Privacy notice
This is the English summary of our Turkish privacy notice, prepared under the Turkish Personal Data Protection Law No. 6698 (KVKK). It covers the hisartuning.com website and the portal.hisartuning.com tuner portal. The Turkish text prevails. Last updated 9 October 2026.
1. Data controller
| Business | Hisar Oto · Hisar Tuning |
|---|---|
| Owner | Recep Ateş (sole trader) |
| Address | Şeker Mah. Yeni Sanayi Sitesi, 6115. Sokak No:18, 38070 Kocasinan / Kayseri, Türkiye |
| Tax office / no | Mimarsinan · 1000935935 |
| [email protected] | |
| Phone | +90 537 376 19 74 |
| +90 537 376 19 74 |
2. The website (hisartuning.com)
The website has no ads, no social media plugins and no tracking cookies. Visits are counted with Cloudflare Web Analytics: when a page opens, a measurement request with the page address, browser and time goes to Cloudflare. It sets no cookie on your device and does not identify you. The site is hosted on Cloudflare, which processes connection data (IP address, request time) to run and protect the service.
If you are signed in to the portal, the website asks portal.hisartuning.com whether your session is open, so it can show your name in the header and open the price list. Only the portal reads its own cookie; the website stores nothing for this.
The WhatsApp and call buttons hand you over to the app on your own device. From then on, WhatsApp's (Meta Platforms) own privacy rules apply.
3. The tuner portal (portal.hisartuning.com): what we process
- Account: your name, account type (company or individual), company name for company accounts, e-mail address, phone number, country, billing address, city and postal code, interface language, the version and date of the terms you accepted, account status and last sign-in. Your password is never stored in readable form, only as a one-way hash.
- Invoice and payment details: an invoice is issued for every payment. At sign-up and with each top-up we take: your name or company name, address, city, postal code, country and the e-mail address for invoices; for company accounts also a tax number or EU VAT ID (on older records, the tax office). Individual accounts are not asked for a tax number. The invoice itself (PDF) is stored encrypted on the server, sent to you by e-mail and shown on your Credits page in the portal; if an invoice is corrected, the earlier version stays in our records.
- Orders and vehicles: vehicle type, make, model, engine and generation, model year, ECU, the tool you read it with, the jobs you pick and their prices, your order notes and the order status history.
- Software files: the original ECU files you upload and the modified files we deliver. These files may contain vehicle identifiers such as the VIN. They are stored encrypted on the server.
- Credit transactions: top-up requests, amount, method (bank transfer or card), transfer reference, approvals and cancellations, and credits held, spent or refunded for orders.
- Card payments: you enter your card on iyzico's payment page; your card details never reach us. To start the payment we send iyzico your name, the name on your invoice, e-mail, phone, billing address (with city, postal code and country), your customer code, IP address, the amount and a payment reference; for customers in Türkiye also the 11-digit national ID number, if one was given for the invoice. iyzico tells us the result, together with the card type and the last four digits of the card.
- Security logs: events such as sign-in attempts, file uploads and downloads and admin actions, with IP address and time.
- Bot protection: sign-up, sign-in and some forms use Cloudflare Turnstile. To verify, the token from your browser and your IP address go to Cloudflare.
4. Cookies and browser storage
We use no advertising or tracking cookies. Everything we use is strictly needed for the service to work and stay secure, so there is no cookie banner.
- Website: hisartuning.com sets no cookies for visitors, and visit counting (Cloudflare Web Analytics) uses no cookies or browser storage. The only exception is a one-year technical cookie (
hisar_ok) stored on devices opened with a special access link given by Hisar Tuning, to allow access to the site. It contains no personal data. - Portal session cookie (
ht_oturum;hp_oturumin the admin panel): set when you sign in and needed to recognise your session. It is sent only to the portal, cannot be read by scripts (HttpOnly), travels only over encrypted connections (Secure) and is not attached to requests from other sites (SameSite=Strict). It lasts 12 hours and is deleted when you sign out. - Language: the portal keeps the language you pick in your browser's local storage (
hp_dil). - Security check: Cloudflare Turnstile and Cloudflare's bot protection may set Cloudflare's own security cookie (e.g.
