Information processed
The Contact form requires your full name, company and email address. Phone number, topic and message are optional. The form does not request special-category personal data; please do not put unnecessary sensitive or special-category information in the free-text field.
The form also sends the selected language, source-page address, information acknowledgement and a hidden anti-bot field expected to be empty. The server adds a request reference and receipt time. For short-term abuse control, the IP address supplied by the trusted ingress is used for rate limiting; depending on configuration, an IP-derived digest, attempt count and expiry are processed.
If authentication is configured and you sign in, session identity, account email, roles and OIDC sign-in transaction data may be processed. Ordinary page viewing does not create a signed-in session.
Purposes and collection
Information is collected electronically when you submit the form. It is used to assess your enquiry, route it to the relevant Mercan team and respond. The form does not create a newsletter or commercial-message subscription.
Technical data supports form security, abuse limits, delivery status and error investigation. If you sign in, session data supports authentication and authorised access.
Legal bases for processing
For receiving, routing, assessing and responding to general corporate enquiries, the basis is KVKK Article 5/2(f): processing necessary for the controller's legitimate interests, provided the data subject's fundamental rights and freedoms are not harmed.
Where a sales, quotation or contract-related enquiry is directly related to establishing or performing a contract, KVKK Article 5/2(c) applies to necessary processing of the parties' personal data. Before an enquiry reaches that relationship, Article 5/2(f) applies where its conditions are met. Necessary processing of existing customer support requests directly related to contracted service delivery falls under Article 5/2(c).
Short-term technical processing to protect the form and Mercan systems from abuse, automated attacks and excessive submissions uses Article 5/2(f). Article 5/2(ç) applies only where a concrete legal obligation requires the particular processing; it is not a blanket basis for website activity. Ordinary Contact enquiries are not based on explicit consent; the checkbox confirms receipt of information only.
Routing and systems
Depending on the topic, the request is routed to the relevant Mercan corporate mailbox at info@mercantechnology.com, sales@mercantechnology.com or support@mercantechnology.com. When delivery is configured, the content is sent through Microsoft Graph in Mercan's Microsoft 365 infrastructure; your email address is included as the reply address. If delivery is unavailable, the application says that the message was neither sent nor saved.
Depending on configuration, rate limiting may use PostgreSQL or an external service over HTTPS. The application does not store the full Contact message in a separate application database table. The scope of operational records in hosting and mail systems depends on the deployed environment.
Retention and browser storage
Personal data is retained only for the period needed for the processing purpose and applicable legal obligations, then deleted, destroyed or anonymised in accordance with the applicable policy and law.
A localStorage record remembers the storage-notice choice. First-party session cookies may be used if sign-in is configured and used. No analytics or marketing tracker is active on current corporate pages. See the Cookie and Storage Information page.
Your rights under KVKK Article 11
You may ask whether your personal data is processed and request information if it is; learn the purpose and whether the data is used for it; learn the third parties to whom it is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction where applicable; and request that correction, deletion or destruction be notified to third parties who received the data.
You may also object to an outcome against you produced solely by automated analysis and seek compensation for damage caused by processing contrary to the law. Send a rights request, with enough information to identify you and your request, to info@mercantechnology.com or to Ünalan Mahallesi, Libadiye Caddesi, Emaar Residence No: 82E, İç Kapı No: 291, Üsküdar / İstanbul.
Contact the controller
Mercan Technology Group Yazılım A.Ş. — info@mercantechnology.com. Controller contact address: Ünalan Mahallesi, Libadiye Caddesi, Emaar Residence No: 82E, İç Kapı No: 291, Üsküdar / İstanbul.