Privacy Notice

ICM Bilgi Teknolojileri Dağıtım Anonim Şirketi treats the protection of personal data and the privacy of the individuals it concerns as a core responsibility. This notice is issued under Law No. 6698 on the Protection of Personal Data ("the Law") to inform you about the processing we carry out as data controller.

1. Identity of the data controller

Under Law No. 6698, the controller of your personal data is:

ICM Bilgi Teknolojileri Dağıtım Anonim Şirketi
Address: Esentepe Mah. Büyükdere Cad. Levent 199 No: 199 İç Kapı No: 6 Şişli, İstanbul, Türkiye
E-mail: info@icmconnect.com
Website: www.icmconnect.com

2. Purposes of processing

Depending on the nature of the activity and your relationship with us, your personal data may be processed in order to:

· conduct customer, partner, supplier and other commercial relationships,
· assess and meet requests for products and services,
· run quotation, sales, contract, order, invoicing and operational processes,
· carry out sales and business development activities,
· manage processes run with partners and technology vendors,
· operate deal registration and manage the allocation of accounts between partners,
· provide technical support, advice and after-sales services,
· plan and run events, meetings, training and similar activities,
· carry out corporate communications,
· manage requests, suggestions, complaints and correspondence,
· run human resources and recruitment processes,
· maintain the information, physical and operational security of the company,
· secure information systems, communications infrastructure and digital channels,
· meet legal and regulatory obligations,
· respond to requests from authorised persons, institutions and public bodies,
· conduct, develop and audit the company's activities,
· conduct legal proceedings and meet legal obligations.

Your personal data is processed for specified, explicit and legitimate purposes, and in a manner connected with, limited to and proportionate to those purposes.

3. Categories of personal data

Within the relevant process and to the extent necessary, the following categories may be processed: identity data, contact data, customer and partner data, professional and corporate data, financial data, transaction and contract data, request and correspondence records, transaction security data, physical premises security data, visual and audio records, and the professional information submitted by a candidate during recruitment.

Data is determined by reference to the activity and the purpose, and personal data that is not necessary is not processed.

4. Method of collection and legal grounds

Personal data may be collected through your correspondence and commercial dealings with us, the website and digital channels, e-mail, telephone, forms, contracts, meetings and events, job applications, partners and authorised persons and bodies, and through other physical and electronic methods used in the relevant activity.

Processing is based on the conditions set out in Articles 5 and 6 of the Law, and in particular on one or more of the following: that processing is expressly provided for by law; that it is directly related to the conclusion or performance of a contract; that it is mandatory for the controller to fulfil a legal obligation; that the data has been made public by the data subject; that it is mandatory for the establishment, exercise or protection of a right; that it is mandatory for the legitimate interests of the controller, provided this does not harm the fundamental rights and freedoms of the data subject; or another condition provided for in the Law.

Where processing requires explicit consent, it is carried out on the basis of consent obtained separately after the necessary information has been given.

5. Cookies and browser storage

This website sets no cookies. Your visit is not analysed, and no third-party script is loaded for measurement or advertising.

The site keeps two preferences in your browser's own local storage. The colour theme you chose, and the language you chose. Neither leaves your device, neither is sent to us, and neither is linked to your identity. You can delete both by clearing site data in your browser, and the site continues to work if you do.

The infrastructure the site is published on may keep technical access logs, as any web server does. Those logs fall within the transaction security data listed in section 3.

6. Transfers

Your personal data may be transferred, only to the extent necessary for the relevant purpose and legal ground, to our partners, product and technology vendors, suppliers and service providers, authorised public institutions, professional advisers such as legal, accounting and audit firms, information technology and infrastructure providers, and other persons and bodies authorised by law. Transfers are made in accordance with the conditions set out in the Law and with our data security obligations.

7. Transfers abroad

The website is published through an infrastructure provider located outside Türkiye, our group company ICM Information Technologies Distribution L.L.C-FZ is established in the United Arab Emirates, and some of the vendors we represent and the partners we work with are located abroad. Certain processing activities may therefore involve a transfer of personal data abroad.

Transfers abroad are made under Article 9 of the Law as amended by Law No. 7499, in force since 1 June 2024. Accordingly a transfer may be made to a country, international organisation or sector for which the Board has issued an adequacy decision. Where no adequacy decision exists, the transfer is made on the basis of one of the appropriate safeguards listed in that Article, namely an agreement between public institutions and international organisations, binding corporate rules, standard contractual clauses, or a written undertaking. Where standard contractual clauses are signed, the Authority is notified within five working days of signature. Where none of these routes is available, a transfer is made only in the incidental cases set out in paragraph six of that Article and on the conditions stated there.

8. Data security

Under Article 12 of the Law we take the technical and administrative measures necessary to provide an appropriate level of security, in order to prevent unlawful processing of and unlawful access to your personal data and to ensure its safekeeping. Those measures include limiting access rights to what a role requires, using encryption in transfer and storage, and putting confidentiality and data security obligations into the contracts of parties acting as data processors.

9. Retention

Personal data is retained for the period provided for in the relevant legislation or required by the purpose of processing. Where that period ends, or where the reasons for processing cease to exist, the data is deleted, destroyed or anonymised in accordance with the legislation and with our retention and destruction procedures.

10. Your rights under Article 11

As a data subject you have the right to learn whether your personal data is being processed; to request information about it if it has been; to learn the purpose of processing and whether the data is used in accordance with that purpose; to know the third parties in Türkiye or abroad to whom it has been transferred; to request its correction where it has been processed incompletely or inaccurately; to request its erasure or destruction under the relevant provisions of the Law; to request that a correction, erasure or destruction be notified to the third parties to whom the data was transferred; to object to a result reached against you through the exclusively automated analysis of processed data; and to claim compensation where you suffer damage because your data has been processed unlawfully.

11. How to apply

You may submit a request under the Law in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, by one of the following routes:

· a signed written application delivered to the address above in person or through a notary,
· from your registered electronic mail (KEP) address,
· using a secure electronic signature or mobile signature,
· from the e-mail address you have previously notified to us and which is registered in our systems, sent to info@icmconnect.com.

Your application should state your name and surname; your Turkish identity number if you are a citizen of the Republic of Türkiye, or your nationality and passport number or identity number if you are not; your address for service; your e-mail address and telephone number for notification if any; and the subject of your request. Any relevant information and documents should be attached.

Your application will be concluded as soon as possible and in any event within thirty days, depending on the nature of the request. Where a request requires additional cost, the fee in the tariff set by the Board may be charged.

If your application is rejected, if you find the response inadequate, or if no response is given within the period, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning the response and in any event within sixty days of the date of application.

12. Information and consent are separate

This notice is issued to inform data subjects about the processing we carry out. The obligation to inform and the obtaining of explicit consent are independent of each other. The obligation to inform is met even where processing does not require consent, and where it does, consent is obtained separately after the necessary information has been given. This notice is not used to obtain consent.

13. Updates

This notice may be updated in line with changes in legislation and in our processing activities. The current text is always published on this page.

Last updated: 16 September 2026