Privacy & Data Protection Notice

QANAQ Dan. İnş. Med. A.Ş. (“QANAQ”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal data you entrust to us.

This notice explains what personal data we collect when you visit this website or engage with our services, why and how we use it, with whom we share it, how we protect it, and the rights available to you. We act as the data controller for this processing. We handle personal data in accordance with the Turkish Law on the Protection of Personal Data No. 6698 (“KVKK”) and, where it applies to you, the EU General Data Protection Regulation (“GDPR”) and equivalent local laws.

1. Who we are

The data controller is QANAQ Dan. İnş. Med. A.Ş., a company established in Türkiye. Our contact details are set out in Section 14. References to “our services” include this website, our project-sourcing, capital-introduction and delivery-coordination activities, and any related communications and events.

2. The personal data we collect

Data you provide to us

When you contact us, submit a project, register your interest as an investor or partner, enter a non-disclosure or onboarding process, or correspond with us, we may collect your name, company and role, business contact details (email, telephone, address), the contents of your enquiry or submission, and information relating to the project, mandate or investment you wish to discuss.

Data we collect automatically

When you visit this website we may automatically collect technical and usage information such as your IP address, device and browser type, pages viewed, referring pages and the dates and times of access. This information is collected through cookies and similar technologies (see Section 5).

Data from other sources

We may receive personal data about you from your organisation, from a party that refers you to us, from our advisers and partners, and from publicly available or commercially available sources, where this is permitted by applicable law.

3. How and why we use your data

We use personal data to:

• respond to your enquiries and manage our correspondence and relationship with you;
• assess, screen and, where appropriate, structure and match projects with capital and delivery partners;
• carry out due-diligence, eligibility, know-your-customer and anti-money-laundering checks;
• administer non-disclosure agreements and control access to confidential information;
• operate, secure and improve this website and our services;
• send you research, briefings, updates or event invitations where you have agreed to receive them or where we are otherwise permitted to do so;
• comply with our legal, regulatory and contractual obligations and protect our legal rights.

Legal bases. Depending on the activity, we rely on one or more of the following grounds: the performance of, or steps prior to entering into, a contract with you; our legitimate interests in operating and developing our business (balanced against your interests and rights); your consent (which you may withdraw at any time); and compliance with a legal obligation. Under the KVKK we rely on the corresponding conditions in Articles 5 and 6, including the establishment or performance of a contract, our legitimate interests, compliance with a legal obligation and, where required, your explicit consent.

4. Confidentiality of projects and submissions

Our model is built on confidentiality. Information you submit about a project, mandate or investment is treated as confidential and is reviewed only by authorised personnel and, where relevant, shared only with screened parties bound by confidentiality or non-disclosure obligations. We do not publish project details or counterparties.

5. Cookies and similar technologies

This website uses first-party and, where applicable, third-party cookies and similar technologies (such as pixels and analytics tags) to enable the site to function, remember your preferences and understand how the site is used. You can manage or disable cookies through your browser settings; disabling some cookies may affect how the site works. Because there is no common industry standard for “Do Not Track” signals, our site does not currently respond to them.

6. How and with whom we share your data

We do not sell your personal data. We may share it with: our affiliates and group entities; service providers who process data on our behalf under contract (for example, hosting, IT, analytics and professional advisers); screened counterparties, investors or delivery partners bound by confidentiality obligations, where relevant to a matter you have asked us to progress; competent authorities, regulators or courts where required by law; and a successor entity in connection with a merger, acquisition or reorganisation. We require our processors to protect personal data and to use it only as instructed.

7. International transfers

Because we work across global markets, your personal data may be processed in countries other than the one in which you are located, including outside Türkiye and the European Economic Area. Where we transfer personal data internationally, we apply appropriate safeguards required by applicable law — such as transfers to adequate jurisdictions, standard contractual clauses, or, under the KVKK, the conditions for cross-border transfer including, where required, your explicit consent.

8. How long we keep your data

We retain personal data only for as long as necessary for the purposes set out in this notice, including to provide our services, maintain our records, and meet our legal, regulatory and contractual obligations. When data is no longer required, we delete it or anonymise it. Retention periods vary according to the type of data and the applicable legal requirements.

9. How we protect your data

We maintain appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration, and we limit access to those who need it. No method of transmission or storage is completely secure, so while we work to protect your data we cannot guarantee absolute security.

10. Your rights

Subject to applicable law and certain exceptions, you have the right to: be informed about and request access to the personal data we hold about you; request a copy of that data; have inaccurate or incomplete data corrected; request erasure or restriction of processing; object to certain processing, including direct marketing; request portability of data you provided to us; withdraw consent where processing is based on consent; and lodge a complaint with the competent supervisory authority. Under the KVKK (Article 11) you may, among other things, learn whether your data is processed, request information about the processing and its purpose, learn the third parties to whom it is disclosed, request correction or deletion, and request compensation for damage arising from unlawful processing.

To exercise your rights, contact us using the details in Section 14. We may need to verify your identity before acting on a request, and we will respond within the period required by applicable law (under the KVKK, generally within 30 days).

11. Automated decision-making

We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing without human involvement. Where any automated tools are used, they are subject to appropriate human review.

12. Children

Our website and services are directed at professional organisations and the individuals who represent them, not at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

13. Changes to this notice

We may update this notice from time to time to reflect changes in our practices or in the law. The date at the top shows when it was last revised, and where changes are material we will take reasonable steps to bring them to your attention.

14. Contact us

If you have any questions about this notice or wish to exercise your rights, please contact us:

You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, where the GDPR applies to you, with your local data protection supervisory authority.

This notice is provided for general information about how QANAQ processes personal data and does not constitute legal advice.