Privacy Policy

1Who we are and what this policy covers

FixTrail ("we", "us") is the data controller for the personal data described in this policy. It covers two things: your visits to our website, quickpentest.com, and the messages you send us — a demo request, a question, a security report or a privacy request.

It does not cover what a FixTrail console processes for a customer. FixTrail is deployed in each customer's own infrastructure, for one organisation. The organisation that runs a console decides what it processes and is the data controller for that data; its own privacy notice and its agreement with us govern that processing, not this policy.

2What we collect, and why

We collect as little as the website and our conversations with you need.

When you visit the website. The server that delivers the pages records technical details of each request: your IP address, the date and time, the page requested, the response, and the browser identifier (user agent) your browser sends. We use these records to deliver the site, to detect and stop abuse, and to diagnose faults.

When you choose a language. If you pick a language with the switch at the top of the page, your browser stores that choice in a cookie and sends it back with each request, so pages open in your language. If you have not chosen, pages follow the language your browser asks for and nothing is stored. Our Cookie Policy lists every cookie we use.

When you ask for a demo. The demo form on this site sends nothing. It writes the request out in your own mail app, and nothing leaves your device until you send that email yourself. If you do, we receive what you wrote: usually your name, your organisation, your work email address, the size of your estate and the security tools you use. We use it to answer you, prepare and hold the demo, and discuss a possible agreement.

When you write to us. If you email sales@quickpentest.com, security@quickpentest.com or privacy@quickpentest.com, we receive your email address, your name if you give it, and whatever your message contains. We use it to answer you: to investigate and fix a reported vulnerability and, if you wish, credit you for it, or to handle a request about your personal data.

When you have an account on a console we run. Accounts on a FixTrail console exist only by invitation or through the organisation's single sign-on. Where we operate a console ourselves, we process your name, email address, role, sign-in events and the audit record of actions taken in your name, to give you access, keep the console secure and keep an accountable record of who did what.

What we do not do. This website uses no analytics, advertising or social-media tools, and loads no scripts or fonts from other companies. We do not sell personal data, we do not use it for advertising, and we do not make decisions about you by automated means alone.

3Legal bases

We process personal data only where the law gives us a basis to do so:

Website request records: our legitimate interest in running a secure, working website (GDPR art. 6(1)(f); KVKK art. 5(2)(f)), and any legal obligation to keep such records (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)).
The language cookie: for the length of your browser session, strictly necessary to provide the feature you asked for, on the basis of our legitimate interest (GDPR art. 6(1)(f); KVKK art. 5(2)(f)). Kept after you close your browser only with your consent to preference cookies, which you can withdraw at any time through Cookie preferences (GDPR art. 6(1)(a); KVKK art. 5(1)).
Demo requests and sales correspondence: steps taken at your request before entering into an agreement (GDPR art. 6(1)(b); KVKK art. 5(2)(c)) and our legitimate interest in answering business enquiries (GDPR art. 6(1)(f); KVKK art. 5(2)(f)).
Security reports: our legitimate interest in keeping our product and our customers secure (GDPR art. 6(1)(f); KVKK art. 5(2)(f)) and the establishment, exercise or protection of a right (KVKK art. 5(2)(e)).
Privacy requests: our legal obligation to answer them (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)).
Accounts on a console we run: the performance of the agreement under which you use it (GDPR art. 6(1)(b); KVKK art. 5(2)(c)) and our legitimate interest in keeping it secure and accountable (GDPR art. 6(1)(f); KVKK art. 5(2)(f)).

We do not rely on your consent for anything on this website today. If we ever do, we will ask first, and you will be able to withdraw your consent at any time.

4Who receives your data

We share personal data only as far as each purpose requires:

Service providers who host our website and servers and run our email, acting on our instructions under contracts that bind them to confidentiality and security.
Professional advisers, such as lawyers and auditors, who are bound by confidentiality.
Public authorities and courts, where the law requires us to disclose data or where it is needed to establish, exercise or defend a legal claim.
A successor business, if FixTrail or part of it is merged or sold, under this policy's protections. We will tell you before your data becomes subject to a different policy.

We do not sell or rent personal data, and we do not share it with anyone for their own marketing.

5Transfers outside Türkiye and the EEA

Some of our service providers may process data on servers outside Türkiye or outside the European Economic Area. Where that happens, we transfer personal data only as article 9 of the KVKK allows: on the basis of an adequacy decision, appropriate safeguards such as standard contracts notified to the Personal Data Protection Authority, or one of the exceptions the article provides. For data subject to the GDPR, we rely on an adequacy decision of the European Commission or on its standard contractual clauses. You can ask us which safeguards apply to your data.