__cf_bm) during the check. It is used only to tell automated traffic apart.
5. Purposes and legal basis
To open your account, verify your e-mail, sign you in, take your order, process and deliver your file and handle revisions; to top up credit, take payment, refund, issue invoices and keep records required by tax law; to send service e-mails (verification, password reset, order status, payment confirmation, invoices); to keep accounts and systems secure (logs, attempt limits, bot protection, backups) and notify the Hisar team internally; to count website visits; to protect our rights in a dispute; and to answer you when you contact us by WhatsApp, phone or e-mail. The legal bases are those of KVKK article 5 (contract, legal obligation, legitimate interest, establishing and defending rights), as listed in the Turkish text. No marketing processing; no campaign messages without your consent.
6. Who we share data with
Your data is never sold. To run the service we share it, only as far as needed, with:
- Hetzner Online GmbH (Germany, Nuremberg data centre): portal server, uploaded files and database backups.
- MongoDB Atlas (MongoDB, Inc.; data in the Amazon Web Services region Frankfurt, Germany): portal database.
- Cloudflare, Inc. (US-based, global network): website hosting, visit counting, Turnstile bot protection, domain infrastructure and the off-server copy of the database backup and of the uploaded files in encrypted form, including invoice PDFs (Cloudflare R2, Western Europe).
- Resend (Plus Five Five, Inc., US): sending verification, password reset, order, payment confirmation and invoice e-mails (your e-mail address and the message content; for invoice e-mails, the attached invoice PDF). Resend's main processing takes place in the US; e-mails are sent from its EU (Ireland) region.
- Google (Google Workspace): the [email protected] mailbox and the Hisar team's mailboxes, holding the e-mails you send us, our replies and internal notification e-mails.
- iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (Türkiye): card payments, with the payment details listed above.
- Electronic invoicing (Türkiye): the e-Archive invoice system of the Turkish Revenue Administration or an e-invoice provider it has authorised; the invoice details listed above.
- Telegram: internal notifications to the Hisar team (new sign-up, order, payment). They never include your name, e-mail or phone, only your customer code (e.g. T0001), the order number, the vehicle make and model, and the amount.
- Software and maintenance provider: Benuka Tech Yazılım ve Bilişim Limited Şirketi (Çankırı V.D., VKN 1640976409), which builds and maintains the website and portal and manages their hosting, can access the systems as far as that work requires.
- Our accountant and the Turkish tax authority for invoicing; public authorities on a lawful request.
- When you talk to us on WhatsApp, the messages sit on Meta Platforms servers.
- When files are processed with third-party tuning software providers, only the technical file is sent, never your identity.
Some of these providers are outside Türkiye; these transfers are made under KVKK article 9.
7. How we collect it
You give it to us through the portal forms, file uploads, e-mail, WhatsApp, phone or in person. Security logs are recorded automatically while you use the portal. The tools we connect to a vehicle only read the software in its control unit.
8. How long we keep it
- Software files: 5 years from the first delivery of the order (for a cancelled order, 5 years from its last update), then deleted from disk and from the off-server copy by an automatic monthly clean-up; the order record stays.
- Invoices (including invoice PDFs and the earlier version of a corrected invoice), payments and credit transactions: for as long as Turkish tax and commercial law requires.
- Account details: while your account is open; when it is closed, anything we are not legally required to keep is deleted.
- Unfinished order drafts without a file: 30 days.
- Security logs: 1 year, then deleted automatically.
- Sessions and links: a session lasts 12 hours, an e-mail verification link 24 hours, a password reset link 1 hour; expired ones are deleted.
- Backups: database backups are kept 14 days on the server and 30 days off the server. The off-server copy of uploaded files and invoice PDFs is kept for as long as the file itself.
- Messages that never turn into a job (WhatsApp, e-mail): at most 1 year.
9. Security
The website and portal only work over encrypted connections (HTTPS). Uploaded files are stored encrypted, passwords only as hashes, each tuner sees only their own orders and files, and only the Hisar team and the maintenance provider named in section 6 can reach the admin panel.
10. Your rights
Under KVKK article 11 you can ask whether we process your data, get information and a copy, learn the purpose and who received it, have it corrected or deleted and have those recipients told, object to a result against you that comes only from automated analysis, and claim damages.
11. How to reach us
Write to the address above, or e-mail [email protected] from the address registered to your portal account, with enough detail to verify your identity. We answer within 30 days, free of charge. You may also complain to the Turkish Personal Data Protection Authority.