KVKK Data Processing
and Privacy Terms

In server and hosting services, Netinternet keeps its customers' data in its own data center in Turkey. This page brings together the answers to the questions most frequently asked before purchasing a service.

A Supplier Confidentiality and Personal Data Protection Agreement is signed with our customers who receive services. You can download the agreement text as a PDF at the end of this page.

The Company Signing the Agreement

• Trade Name: Netinternet Bilişim Teknolojileri Anonim Şirketi
• Tax Office / No: Pamukkale / 631 073 7752
• MERSIS No: 0631073775200023
• Trade Registry: Denizli Chamber of Commerce, 17 / 31053
• KEP Address: netinternet@hs03.kep.tr
• Address: Kınıklı Mh. Hüseyin Yılmaz Cd. No:67/B01 Pamukkale / DENİZLİ

Our company is registered with VERBİS. You can query our registration by company title at verbis.kvkk.gov.tr

Shared Responsibility

In server and hosting services, data security is a responsibility shared between Netinternet and the customer. The extent of this sharing is the area each party actually controls: Netinternet operates the infrastructure and is responsible for its security; since administrator rights to the server belong to the customer, the inside of the server and the data in it are the customer's responsibility. This distinction is necessary so that the parties do not assume obligations for an area they do not control, and so that the customer, as the data controller, can correctly plan its own measures.

Netinternet's area of responsibility

• Data center facility, physical security, power and air conditioning
• Internet access and network infrastructure
• Network-level attack protection
• Virtualization and storage infrastructure
• Authorization of Netinternet personnel accessing these layers and keeping access logs

Customer's area of responsibility

• Operating system, applications, database and all content on the server
• Server access rights and password management
• Backup and encryption of the data on the server
• Detection of incidents occurring within the server and making the necessary notifications

In normal operation, Netinternet personnel do not access server content. Access takes place only upon the customer's support request and is logged. The customer is free to apply disk- or volume-level encryption on its server.

Where Is Your Data Kept?

• Your server, disk and infrastructure backups are located in the Netinternet data center in Denizli.
• Netinternet does not transfer data abroad, back up abroad, or use CDN or proxy services.
• Our support staff are located in Turkey.
• These commitments are written in the agreement text; you do not need to request a separate location statement.

The commitment covers the infrastructure operated by Netinternet. Third-party services you set up yourself (CDN, external backup, etc.) are out of scope.

Data Center Information

• Facility: Netinternet Data Center, Pamukkale University Technopark, Denizli
• Operating model: The facility is operated by Netinternet; it is not colocation.
• ISO/IEC 27001:2022: Certificate No IS-190122, PROKS Certification. The scope is written on the certificate.
• Other certificates: ISO/IEC 27701, ISO/IEC 20000-1, ISO 22301 and ISO 9001
• The validity of our certificates can be verified with the QR code on them.

All our certificates: Our Certifications

[There is no Uptime Institute Tier or TSE data center certificate.] Our power, cooling and redundancy structure: Power, Cooling, Security

Sub-processors

• We do not use any sub-processor that accesses the data on your server. The data center and virtualization infrastructure are operated by Netinternet.
• To protect your IP addresses from DDoS attacks, we receive a DDoS mitigation service from a domestic operator. This service works only on network traffic; it has no access to the data on your server.
• If a sub-processor with access to data is to be added, you will be notified in writing in advance.

Confidentiality

• All our personnel sign a written confidentiality undertaking upon hiring; the undertaking continues after they leave.
• Your data is not used for marketing, product development, artificial intelligence training, sale or transfer to third parties.
• Confidentiality provisions are included in the agreement; a separate confidentiality undertaking is not required.
• Legal requests from authorized public institutions are handled under the following policy: Hosting Provider and Legal Obligation Policy

Security Incidents and Applications

• If a security incident affecting your service occurs in our infrastructure, you will be informed without delay. Incident process: Incident Management Policy
• Detection of incidents within the server and the necessary official notifications are the responsibility of the customer managing the server.
• A personal data application regarding your data that reaches us is forwarded to you within [3] business days without being answered by us.

Backup

• No standard backup is performed on behalf of the customer on virtual and physical servers; backup responsibility lies with you.
• If you wish, you can additionally purchase the 1, 2 or 3-day automatic system snapshot service.
• Netinternet keeps infrastructure-level backups in order to run servers on other hardware in case of hardware failure. These backups are stored in Turkey [encrypted], deleted after [N] days, and are not a backup guarantee given to you.

Suspension, Deletion and End of Service

In case of late payment:

• Within 7 days after the due date, 3 reminders are sent by e-mail; at the end of the 7th day the service is suspended.
• The data of a suspended service is kept for 10 days; at the end of the 10th day it is completely deleted.
• If payment is made within this period, the server is reopened with its data and you can export your data yourself.

When the service ends:

• You export your data yourself before the service ends; Netinternet does not provide a separate data handover.
• The virtual disk is deleted; infrastructure backups are automatically deleted within [N] days at the latest.
• A written destruction report is provided upon request.
• Since storage is shared, deletion is performed at the logical level; physical disks are destroyed at end of life.

Technical Measures We Apply

• Multi-layered physical access control and logging in the data center
• Role-based access for personnel; multi-factor authentication for administrator access
• Anti-DDoS protection by default on all services
• Virtualization-level isolation between customer servers
• Secure deletion and destruction procedure
• Independent certification audit once a year

Details: Information Security Policy · KVKK Compliance · Supplier Security Policy

If You Would Like to Sign the Agreement

The agreement text is the same for all our customers; no customer-specific changes are made. To sign:

1. Download the PDF below.
2. Fill in your party information (title, address, tax information, authorized person) and sign.
3. Send the signed copy to our KEP address (netinternet@hs03.kep.tr) or via [e-mail address].
4. The countersigned copy is sent to you through the same channel.

Our Commitment

In server and hosting services, Netinternet;

• to keep your data within the borders of Turkey,
• to define the limits of responsibility clearly and auditably,
• to assume data processor obligations through a written agreement

is committed.