Data Protection Notice
Last updated: 2026-10-17
Data Controller
This notice is prepared by TÜV AUSTRIA SILA KALİTE as data controller, under the Turkish Personal Data Protection Law (KVKK, Law No. 6698).
Personal Data Processed and Purpose
On our website, (i) identity and contact details submitted via the contact/quote form are processed to respond to your request and conduct quotation processes; (ii) identity (including Turkish ID number), contact and professional details in certification application forms are processed for ISO 9712/ISO 17024 personnel certification, where identity verification is an accreditation requirement; (iii) career form details for candidate evaluation; (iv) survey and complaint/appeal submissions for accreditation-required quality processes; (v) the certificate number and full name you enter on the certificate verification page are processed solely to confirm the certificate's validity (see "Certificate Verification").
Special Categories of Data
The physical-disability information you may declare in the welder/brazer application is a special category (health) datum under Art. 6 of the KVKK, processed solely to ensure exam safety and suitable exam conditions, on the explicit consent you give via the separate consent box on the application form. Withholding this consent does not prevent the evaluation of your application.
Legal Basis
Your data is processed on the legal bases of being directly related to the establishment or performance of a contract, legal obligation (accreditation legislation) and legitimate interest under KVKK Art. 5/2; for special-category (health) data, it is processed on your explicit consent under KVKK Art. 6.
Certificate Verification
Under accreditation rules and its certification procedures, TÜV AUSTRIA SILA KALİTE must enable third parties (e.g. employers, clients, auditors) to verify the certificates it issues. When the certificate number and the holder's full name are entered together correctly, the verification page shows the certificate number, name, a masked form only of the national / foreign ID number, the standard and scope, issue and expiry dates, the employer named on the certificate (welder certificates) and the current status (valid, suspended, withdrawn or expired); making suspension and withdrawal verifiable is required by the certification scheme and the certification agreement. Certificates are not published as a list; details are shown only to someone who knows both the number and the full name. Full ID numbers, contact details, exam results and health data are never shown. This processing is based on Art. 5/2-c (performance of the certification agreement), Art. 5/2-ç (legal obligation arising from accreditation rules) and Art. 5/2-f (legitimate interest in certificates being verifiable) of the KVKK. The employer name is taken from information provided by the holder or the employer during the certification application.
Data of People Running a Verification Query
The full name you enter on the verification page is used only to check for a match and is not stored. To prevent misuse, the time of the query, the certificate number queried, whether a record was found and a masked form of your IP address or a digest (pseudonym) derived from it are kept as a security log: records before 07:32 (Turkish time) on 10 September 2026 contain the masked IP address, later records contain the digest; your full IP address is not written to this log. For short-term query limits, digest keys derived from your IP address and the certificate number queried are used and expire automatically after a short time.
Transfer
Your data is transferred to service providers acting as data processors: site hosting and content delivery (Vercel Inc., USA), email delivery of form notifications (Resend Inc., USA), database services (Supabase), short-term request-limit counters that prevent misuse (Upstash) and — limited to messages you type into the AI assistant — response generation (Anthropic PBC, USA). Cross-border transfers comply with Art. 9 of the KVKK. Beyond this, your data is not shared with third parties except for legal obligations, and is never sold or transferred for marketing purposes.
Retention Period
Your data is retained for the period required by the processing purpose and statutory limitation periods, after which it is deleted, destroyed or anonymised. For certificate verification, certificate details remain verifiable while the certificate is valid and for at least one certification period after expiry, up to 10 years; query security logs are deleted after 1 year.
Your Rights
You may exercise your rights — including learning whether your data is processed and requesting correction or erasure — by writing to info@tuvsila.com.
Effective Status
This notice is currently in effect; it is updated when necessary and the current version is published on this page.