01Operator and scope
This website is operated under the Cynlume brand. The company name supplied for this draft is Cynlume LTD. ŞTİ., with the English description “Cynlume Software Technologies Ltd.” and contact address Esentepe Mah. Talatpaşa Cad. No:5/1 Şişli / İstanbul. Contact: info@cynlume.com; +90 (850) 840 6690. The complete registered legal name, MERSİS number and tax office remain to be confirmed.
This notice covers website enquiries and browsing. A negotiated customer agreement and, where required, a separate data-processing agreement govern services delivered to business customers. The site is intended for professional business enquiries and does not offer consumer checkout.
02Information and collection methods
The enquiry form asks for your name, company name, work email, job title, area of interest, indicative budget and a short project description. Required fields identify the request and provide enough context for a response. Do not submit passwords, source code, trade secrets, identification documents or sensitive personal data.
In the current email-draft mode, form contents are assembled in your browser. Clicking the form button prepares an email; it does not submit a message to our website server or confirm receipt. Your email application sends the information only when you complete the send action. A downloadable email draft is available as a fallback.
If online intake is activated after the operating details are approved, the website will record the same fields, an enquiry reference, submission time, language and notice version. Infrastructure providers may also process IP addresses, request times and technical security logs when delivering the website. We do not treat the illustrative architecture or sample telemetry as real customer activity.
03Purposes and legal bases
We use business enquiry information to understand a proposed engagement, assess its scope, communicate with the contact person and maintain a proportionate record of the discussion. We do not add enquiry contacts to marketing campaigns by default.
Where the GDPR applies, business-contact handling ordinarily relies on a legitimate interest in responding to relevant enquiries, subject to the individual’s rights. Steps requested by an individual before entering their own contract may instead fall within the pre-contractual basis. Legal obligations and the establishment or defence of claims are assessed separately. Under Turkish Law No. 6698, the corresponding purpose-specific processing conditions are assessed under Article 5; sending an enquiry is not blanket consent for unrelated processing.
Reading this notice or ticking an acknowledgement confirms that information was provided; it is not consent to marketing, unrestricted international transfers or processing unrelated to the enquiry.
04Recipients and international processing
Authorised Cynlume personnel and, when necessary, professional advisers may access relevant information. Hosting, security and email providers may process information in their service roles. Disclosure to authorities occurs only where a valid legal basis requires or permits it. We do not sell enquiry data.
An email you choose to send is processed by the email providers involved. The website is hosted through the Sites platform; infrastructure and access services may involve processing outside Türkiye. The exact contracting providers, processing locations and transfer safeguards must be confirmed before public online intake is activated.
A recurring overseas transfer requires an applicable transfer mechanism, not a general checkbox. Where relevant, Turkish Article 9 requirements and GDPR Chapter V safeguards must be put in place, with the required notices and agreements. This draft does not represent that a standard contract, adequacy decision or other safeguard has already been secured.
05Retention and security
Non-contractual enquiry records should be reviewed for deletion when the enquiry no longer serves a legitimate purpose; the proposed operating limit is 180 days after the last relevant interaction unless a documented legal obligation or dispute justifies longer retention. Customer, accounting and contractual records require a separate, approved retention schedule. Mailbox and backup deletion arrangements must be aligned with that schedule.
The prepared online intake uses server-side validation, restricted write-only public access, prepared database queries, request limits and limited technical identifiers. Those measures reduce risk; no website or transfer channel can guarantee absolute security. Production access, incident response, supplier contracts and deletion routines must be maintained operationally.
06Cookies, local preferences and external links
This website does not install advertising pixels or analytics scripts. It stores a theme preference in your browser’s local storage; the selected language is reflected in the page URL. These settings do not contain the enquiry text. You can remove a stored preference through browser settings.
The access or authentication service used to view a private Site may use its own necessary cookies and process account information under its own notices. Fonts are served with the website. Map links open Google Maps only when you select them; the map provider’s own terms and privacy rules apply after navigation.
07Your rights and requests
Contact info@cynlume.com or write to the address above with a clear description of your request. We may ask for proportionate information to verify your identity. Please avoid sending an ID document unless it is specifically necessary and a suitable channel has been agreed.
Depending on the law that applies, you may request access, information, correction, deletion, restriction or portability, object to qualifying processing and complain to a competent supervisory authority. If a particular activity relies on consent, consent can be withdrawn without affecting earlier lawful processing. We do not use this enquiry form for decisions based solely on automated processing with legal or similarly significant effects.
Under the GDPR, applicable requests are normally addressed within one month, with legally permitted extensions where justified. Turkish applications follow the KVKK procedure and are answered as soon as practicable and within the applicable 30-day period. The Turkish KVKK Notice explains the local application route.
08Updates and adoption
This is a review draft dated 5 September 2026. Before adoption, the company must verify its legal identity, actual service providers, cross-border arrangements and retention operations. Material changes to actual processing require an updated notice; using the site does not waive statutory privacy rights.