Our Engagements
Including Milli Piyango (the Turkish National Lottery), TÜBİTAK BİLGEM, the Turkish Data Protection Authority, ÖSYM, Turkcell, COSCO Shipping, Kabsan Defense, and holding, government, finance, industrial, telecom, and international logistics organizations: 400+ organizations for KVKK compliance, ISO 27001 BGYS kurulumu, penetration testing, GDPR consulting and information security awareness training and more. Below is a selection of that work.
Highlights from the ISMS, KVKK, and awareness work we deliver for ministries, affiliated agencies, municipalities, and regulators.
In April 2022, we designed the information security awareness program for department heads as part of the Turkish National Lottery Administration's ISMS compliance process. Two of our field consultants ran the program over a full week.
In December 2025, our colleague Uygar Yasin Aydın walked Authority officials through the technical and administrative solutions we have developed, presenting our consulting approach through reference projects.
In August 2022, we delivered hands-on training to ÖSYM (Student Selection and Placement Center) staff on ISMS obligations and day-to-day operational controls. The program was tailored to the high confidentiality requirements of national examination processes.
In February 2023, we delivered hands-on training to Turkish Jockey Club staff, under the Ministry of Agriculture and Forestry, covering cyber threat actors, personal data protection, and safe internet use. Our field team ran the program for a week.
In December 2025, we completed the awareness program required under Law No. 6698 at the Sivas Kangal Thermal Power Plant. Human-factor risk at the intersection of OT and IT environments was the central theme.
In December 2025, we delivered a two-day cybersecurity awareness program to Erzincan Municipality staff. Protecting citizen data and building institutional resilience against digital threats set the agenda.
In August 2022, we delivered awareness training to Samsun Metropolitan Municipality based on Law No. 6698 and current DPA Board decisions as part of its KVKK compliance process. Managers from multiple departments attended.
In September 2024, we ran a hands-on session for municipal staff on data protection strategies and managing citizen requests. Current DPA Board decisions were worked through with example cases.
In September 2024, at an event hosted by the Turkish Data Protection Authority, we briefed participants on data security obligations and technical controls under Law No. 6698.
Coordination and training engagements for academic institutions, professional chambers, and research centers.
In November 2022, we delivered a comprehensive presentation at TOBB headquarters on data controller obligations and VERBİS practices under KVKK Law No. 6698.
In July 2024, we delivered awareness training to PTB members on data controller obligations and explicit consent processes under Law No. 6698, with practical examples on data security measures.
In November 2021, Uşak University held a broad coordination meeting with us, attended by all department heads. The university's KVKK compliance roadmap took shape in that session.
In March 2023, we trained TÜBİTAK BİLGEM software developers on software process improvement and quality management in line with the ISO/IEC 15504 (SPICE) standard.
In May 2024, our information security session for Yüksek İhtisas University's academic and administrative staff covered student personal data processing and KVKK compliance.
In May 2025, we met with students as part of our partnership with TED University, running interactive sessions on career development and cybersecurity career paths.
In April 2026, we met students at our booth at TED University. Our team walked interested students through career opportunities in KVKK and specialization paths in cybersecurity, one on one.
Compliance engagements for bank subsidiaries, telecom operators, and large-scale service providers.
Across 2024-2025, İŞMER — a Türkiye İş Bankası subsidiary — successfully implemented its ISO/IEC 27001 ISMS with our consulting and reached certification. We stood beside them at every stage, from policy documentation to internal audit.
In February 2025, our partnership engagement with Turkcell introduced the value-added cybersecurity and KVKK solutions we have built around customer needs. We mapped the new project roadmap together.
In October 2024, we ran a dedicated session for customer representative teams at Turkcell headquarters. Subscriber data protection and social engineering vectors were the highlights.
In February 2025, the Chairman of the Nesil Group of Companies appeared on CNN Türk to discuss personal data protection principles under Law No. 6698 and recent DPA Board decisions.
In August 2022, we delivered tailored awareness training to call center staff handling high volumes of customer data, covering voice recording management, explicit consent, and data minimization.
In summer 2022, we assessed the data processing operations of the online reservation platform with oteldenal.com management and delivered a detailed report of legal compliance recommendations.
In July 2025, we launched the enterprise Privacy Center project for SOCAR on our CerezGo platform. Cookie management, user preference records, and KVKK and GDPR compliance were unified under a single privacy center.
End-to-end KVKK compliance services for hotel groups, mall operators, and group companies.
In December 2025, we completed KVKK awareness and regulatory compliance training across all operational teams of the Megasaray Hotel Group, led by our counsel Atty. İrem.
In December 2025, we performed a current-state analysis of KVKK and information/cyber security obligations at Kuzu Effect Mall, consolidating risk and compliance posture in a single executive-level report.
In spring 2026, our KVKK legal advisory for the Ankara-based mall analyzed data processing operations specific to shopping center operations and the tenant data governance model in detail.
