Privacy Policy

About this policy

This Privacy Policy explains how we process the personal data of people who visit the MHS Links Media site at mhslinks.com/media, fill in our contact, quote request or free assessment forms, subscribe to our newsletter, use our chat assistant or contact us in any other way.

It is our privacy notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), our information notice under Article 13 of the EU General Data Protection Regulation (“GDPR”) where the GDPR applies, and our notice under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”). The GDPR applies to the extent that we offer our services to people in the European Economic Area (“EEA”).

Data controller

MHS Links provides its services through MHS LINKS CONSULTANCY L.L.C S.O.C in the United Arab Emirates and MHS Danışmanlık ve Ticaret Limited Şirketi in Türkiye (together “MHS Links” or “we”). The company responsible for your personal data (the data controller) is:

• If you are resident in Türkiye: MHS Danışmanlık ve Ticaret Limited Şirketi, the data controller under the KVKK.
• In all other cases (including people in the EEA): MHS LINKS CONSULTANCY L.L.C S.O.C, the data controller under the GDPR and the UAE PDPL.

For any question or request about your privacy, write to us at [email protected]. Our company details:

United Arab Emirates

Türkiye

Personal data we process

We only process the data we need to handle your request and to run the site securely. Which data we process depends on how you use the site:

• Forms (contact, quote request and free assessment): your full name, email address, phone number, company name, website address, the package or service you are interested in, your budget range, your project preferences (such as the number of pages, languages, features and design style), your goals and message, and the fact that you ticked the form’s consent box.
• Newsletter: your email address and the date you subscribed.
• Email and other correspondence: when you write to us directly, your name, contact details and the content of the correspondence.
• Chat assistant: the messages you write, your name if you share it, a random ID for the chat, the address, title and language of the page where the chat started, and the time of each message (details below).
• Technical data: when you visit the site, the IP address your browser sends, browser and device information, the date and time of the visit and the page opened. These are kept in the server logs of our hosting infrastructure.
• Stored in your browser: your theme choice, your cookie preference and the chat assistant’s data. This information stays on your device; see the Cookie Policy for details.

If you do not fill in the required fields of a form, we cannot receive your request or get back to you; the other fields are up to you. We do not take payments or ask for payment details on our sites.

We do not ask for special categories of personal data (such as health, religion, ethnic origin or biometric data); please do not enter such information, passwords or card details in forms or in the chat. Our sites are not intended for people under 18.

Purposes and legal bases

We process your data for the purposes below, on the legal bases shown next to each. “KVKK” refers to the legal bases in Article 5 of the KVKK, and “GDPR” to those in Article 6 of the GDPR.

Where we rely on legitimate interest, our interests are to respond to business enquiries quickly and accurately, to keep our site and systems secure and to improve the quality of our service. You can object to this processing at any time.

The consent box on our forms confirms that you know your data will be processed as described in this policy to reply to your request; that processing relies on the legal bases above.

Whenever processing requires your explicit consent, we ask for it separately, and you can withdraw it at any time. If we start using analytics or marketing cookies, they will also run only with your explicit consent.

Chat assistant

The chat assistant on every page of our sites answers your questions using artificial intelligence; the chat window also states that the replies are generated by AI. You do not need an account to use it.

When you start a chat, each message you write is sent to our server and to our AI service provider so that a reply can be generated. Together with the message, we send the latest messages of the chat (for context), the chat ID, the address, title and language of the page and, if you shared it, your name.

The chat history (the last 80 messages), the chat ID and the fact that you accepted the notice are stored in your browser, so the chat continues when you change pages. You can delete the history with the “New chat” button, and remove all chat data by clearing this site’s data in your browser.

Chats may be recorded to review and improve the quality of our service. The assistant does not make automated decisions about you that have legal or similarly significant effects; its replies are for information only and may contain mistakes. For important matters, please contact our team directly.

Who we share data with

We do not sell your personal data or share it with third parties for advertising. We share it only with the following recipients, and only as far as needed:

• Our group companies: MHS LINKS CONSULTANCY L.L.C S.O.C and MHS Danışmanlık ve Ticaret Limited Şirketi, and the team your request concerns (MHS Links AI, MHS Links Cyber, MHS Links Media or MHS Links Defence).
• Our service providers (data processors): companies that provide hosting and form infrastructure, email delivery and the AI service behind the chat assistant. They process your data only on our behalf and on our instructions, under the confidentiality and security obligations of their contracts.
• Google (maps): If you choose to show the map on our contact pages, it loads from Google Maps and your IP address and browser details are sent to Google, which processes them under its own privacy policy. Nothing is sent to Google unless you press the button.
• Our advisers: the lawyers and accountants we work with for our legal and financial obligations, who are bound by professional confidentiality.
• Public authorities: only where the law requires it or in response to a legally valid request.

You can ask for the current list of our service providers at [email protected].