6How long we keep it

We keep personal data only as long as its purpose requires:

Website request records: up to 90 days, unless a record is needed to investigate a specific security incident, in which case for as long as that investigation and any related proceedings require.
The language cookie: in your own browser, until you close it; if you allow preference cookies, for up to one year from your last choice. You can delete it at any time.
Demo requests and sales correspondence: while the conversation is active and for two years after our last contact if no agreement follows. If one does, for as long as commercial and tax law require us to keep business correspondence, up to ten years under the Turkish Commercial Code.
Security reports: for as long as needed to fix the issue, and for up to five years afterwards as a record of how it was handled.
Privacy requests: the request and our answer, for three years after we answer, so that we can show how it was handled.
Accounts on a console we run: for as long as the account exists. The console's audit log is append-only by design, and the entries about you are kept for as long as that console keeps its audit log.

When a period ends, we delete, destroy or anonymise the data, in line with article 7 of the KVKK and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

7How we protect it

We protect personal data with technical and organisational measures that fit the risk: encrypted connections to the website, access limited to the people who need it for the purposes above, and the security practices we describe on our Security page.

8Information notice under the KVKK

This section is our information notice under article 10 of the Personal Data Protection Law No. 6698 (the "KVKK").

Data controller. FixTrail. You can reach us at privacy@quickpentest.com.

Personal data and purposes. Website request records, to run and secure the website; your language choice, to show pages in your language; the contents of your demo requests and correspondence, to answer you and to prepare and carry out an agreement; security reports, to fix vulnerabilities and protect our product and customers; privacy requests, to fulfil our legal obligations; and, on a console we run, account and audit data, to give access and keep an accountable record. Section 2 describes each in full.

Method of collection and legal bases. We collect personal data electronically: automatically when you visit the website, and directly from you when you write to us or use a console we run. Our legal bases are those in article 5(2)(c), (ç), (e) and (f) of the KVKK, as set out in section 3.

Transfers. We may transfer personal data to the recipients in section 4 for the purposes above, in line with article 8 of the KVKK, and abroad only as section 5 describes, in line with article 9.

Your rights under article 11. You have the right to:

learn whether your personal data is processed;
request information about it if it is;
learn the purpose of the processing and whether the data is used in line with that purpose;
know the third parties in Türkiye or abroad to whom your data is transferred;
request the correction of incomplete or inaccurate data;
request the erasure or destruction of your data under the conditions in article 7;
request that the third parties to whom your data was transferred be told of a correction, erasure or destruction;
object to a result that is to your detriment and arises solely from the analysis of your data by automated systems;
claim compensation for damage you suffer because of the unlawful processing of your data.

Section 10 explains how to apply.

If the GDPR applies to our processing of your data, you have the right to:

access your personal data and receive a copy of it;
rectification of inaccurate or incomplete data;
erasure of your data where there is no longer a reason to keep it;
restriction of processing while a question about it is resolved;
data portability, for data you gave us and that we process by automated means on the basis of an agreement or consent;
object to processing based on our legitimate interests, at any time, on grounds relating to your situation;
withdraw consent at any time, where we rely on it, without affecting processing that took place before;
not be subject to a decision based solely on automated processing that significantly affects you;
lodge a complaint with a supervisory authority, in particular in the EU or EEA country where you live or work or where you believe an infringement took place.

10How to exercise your rights

Write to privacy@quickpentest.com. Tell us who you are, how we can reach you and what you are asking for. If you are writing about a particular exchange with us — a demo request or a security report, say — mention it so that we can find it quickly. We answer in Turkish or English.

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may also apply in writing, through registered electronic mail (KEP), with a secure electronic or mobile signature, or by email from an address you have given us before and that is registered with us. Write to privacy@quickpentest.com and we will send you the addresses for a written or KEP application.

Before we act on a request, we may ask you to confirm your identity, so that we never disclose your data to someone else.

We answer free of charge and as soon as we can: within 30 days under the KVKK, and within one month under the GDPR, which can be extended by two further months for a complex request — if so, we will tell you why. If answering involves a separate cost, the KVKK allows a fee under the tariff set by the Personal Data Protection Board.

If you are not satisfied with our answer, or we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your application. Where the GDPR applies, you can also complain to a supervisory authority at any time.

11Children

This website and our product are made for organisations. They are not directed at children, and we do not knowingly collect children's personal data.

12Changes to this policy

When we change this policy, we update the date at the top of the page. If a change affects how we use personal data we already hold, we will tell the people affected before it applies.

13Contact

For anything about your personal data, write to privacy@quickpentest.com. To report a vulnerability, write to security@quickpentest.com. For everything else, write to sales@quickpentest.com.

Cookies on this site