This page is the web summary of Annex-6 (Protection of Personal Data) v2.3 of the RegPEX Participation Agreement. The binding text is Annex-6 in the agreement set; in case of conflict, the agreement set and the Turkish text prevail (Agreement set).
1. Data Controller
The data controller is 3C1B Telekomünikasyon ve İnternet Hizmetleri Sanayi ve Ticaret A.Ş. ("3C1B"). "RegPEX" is the trade name (brand) of 3C1B's internet exchange point activity; it is not a separate legal entity or a separate data controller.
| Legal name | 3C1B Telekomünikasyon ve İnternet Hizmetleri Sanayi ve Ticaret A.Ş. |
| Registered office | Yukarı Öveçler Mahallesi, 1280 Sokak No: 5A, 06460 Çankaya / Ankara, Türkiye |
| Tax office / Tax ID (VKN) | Maltepe Tax Office / 0012106304 |
| MERSIS no. | 0001210630400001 |
| Trade registry no. | 269125 |
| Telephone | +90 312 988 00 00 |
| KEP (registered e-mail) | 3c1b@hs02.kep.tr |
| E-mail / web | kvkk@3c1b.com · www.3c1b.com/kvkk · regpex.tr |
| VERBIS registry no. | 27832826 |
3C1B determines the purposes and means of processing itself; in this relationship it does not act as a data processor on behalf of the PARTICIPANT but is a data controller for its own purposes (Annex-6 cl. 1.2–1.3, 1.5).
2. Scope
2.1. The PARTICIPANT is a legal entity, and legal-entity data falls outside the scope of Law No. 6698 (KVKK). This policy covers only the personal data of the natural persons who represent the PARTICIPANT or act as its technical/administrative contact (authorised signatory, technical contact, NOC contact) (Annex-6 cl. 1.1–1.2).
2.2. The PARTICIPANT is responsible for informing these persons and for providing the required notice in its own capacity as a data controller (Annex-6 cl. 1.2).
2.3. For hobby members, the processing of personal data is subject to a separate privacy notice: the RegPEX Hobby Membership Privacy Notice (PDF, v1, Turkish only; all blank templates: Agreements).
3. Personal Data Processed
| Category | Data | Source |
|---|---|---|
| Identity | Name, surname (application form) | Application |
| Identity (signature stage) | Turkish ID number for the authorised signatory of a Türkiye-resident PARTICIPANT; passport or corporate authority document for a foreign signatory | Only after the application is accepted, at the agreement signature stage; not collected on the application form |
| Contact | Business e-mail; telephone (optional) | Application and membership records |
| Operational contact | NOC contact point, technical contact information | Annex-2.1 |
| Transaction security | Authorised transaction/approval records, signature record | Contract process |
3.1. The Turkish ID number is not processed for the authorised signatory of a foreign PARTICIPANT; identity is verified through a passport or a corporate authority document.
3.2. The Turkish ID number is processed only to the extent mandatory for identity verification of the authorised signatory of a Türkiye-resident PARTICIPANT and for notifications to the BTK required by legislation; access is limited to authorised personnel on a least-privilege basis (role-based access control and access trail) (Annex-6 cl. 2.6).
4. Traffic Measurement Data
4.1. 3C1B measures traffic on the RegPEX platform solely for platform and participant security (IP spoofing, DDoS prevention), aggregate traffic graphs/statistics, and verification of the enforcement of the defined speed and of the connection record, in aggregate at port/flow level. For the usage-limit review (Annex-2.7) it additionally uses only the header fields of sampled flow data (sFlow) (Annex-6 cl. 2.5).
4.2. IP addresses in sFlow headers may constitute personal data; they are processed on the basis of legitimate interest (KVKK Art. 5/2-(f)), solely for review and security purposes. Raw samples are retained for 14 days and summaries for 90 days (Annex-6 cl. 2.5; Annex-2.7(d)).
4.3. This measurement does not target individual end users and is not collected for retention purposes. 3C1B is not a content/traffic logging obligor in this respect (Annex-6 cl. 2.5).
5. Purposes and Legal Bases
| Purpose | Legal basis (KVKK Art. 5/2) |
|---|---|
| Conclusion and performance of the participation agreement | (c) necessity for the conclusion/performance of a contract |
| Submission of the agreement to the BTK and interconnection notifications (Participation Agreement Art. 11) | (a) expressly provided for by law / (ç) legal obligation |
| Invoicing | (c) performance of the contract |
| Operational communication, incident/security management | (f) legitimate interest |
| Usage-limit review (IP addresses in sFlow headers; review/security only) | (f) legitimate interest |
Processing complies with the principles in KVKK Art. 4 (lawfulness, accuracy, specified-explicit-legitimate purpose, proportionality, limited retention). As the legal bases above cover the processing, explicit consent is as a rule not sought; if a separate purpose arises, it is assessed separately (Annex-6 cl. 3, 3.1).