Across 2025-2026, we designed a unified KVKK compliance program for a group structure spanning İZTAŞ, PETYAT, İLTAŞ, SURTAŞ, EGE İŞ, ERMADEN, İZEGE, TAŞOVA, HMT, and TOTAL — managing every brand from a single point.
For guest-data-intensive hotel operations, we structured the KVKK compliance framework covering check-in/check-out processes, CCTV records, and third-party integrations.
Across 2024-2025, we implemented the KVKK compliance program covering all Devtaş Group brands in six stages: analysis, inventory, explicit consent, contract management, training, and audit.
In February 2024, we trained Anadolu Hotel staff on required KVKK measures and employee responsibilities. The goal: a lasting data protection culture across the hotel.
In March 2023, we walked ESSA Group management and operations teams through the controller/processor distinction in holding structures, intra-group data transfers, and the duty to inform — in detailed modules.
Penetration testing and KVKK compliance for defense, automotive, packaging, and machinery manufacturers.
In spring 2026, we put Kabsan's information systems and network infrastructure through a comprehensive security assessment using our TSE Class A methodology.
In March 2023, we prepared hands-on training for Sinerji Defense staff on corporate information security policies, classified information handling, and operational countermeasures against cyber threats.
In November 2022, we delivered an awareness session to Mavinci Defense board members on personal data and classified information governance across the defense supply chain.
In early 2026, we trained automotive dealership staff on lawful personal data processing, privacy notices, and explicit consent. Day-to-day KVKK obligations were covered with detailed examples.
In early 2026, our KVKK consulting for İzmir-based Surtaş Automotive covered every personal data processing operation end to end and closed the compliance gaps.
In August 2022, we briefed the committee members of export-focused Unison Ambalaj A.Ş. on GDPR fundamentals for the EU market alongside KVKK, including cross-border data transfer rules.
In summer 2022, we delivered KVKK training to İDEA Machinery Generator Group board members on personal data governance and data controller obligations across the manufacturing ecosystem.
In summer 2022, we walked RESA Yapı board members through subcontractor and data processor relationships in construction, with practical examples on site data security.
In autumn 2022, we held a briefing with the Biga Organized Industrial Zone board. A shared KVKK compliance roadmap for member companies was on the table.
In March 2026, we ran a two-day on-site engagement at the client location. Our pentest team completed an end-to-end security assessment with live analysis of the network topology.
In the second phase of the March 2026 field engagement, we executed application-layer tests and social engineering scenarios, delivering a technical report with findings ranked by action priority.
GDPR compliance services for foreign-owned organizations and global logistics operators.
In early 2026, we ran the GDPR compliance process for the Türkiye operations of China-based global logistics operator COSCO. International data transfers, legal obligations, and technical safeguards were covered in depth.
In February 2025, we reviewed the data processing operations of France-based Nicomatic's Türkiye operations for compliance and prepared a structured set of recommendations to strengthen security controls.
In February 2023, our program for organizations transferring data to the EU market covered GDPR fundamentals, cross-border transfer mechanisms (SCCs, BCRs), and breach notification obligations in detailed modules.
In early 2023, our staff program compared the core requirements of KVKK and GDPR side by side, working through practical examples of what to watch for in data processing operations.
In autumn 2023, our meeting with Unison Ambalaj A.Ş. committee members addressed the committee competencies needed to achieve and sustain GDPR compliance.
In February 2025, we audited the data processing operations of vehicle tracking and telematics provider Seyir Mobil Sistemler — driver and location data above all — against legal requirements, then produced an action plan from the improvement recommendations.
Raising public awareness through industry summits, conference speaking, and trade fair participation.
In February 2022, we presented on "Carry Your Business into the Future with Sound Data Governance" at the Personal Data Protection Conference organized by TSİAD.
At the October 2024 conference, Mr. Binali Yıldırım visited our booth and received a short briefing on our cybersecurity and KVKK projects.
At the October 2024 Cryptology Conference, we walked booth visitors through our penetration testing methodology and applied cryptography scenarios.
At the September 2024 Data Protection Fair, we introduced booth visitors to our TSE 13298-compliant electronic document management and data protection products.
At the Data Center Fair held in Istanbul on 28-30 October 2021, interest in our KVKK solutions exceeded expectations — a clear sign of how fast sectoral compliance needs are growing.
At the December 2025 event, our sessions on cybersecurity, KVKK, and digital transformation drew far more participant interest than expected.
In March 2026, we trained Teknik Grup Defense management and operations teams on KVKK compliance across the defense supply chain through applied cases, including examples from current DPA Board decisions.
In early 2023, we introduced our data masking solution for personal data minimization to an Organized Industrial Zone board, aligned with TSE standards.
In November 2023, we completed a one-day awareness program for racecourse staff on digital threats, safe internet use, and data security measures.