Nexren Shield1Data Controller and General Provisions
Provider Identity
This Privacy Policy and Personal Data Protection Disclosure is provided by Nexren Shield Bilişim Teknolojileri A.Ş. ("Nexren Shield", "Company", or "Data Controller"), headquartered in the Republic of Turkey.
Scope of Activity
Our platform provides autonomous cyber defense and reverse proxy architecture designed to secure web applications, corporate websites, and REST APIs against volumetric cyber attacks, DDoS threats, web vulnerabilities, and botnet abuse.
Legal Compliance Framework
Our company operates in strict adherence to Law No. 6698 on the Protection of Personal Data ("KVKK"), the EU General Data Protection Regulation ("GDPR"), Law No. 5651, and all relevant regulatory standards.
Privacy by Design
Nexren Shield is built upon the "Privacy by Default" standard. Legitimate HTTP request payloads forwarded across our network are never permanently stored, scanned, or transmitted to third-party tracking engines.
2Categories of Personal Data Processed
Customer and User Account Information
Usernames, enterprise email addresses, securely hashed credentials, multi-factor authentication (2FA/TOTP) credentials, and administrative configuration audit logs are processed.
Contact and Support Records
Name, email address, inquiry subject, selected department, and message details submitted via our contact or support portals are processed solely to resolve technical requests.
Network and Cybersecurity Telemetry
To detect and mitigate malicious attacks, client IP addresses, ports, protocol types, request timestamps, User-Agent strings, HTTP request methods, and destination URLs are evaluated in real time.
Security Event Records
Malicious attempts identified by WAF and DDoS mitigation rules (such as SQL injection, XSS, and automated bot probes) are recorded as operational security events.
3Cookie Policy and Preference Management
Strictly no advertising or marketing cookies
Nexren Shield does NOT utilize Google Analytics, Meta Pixel, ad retargeting tags, or commercial tracking beacons. Only strictly essential technical cookies required for core security and functionality are deployed.
Strictly Necessary Security & Session Cookies
Mandatory technical security cookies are deployed to filter automated botnet abuse and safeguard legitimate user traffic. These cookies are technically necessary to ensure platform integrity and uninterrupted service.
Preference Storage
Local browser storage is used strictly to remember user interface preferences, such as language (Turkish / English) and theme modes (Dark / Light).
Cookie Lifespan
Security session cookies are temporary and expire automatically upon closing your browser or within a maximum of 24 hours depending on the active security profile.
Managing Cookies
Users may clear cookies via browser settings at any time; however, disabling strictly necessary security cookies may trigger recurrent verification challenges.
4Processing Purposes & Legal Grounds
Processing Purposes
Technical and operational data is processed to mitigate cyber attacks, preserve service availability, respond to technical support inquiries, and fulfill statutory logging mandates.
Legal Grounds (KVKK & GDPR)
Data processing relies on KVKK Art. 5/2-c (contract performance), Art. 5/2-ç (compliance with legal obligations), Art. 5/2-f (legitimate interests), and GDPR Art. 6(1)(b), (c), (f).
5Retention Periods & Data Deletion Policy
Security Logs & Threat Telemetry
WAF security incident logs, blocked attack metrics, and telemetry data are retained for a maximum of 7 days, after which they are automatically and permanently purged from active systems.
Statutory Access Logs (Law No. 5651)
Internet traffic access logs required under Law No. 5651 are maintained in encrypted archives for the statutory period of 1 to 2 years and erased upon expiration.
Account & Support Ticket Data
Account information is maintained for the duration of active service, while customer support submissions are retained for statutory limitation periods following resolution.
Secure Disposal Methods
All expired personal data is purged in accordance with data erasure guidelines using secure cryptographic deletion and data overwriting standards.
6Data Transfers, Recipients & Infrastructure Location
Prohibition of Commercial Data Sales
Nexren Shield strictly NEVER sells, leases, or trades user or visitor data to third parties for marketing, profiling, or commercial exploitation.
Secure Transit to Origin Backends
Legitimate web traffic passing verification is forwarded over encrypted channels to the customer's specified origin backend. Downstream processing remains governed by the customer's own privacy policy.
Law Enforcement & Legal Inquiries
Information is disclosed to public authorities, judicial courts, and telecommunication regulators exclusively when mandated by lawful process or court orders.
Infrastructure Hosting Location
Nexren Shield server infrastructure and data storage are hosted on a virtual server in a data center located within the Republic of Turkey.
7Data Subject Rights (KVKK Art. 11 & GDPR Art. 15-22)
Pursuant to KVKK Art. 11 and GDPR Art. 15-22, data subjects possess the following legal rights:
Learning whether your personal data is processed, requesting information if your personal data has been processed, learning the purpose of processing and whether it is used in line with that purpose, knowing the third parties to whom personal data is transferred in Türkiye or abroad, requesting correction if personal data is processed incompletely or incorrectly, requesting deletion or destruction of data under Article 7 of the KVKK, objecting to an outcome against you arising from the analysis of processed data exclusively by automated systems, and requesting compensation for damage you suffer because your personal data was processed unlawfully.
8Application Procedures & Inquiries
Application Channels
You may submit your requests regarding the rights listed above to the Data Controller in writing through the official Technical Support and Contact Portal or from your corporate email address registered in the system.
Response Timeframe
Properly submitted requests will be evaluated and finalized free of charge within thirty (30) calendar days at the latest.
9Technical & Organizational Security Safeguards
Technical Measures
All data in transit is protected using modern TLS 1.3 encryption, network packet filtering, role-based access control (RBAC), multi-factor authentication (2FA), and routine security vulnerability patching.
Organizational Measures
Internal access is restricted strictly to authorized technical engineers on a need-to-know basis, coupled with periodic compliance audits and confidentiality obligations.
10Effectiveness, Revisions & Jurisdiction
Updates & Effectiveness
This Privacy Policy is effective immediately upon publication. Updated versions reflecting legal or operational adjustments will be published directly on this website.
Governing Law & Jurisdiction
This Policy is governed by the laws of the Republic of Turkey. The courts and execution offices of Istanbul (Çağlayan) hold exclusive jurisdiction over disputes.
For your questions: contact@nexren.net