirmed and the time you confirmed it.
• The submission's reference number and date.
• A salted, monthly-rotating hash of your IP address. The raw IP address is never written to our database. The hash is used for rate limiting and abuse review and is erased after 90 days at the latest.
• A hash of your email address for rate limiting; these records are deleted within a few days.
• Session records kept by our authentication service for signed-in users. These records contain the IP address and browser information of the session; they are deleted when you sign out or delete your account, and records of sessions unused for 400 days are deleted automatically every day even if you never sign out. Technical logs of the authentication service are kept for a few days at most.

What we do not collect: We do not track your browsing, build profiles or collect data for advertising. The site does not make requests from your browser to third-party servers for fonts, analytics or ads. Reference logos, team photos and product videos load into your browser directly from the file storage of our processor Supabase (Frankfurt, EU); like any web server, Supabase technically sees your IP address and browser information while serving them.

4. Why we use your data, and on what legal basis

مرّروا الجدول أفقيًا →

Ticking the box on a form confirms that you have read this policy; it is not a request for consent. Where we rely on consent, you can withdraw it at any time (for example by switching off the newsletter option in your account or writing to us). Withdrawal does not affect processing carried out before it.

Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details of that assessment.

5. Who processes your data for us

We do not sell your data. We use the following processors to run the service:

مرّروا الجدول أفقيًا →

Otherwise, your data is disclosed only where we are legally required to do so.

6. International transfers

Our database is in the EU (Frankfurt). Your data nevertheless leaves the European Economic Area in two ways:

1. To Türkiye. We are established in Türkiye, and our staff access your data from there to answer you. The European Commission has not adopted an adequacy decision for Türkiye.
2. To the United States. Our hosting provider's server-side functions may run in the US, and our processors are US companies. These transfers rely on the providers' data processing agreements, which incorporate the EU Standard Contractual Clauses, and, where the provider is certified, on the EU-U.S. Data Privacy Framework.

You can ask us for a copy of the relevant safeguards by writing to info@cybernexglobal.com.

7. How long we keep your data

مرّروا الجدول أفقيًا →

At the end of these periods, data is deleted or anonymised.

8. Your rights

Under Articles 15 to 22 GDPR you have the right to:

• Access the personal data we hold about you and receive a copy.
• Have inaccurate or incomplete data rectified.
• Have your data erased.
• Restrict processing in certain cases.
• Data portability: receive the data you gave us in a structured, commonly used, machine-readable format and have it sent to another controller.
• Object at any time to processing based on our legitimate interests, and to direct marketing.
• Withdraw consent at any time where processing is based on consent.

Self-service: if you have an account, you can download your data as a JSON file and delete your account from your account settings. Deleting your account removes your profile and saved solutions; requests you sent earlier are detached from your account and kept only for the periods in section 7.

To exercise any right, write to info@cybernexglobal.com or to the postal address above. We reply within one month (Art. 12(3) GDPR); we may ask you to confirm your identity.

Automated decisions: CYRA's recommendations are a rule-based product selection aid. They do not produce legal or similarly significant effects for you, so there is no automated decision-making within the meaning of Article 22 GDPR.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State where you live, work or where you believe an infringement took place. We would appreciate the chance to address your concern first, but this is not a condition.

10. Security

• All traffic is served over HTTPS with HTTP Strict Transport Security and a strict Content Security Policy.
• Row-level access rules apply to every database table; members can see only their own records.
• Two-step verification (TOTP) is mandatory for staff accounts. Content editors cannot access personal data.
• Session cookies are HttpOnly and Secure, and no database client runs in your browser.
• Changes to personal-data tables are written to an audit log that records which fields changed, not the data itself.

11. Changes

We may update this policy when the law or our processing changes. Each version is dated, and the version you confirmed when submitting a form is stored with your record.