Privacy Policy

Only what the service needs.
Nothing sold, nothing tracked.

SIRAT processes the personal data it needs to provide its service. We do not sell it, we do not use it for advertising, and we do not track you across other websites or apps. This policy explains what we collect, why, who we share it with, how long we keep it, and the rights you have.

  1. 01Scope
  2. 02Data controller
  3. 03Data we collect
  4. 04Purposes and legal bases
  5. 05AI and translation
  6. 06Service providers and transfers
  7. 07Retention
  8. 08Security
  9. 09iOS app
  10. 10Cookies and local storage
  11. 11Your rights and account deletion
  12. 12Other matters

01 — Scope

Scope

This policy covers the personal data of our users and visitors in the following services:

  • the siratdefence.com website and its forms;
  • the SIRAT Defence Intelligence platform (web application);
  • the SIRAT iOS app.

Records on the platform concern organisations. Where such a record contains the name of a person — for example an official named in a public procurement notice — that processing is described on our Data & Corrections page, which also explains how to have a record corrected or removed.

This text is provided as the information notice required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and as the information required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

02 — Controller

Data controller

The data controller for your personal data is SIRAT Savunma Danışmanlık Dış Tic. A.Ş. (SIRAT Defence Solutions).

03 — Data

Data we collect

We collect only the data needed to provide the service, protect your account and meet our legal obligations.

Category
What it includes
Where it comes from
Identity and contact
Name, job title, email, telephone
Account application, invitation, your profile
Organisation details
Company name, tax number, address, website, NCAGE code, logo, contact person
Account application and company profile
Account and sign-in
Password (hashed), role, session and sign-in records (IP address, browser information)
Collected automatically at sign-in
Usage
Open screen, last seen time, read status, agreements you have accepted (date, version, browser information)
Collected automatically during use
Content you create
Questions to analysts and their answers, messages, tasks, mission briefing requests, bid tracking, notes, watchlist, documents you upload
Entered by you
Search
The search text you type on the platform (not stored in our database)
Entered by you
Mobile device
Notification token, platform, app version, notification preferences
iOS app
Website forms
Name, company, role, email, country, message
Contact and access request forms
Technical logs
IP address, browser type, time of access
Server logs, collected automatically

We do not take card payments. Payments are made by bank transfer, and invoice records are kept in the name of the organisation. We do not process special categories of personal data (such as health, biometric or religious data).

Providing the identity, contact and organisation details is necessary to open and run an account; without them we cannot provide the platform. Everything else is either generated by your use of the service or entirely up to you.

04 — Purposes

Purposes and legal bases

Purpose
Legal basis
Opening your account, signing you in and providing the service
Formation and performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b))
Preparing opportunities, reports and briefings suited to your organisation's profile
Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b))
Answering analyst questions and providing support
Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b))
Sending invitations, password resets, announcements, the weekly summary and notifications
Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b))
Protecting accounts, preventing misuse and auditing actions
Legitimate interests in keeping the service and its users secure (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f))
Replying to requests sent through the website forms
Steps prior to a contract and legitimate interests in answering enquiries (KVKK Art. 5(2)(c) and (f); GDPR Art. 6(1)(b) and (f))
Invoicing and legal obligations
Legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c))
Protecting our rights in legal claims
Establishment, exercise or defence of a right (KVKK Art. 5(2)(e); GDPR Art. 6(1)(f))

We do not use your data for any purpose incompatible with these. We do not take decisions about you that are based solely on automated processing and that have legal or similarly significant effects on you.

05 — AI

AI and translation

Some features — search, matching, reports and briefings — use AI models from third-party providers. These models receive organisation information (such as name, sector, products, markets and publicly available text from the organisation's website), the search text you type and the details of the mission briefings you request. They do not receive your name, email address or telephone number.

Your analyst questions and their answers, messages, tasks and uploaded documents are not sent to AI models. Content drafted with the help of AI is marked as such on screen, and it does not replace a legal or compliance decision.

In the Turkish view, translation services process the text you see on screen.

06 — Providers

Service providers and international transfers

We share your data only with the service providers that run the platform — cloud hosting, email delivery, security, AI and translation — and only as far as each of them needs to do its job. They process it on our instructions, under contracts that require them to protect it to the same standard as we do. Some of these providers are located abroad, so using the service involves transferring your personal data outside Türkiye. We make these transfers on the basis of the safeguards provided for in Article 9 of KVKK and, under the GDPR, on the basis of adequacy decisions or standard contractual clauses. You can ask us for the current list of providers, or for a copy of the relevant safeguards, at the address in section 02.