International transfers

One of our companies is in the United Arab Emirates and the other in Türkiye, and some of our service providers may have servers in other countries (for example, EU countries and the United States). Your personal data may therefore be transferred outside the country you are in.

For transfers from Türkiye, we comply with Article 9 of the KVKK: we base the transfer on an adequacy decision of the Turkish Personal Data Protection Board or on appropriate safeguards such as the standard contracts set by the Board; in occasional cases where these are not available, we rely on one of the exceptions listed in the law (for example, where the transfer is necessary to perform a contract, or on your explicit consent).

For transfers from the EEA, we comply with Chapter V of the GDPR: for countries without an adequacy decision of the European Commission, we use the Commission’s standard contractual clauses or other appropriate safeguards. You can ask for a copy of these safeguards at [email protected].

How we collect data

We collect your personal data electronically: directly from you through the forms you fill in, the emails you send us and the chat assistant, and by fully or partly automated means through server logs and browser storage when you visit the site. Collection relies on the legal bases listed under “Purposes and legal bases” above.

How long we keep data

We keep your data only for as long as the purpose requires and for the periods set by law:

• Requests that do not lead to a contract: for a reasonable period after your request is completed, so we can answer any follow-up questions; then the data is deleted or anonymized.
• Customer relationship and contracts: for the term of the contract and, after it ends, for the periods required by tax and commercial law (in Türkiye, generally 10 years for commercial books and records).
• Newsletter: until you unsubscribe or withdraw your consent. After you unsubscribe, we may keep your address only to make sure we do not email you again.
• Chat assistant: the chat in your browser stays until you start a new chat or clear your browser data. Chat records on our servers are not kept longer than the quality and security purposes require.
• Server logs: for the short period needed for security, or for as long as the law requires them to be kept.

When the period ends, your data is deleted, destroyed or anonymized. If there is a dispute or a legal request, the data concerned may be kept until it is resolved.

Data security

We take appropriate technical and organizational measures to protect your data against unauthorized access, loss and misuse: data is transmitted over an encrypted connection (HTTPS), access is limited to the people who handle your request, and our contracts with service providers include confidentiality and security obligations. In the event of a data breach, we notify the competent authority and, where required, you, within the time limits set by law.

Your rights

Under Article 11 of the KVKK, you have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Türkiye or abroad to whom your data is transferred;
• ask for incomplete or inaccurate data to be corrected, and for your data to be deleted or destroyed under the conditions set by the law;
• ask for these corrections, deletions and destructions to be notified to the third parties to whom the data was transferred;
• object to a result against you that arises from the analysis of your data exclusively by automated systems;
• claim compensation if you suffer damage because of unlawful processing.

Where the GDPR applies (Articles 15–22), you also have the right to:

• access your data and receive a copy;
• have inaccurate or incomplete data corrected;
• have your data erased;
• have the processing restricted in certain cases;
• receive the data you provided, where processing is based on your consent or a contract and carried out by automated means, in a structured, commonly used format, and have it transmitted to another controller (data portability);
• object to processing based on legitimate interest and to direct marketing;
• withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

Under the UAE PDPL, you also have the right to access your data, have it corrected or erased, have the processing restricted or stopped, and have your data transferred.

Requests and complaints

To exercise your rights, write to us at [email protected]. Under the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller, you can also send requests under the KVKK in writing, by registered electronic mail (KEP), with a secure electronic or mobile signature, or from an email address you have previously given us that is registered in our systems. Our postal addresses:

• If you are resident in Türkiye: MHS Danışmanlık ve Ticaret Limited Şirketi, Küçükbakkalköy Mah. Tanzimat Sk. Ekmo Life Sitesi No: 18-20C İç Kapı No: 20 Ataşehir/İstanbul, Türkiye
• In all other cases: MHS LINKS CONSULTANCY L.L.C S.O.C, Office GF-82, Wafi Residence Office LHEU, Opposite Dubai Health Care City Metro, Al Razi Street, Umm Hurair II, Bur Dubai, Dubai, United Arab Emirates

Please include your full name, your Turkish ID number if you are a Turkish citizen (or your nationality and passport or ID number if you are not), your address for correspondence, your email address if you have one, and your request. We may ask for additional information to verify your identity.

We complete your request free of charge as soon as possible and within thirty days at the latest, depending on its nature; if it involves an additional cost, we may charge the fee set by the Turkish Personal Data Protection Board. We respond to requests under the GDPR within one month; where necessary, this can be extended by two further months, and we will let you know.

If your request is rejected, you find our answer insufficient or we do not answer in time, you can complain to the Turkish Personal Data Protection Board within thirty days of learning of our answer and in any case within sixty days of your request. If you are in the EEA, you also have the right to complain to the data protection authority in the country where you live or work or where the infringement took place; if you are in the UAE, to the UAE Data Office.

Changes

We may update this policy to reflect changes in the law or in our services. The current version is always published on this page, with the “Last updated” date at the top.