6. Transfers
6.1. Transfer to the BTK. Data of data subjects may be transferred to the Authority under the interconnection legislation (Access and Interconnection Regulation Art. 19) and, to the extent applicable, BTK subscriber/notification obligations (Annex-6 cl. 4.1).
6.2. Transfers abroad. Where a transfer abroad takes place (in particular regarding authorised/technical persons of a foreign PARTICIPANT, and cross-border components such as PeeringDB/route servers), it is made under KVKK Art. 9 and only with one of the appropriate safeguards: a standard contract (notified by 3C1B to the Board within five (5) business days of signature), binding corporate rules, or another safeguard/exception under KVKK Art. 9. Being a "foreign member" alone is not the criterion for a transfer; the criterion is whether data is actually transferred abroad (Annex-6 cl. 4.2).
6.3. Data processors. Third parties from which 3C1B obtains services on its own behalf (POP/data-centre operators, payment/invoicing service providers, etc.) may act as data processors; written arrangements are made with them under KVKK Art. 12 (Annex-6 cl. 1.4).
6.4. Save where required by legislation, such as a request from a judicial or administrative authority, data is not transferred to third parties (Annex-6 cl. 4.3).
7. Retention Periods
7.1. Subscription and contract records are retained for the duration of the subscription and for 30 years after the subscription ends (BTK Consumer Rights Regulation Art. 7/7) (Annex-6 cl. 5.2).
7.2. Data processed as BTK notification records is retained for the period provided by the relevant legislation. Deletion requests received during that period are met by restricting access to the record, because of the statutory retention obligation (Annex-6 cl. 5.1).
7.3. Sampled flow (sFlow) data: raw samples 14 days, summaries 90 days (see Section 4) (Annex-6 cl. 2.5).
7.4. Retention periods are set so as not to be shorter than the periods provided in the relevant legislation (Annex-6 cl. 5.2).
8. Data Subject Rights (KVKK Art. 11)
8.1. The data subject has the right to learn whether data is processed, request information, learn whether it is used for its purpose, know the recipients to whom it is transferred, request correction/deletion, and object to automated processing (Annex-6 cl. 6.1).
8.2. Requests are made through the channels below and answered within the period provided by legislation. A deletion request cannot be met for records that must be retained by law; in that case access is restricted and the data subject is informed with reasons (Annex-6 cl. 6.2).
9. How to Apply
You may submit your application to kvkk@3c1b.com, to the KEP address 3c1b@hs02.kep.tr, via www.3c1b.com/kvkk, or in writing to our registered office (Yukarı Öveçler Mahallesi, 1280 Sokak No: 5A, 06460 Çankaya / Ankara, Türkiye).
10. Data Security
Under KVKK Art. 12, 3C1B takes technical and administrative measures (role-based access control, access audit log, encryption, least privilege) to prevent unlawful processing of and access to data. In the event of a data breach, notification is made to the Personal Data Protection Board no later than seventy-two (72) hours from the date the breach becomes known, and to affected data subjects as soon as reasonably possible (Annex-6 cl. 7.1).
11. Notice
Annex-6 does not replace 3C1B's notice obligation under KVKK Art. 10; 3C1B makes a separate privacy notice available to the authorised/technical contact persons. The PARTICIPANT informs these persons, who are its own personnel, about the processing (Annex-6 cl. 8.1).
12. Cookie Policy
This site uses first-party cookies that are necessary for it to work. No analytics, advertising or profiling cookies are used; accordingly, consent is not requested for the strictly necessary cookies (they are required to provide the service requested).
12.1. Cookies we use
| Cookie | Purpose | Duration | When |
|---|---|---|---|
.AspNetCore.Antiforgery.<id> |
Protection against cross-site request forgery (CSRF) on forms | Session (deleted when the browser closes) | Pages with forms |
.AspNetCore.Identity.Application |
Keeps the operator/administrator signed in | Persistent; 14 days since last use (sliding) | Only after sign-in |
.AspNetCore.Mvc.CookieTempDataProvider |
One-time information message in the admin area | Session | Admin area (/Admin) only |
The language is determined from the URL and is not stored in a cookie. Your cookie-notice choice is kept not in a cookie but in your browser's local storage (regpex_cookie_consent); it stays on your device and is not sent to the server.
12.2. Third-party services
- Google reCAPTCHA v3 (contact, application and registration forms): used to distinguish automated or abusive submissions. Google may set its own cookies in your browser and process device/usage information. This processing is governed by Google's own privacy policy.
- Google Fonts: fonts are loaded from Google servers. No cookie is set, but your IP address and browser information are technically transmitted to Google when the page loads.
These services may involve transfer of data abroad (to Google servers). See the sections above and Google's privacy policy for details.
12.3. Managing cookies
You can delete or block cookies in your browser settings. If you block the necessary cookies, sign-in will not work and forms may fail. Questions: kvkk@3c1b.com.
13. Version
This page corresponds to Annex-6 v2.3 (version date 19.10.2026). For the current versions in the agreement set, see the Agreement set page. The Turkish text prevails.