Where the law requires it, we may also share data with competent public authorities and courts. We never sell your data to any third party.

07 — Retention

Retention

Data
How long we keep it
Account details and content you create
For as long as your organisation's subscription lasts; deleted or anonymised no later than 6 months after it ends
Account applications that are not approved
1 year from the application
Security logs (sign-in and session records)
Up to 1 year
Audit logs
2 years
Website form correspondence
2 years after the request is closed
Notification tokens
Disabled at sign-out; deleted after 6 months without use
Invoice and payment records
10 years (Turkish Commercial Code and tax legislation)

When a period ends, the data is deleted, destroyed or anonymised. Records relevant to an ongoing legal dispute may be kept until that dispute is concluded.

08 — Security

Security

We protect your data against unauthorised access, loss and alteration with appropriate technical and organisational measures. All connections are encrypted, each user can reach only the records of their own organisation, passwords are stored in hashed form that SIRAT staff cannot read, sign-in is protected against automated attacks, and administrative actions are logged.

No system is entirely free of risk. If a personal data breach occurs, we will notify the competent authorities and the people affected within the time limits set by law.

09 — iOS app

Information specific to the iOS app

  • AccountsAccounts cannot be created in the app; they are created for organisations that have a contract with SIRAT. You sign in with your email and password. To delete your account, see section 11.
  • Face IDThe app lock uses Apple's on-device authentication. Face and fingerprint data never leave your device and never reach SIRAT.
  • NotificationsIf you allow notifications, we store your device's notification token and your notification preferences with your account. The token is disabled when you sign out, and you can withdraw permission at any time in iOS Settings.
  • Data on your deviceBriefings you save for offline reading, and notes you add to them, are kept only on your device and are deleted when you sign out.
  • No trackingThe app contains no advertising, analytics or tracking tools and does not track you across other companies' apps or websites.

10 — Cookies

Cookies and local storage

We use no advertising, analytics or tracking cookies. We use only what is needed for the service to work:

  • SessionWhen you sign in, the session key is kept in your browser's local storage and removed when you sign out.
  • Language preferenceThe language you choose is kept in local storage. When Turkish is selected, Google Translate's language cookie is also used.
  • Third-party serviceshCaptcha and Google Translate may use their own security and functional cookies. These are governed by their own privacy policies.

You can delete cookies and local storage in your browser settings; doing so will sign you out.

11 — Your rights

Your rights and account deletion

Under Article 11 of KVKK and the GDPR you have the right to:

  • learn whether your personal data is processed and, if so, request information about it;
  • learn the purpose of the processing and whether the data is used in line with that purpose;
  • know the recipients in Türkiye or abroad to whom your data is transferred;
  • request the correction of incomplete or inaccurate data;
  • request the erasure or destruction of your data, or the restriction of its processing;
  • request that corrections and erasures be notified to the third parties to whom your data was transferred;
  • object to an outcome against you that results from analysis carried out exclusively by automated systems;
  • receive your data in a commonly used format (data portability);
  • object to processing based on legitimate interests;
  • claim compensation for damage suffered as a result of unlawful processing.
How to apply

Write to info@siratdefence.com from the email address registered with us, under the subject Personal data request, or send a written request to the address in section 02. We may ask for additional information to verify your identity. We reply free of charge within 30 days at the latest.

Account deletion. To have your account deleted, write to the same address under the subject Account deletion request. Your account and the content belonging to you are deleted within 30 days. Records that we are legally required to keep, such as invoices, are kept until their retention period ends. The administrator of your organisation's account can also deactivate your user.

Complaints. If you are not satisfied with our reply, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or, if you are in the EU, to the data protection authority of your country.

12 — Other

Other matters

  • ChildrenOur services are intended for organisations. They are not directed at anyone under 18, and we do not knowingly collect data from them.
  • ChangesWe may update this policy. We announce significant changes in the platform or by email. The current version is always on this page.
  • ContactQuestions about this policy: info@siratdefence.com

Last updated 14 October 2026
SIRAT Defence Solutions · Çukurambar, Çankaya / Ankara, Türkiye

Talk to us →