Privacy Policy

This Privacy Policy has been prepared by Önder Yazılım ("Company") to inform you about the purposes, legal grounds, collection methods and your rights regarding the processing of your personal data.

1. Collection of Personal Data

Your personal data is collected through the following channels:

• Contact Form: Your name, surname, email address and message content.
• Cookies: When you visit the website, your IP address, device information, browser type and site usage data via your browser.
• Email Correspondence: Personal information you provide directly via email.
• ZREST Access Logs: Licence key, matched licence/customer name, resolved host, the location parameter (which may be a full URL), package version, referrer, user-agent, request time and verification result. The ZREST application access log does not collect the client IP address.

2. Purposes of Processing Personal Data

The personal data collected is processed for the following purposes:

• Responding to your contact requests and managing customer relations
• Providing information about available services
• Analysing and improving website performance
• Fulfilling legal obligations
• Conducting statistical analyses (anonymously)
• Auditing ZREST licence access, identifying unregistered installations and investigating abuse

3. Sharing of Personal Data

Your personal data may be shared with the following third-party service providers:

Your personal data is not shared with third parties other than the service providers listed above and is not used for commercial purposes.

4. Protection of Personal Data

Önder Yazılım takes the necessary technical and administrative measures to ensure the security of your personal data:

• The website is protected with SSL (HTTPS) encryption.
• Access to personal data is limited to authorised persons only.
• The privacy policies of third-party service providers are regularly evaluated.

5. Your Rights

You have the following rights regarding your personal data:

• The right to know whether your personal data is being processed
• The right to request information if your personal data has been processed
• The right to know the purpose of processing your personal data and whether it is used in accordance with that purpose
• The right to know the third parties to whom personal data is transferred domestically or abroad
• The right to request correction if your personal data is incomplete or inaccurately processed
• The right to request deletion or destruction of your personal data
• The right to object to a result arising against you through analysis of processed data exclusively via automated systems
• The right to claim compensation for damages in case your personal data is processed unlawfully

To exercise the above rights, contact info@onderyazilim.com. Your request will be finalised within 30 days at the latest.

6. Cookie Policy

The website uses cookies to improve user experience and analyse site performance.

6.1 Types of Cookies Used

6.2 Cookie Management

You can change your analytics preference at any time with the Change Cookie Preference button in the footer. When analytics is declined, Google Analytics storage is not permitted; the Google tag may send limited cookieless measurement signals. You can separately delete existing cookies in your browser settings.

7. Retention of ZREST Access and Discovery Records

ZREST access logs are retained for security and licence auditing. The ZREST application access log does not collect or store the client IP address. Access records containing the licence key, matched licence/customer name, host, location, package version, referrer, user-agent, request time and verification result are kept for 180 days; records beyond that period are deleted automatically during daily maintenance. If no requests arrive for an extended period, maintenance runs with the next ZREST request.

Servers observed with a discovery licence are also tracked in a deduplicated list. The list contains the server name, latest location value, first- and last-seen times, request count, notification status and attempts, and the latest notification error. Further requests from the same server update the existing record rather than creating a new row. This list is not deleted automatically after a fixed period; it is reviewed manually for discovery follow-up and to prevent duplicate notifications.

A Formspree notification is created when a discovery host is first seen. Its payload contains only the host, location and first-seen time; the licence key and user-agent are not included. ZREST does not log the client IP address, while Formspree may see the connecting web server's IP address as technical connection data.

8. Changes

This Privacy Policy may be updated from time to time in line with changes in legal regulations or company policies. The updated policy will be published on this page.