Privacy Policy and Data Protection Notice

This is an unofficial English translation provided for convenience. In case of any discrepancy, the Turkish version is legally authoritative. "KVKK" refers to Turkish Law No. 6698 on the Protection of Personal Data.

1. Data Controller and Scope

The data controller is NETMETRİK MOBİL VE GENİŞBANT VERİ ANALİZİ HİZMETLERİ("NETMETRİK"), registered at Tahtakale Mah. Lilyum Sk. No:3/193 Stüdyo24 Residence, 34325 Avcılar / İstanbul. You can reach us at [email protected].

This notice covers everyone whose personal data we process: visitors who run a speed test on HIZTESTI.COM, people who create an optional account, authorised representatives and team members of organisations using the Partner Portal, and people who contact us.

2. Personal Data We Process

• Measurement data:download, upload, latency, jitter and packet loss results; your IP address, ISP, connection type and the city derived from the IP; device and browser information. If you grant location permission (in your browser or in the mobile app), your device's location at the time of the test (latitude, longitude and accuracy) is also recorded with the measurement; if you do not, only the city derived from your IP address is used. On cellular, the network type (5G/LTE/3G). The name (SSID) and the security type (open, WEP, personal or enterprise) of the Wi-Fi network you are connected to are kept only in the test history on your device and, if you have created an account, in your own synced history; they are not written to share records or statistics and are never displayed on the public share page.
• Account data (optional): a speed test requires no account. If you create one to sync your test history across devices, we process your email address, your name (optional), your password (stored only as an irreversible hash) and your correspondence language. If you sign in with Google or Apple, we receive the email address, name and account identifier that provider shares with us.
• Organisation and billing data: for Partner Portal customers — organisation name, tax number and tax office, billing address and email, phone, payment records and invoice numbers.
• Usage records: session data (IP address, browser information, sign-in time) and audit logs of account actions.
• Support content: messages you write in support threads and contact forms, together with your contact details.
• Server partnership data: for organisations hosting a measurement server — host name, IP address, location and capacity information, plus operational telemetry from the server.

3. How We Collect Data

• Directly from you: registration, billing details, support threads, contact forms.
• Automatically: the measurement itself, session cookies, security logs and audit records created as you use the service.
• Derived: ISP and city information derived from an IP address using a locally hosted geolocation database. Where that database cannot determine the city or location, the IP address is looked up with an IP geolocation service provider solely to complete the city and approximate location.
• App install source: the Android app reads only the campaign label from the install information of Google Play (on Huawei devices, AppGallery) (for example, which link you came from) and reports it once on first launch and once after your first measurement. This report is not linked to your account, device identifier or measurement results; only the country is derived from your IP address, and the IP address is not stored.

4. Purposes and Legal Bases

Under KVKK Articles 5 and 6, every processing activity rests on a legal basis. Ours are:

5. Speed Test Measurements and Open Data

When you start a test, data is temporarily downloaded and uploaded between your device and our measurement servers to determine your connection's capacity. This traffic is test data only; the contents of your connection are never inspected or recorded.

Measurement results feed the statistics we publish about internet quality. Those statistics and open data sets are anonymised and aggregated — IP addresses never enter them, and no individual can be identified from them. Where an IP address is displayed on our own screens it is masked (the last octet of an IPv4 address is zeroed).

6. HIZTESTI Custom End-User Data (Our Processor Role)

When visitors use a test widget embedded on a customer's site, the nature of the measurement means the visitor's IP address, ISP information and measurement metrics are processed. For that data the customer organisation is the data controller; NETMETRİK acts as a data processorwhile providing the service. Informing their own visitors under KVKK is that organisation's responsibility. Reporting screens and exports apply masking defaults to fields containing personal data.

7. Cookies and Local Storage

We use only cookies that are necessary for the service to work: the session cookie that keeps you signed in, the security cookie set by our bot-protection layer, and a preference cookie that remembers your language. In addition, your own test history and preferences (such as theme choice) may be kept in your browser's local storage — that data stays on your device and is not transmitted to us as a separate record.

We do not use advertising or cross-site tracking cookies, and we do not run third-party advertising trackers. You can clear cookies and local storage from your browser; note that clearing the session cookie signs you out and clearing local storage removes the locally kept test history.

8. Who We Share Data With

Your data is never sold and is never shared with third parties for marketing. We share it only with:

• Infrastructure providers: the providers we use for DNS, CDN, bot protection, email delivery and storage (encrypted backups and share images) — strictly to deliver the service and only to the extent it requires.
• IP geolocation provider: only when our own database cannot determine your city or location, and only your IP address, to complete that information.
• Identity providers: only if you choose to sign in with Google or Apple, and only for that sign-in.
• Map providers: when you open the route map, your device requests the map images directly; your IP address and the area being viewed reach the map provider.
• Server partners: only where an organisation hosts a measurement server, and only the operational information required for that relationship.
• Authorities: where required by law, upon a duly issued request.

9. Retention Periods

• Account data: for as long as the account exists. When you delete your account, your account details, sessions and synced test history are deleted immediately; anonymised measurement statistics and any billing records are kept for the periods stated here.
• Billing and payment records: 10 years, as required by tax legislation.
• Session records: until the session expires; audit logs for 2 years.
• Support threads: 3 years after the thread is closed.
• Password reset and verification links: single-use and expire within hours.
• Measurement records: personal data fields are masked; anonymised statistics are kept indefinitely.

10. Data Security and Breach Notification

Passwords are stored only as irreversible hashes, all traffic is encrypted in transit, backups are encrypted, access to systems is restricted and account actions are written to an audit log. Should a breach occur, we notify the Personal Data Protection Board within 72 hoursof becoming aware of it and inform affected data subjects, in line with KVKK Article 12 and the Board's decisions.

11. Commercial Electronic Messages

Service notifications (approval, quota, invoice, security) are part of performing the contract and are not commercial electronic messages. Should we send marketing messages, they are sent only with your consent and through the Message Management System (İYS); every such message carries an opt-out and you may also write to [email protected].

12. Automated Decision-Making and Profiling

No decision producing legal effects concerning you is taken by fully automated means. Automated checks such as quota enforcement and rate limiting act on the account, not on the person, and are always reviewable by a human operator.

13. Children's Data

Our services are not directed at children and we do not knowingly process children's data. The Partner Portal in particular is a business service intended for people aged 18 and over. If you believe a child's data has reached us, write to [email protected] and we will delete it without delay.

14. Your Rights Under KVKK and How to Apply

Under KVKK Article 11 you have the right to learn whether your data is processed, to request information, to learn the purpose of processing, to know the third parties to whom it is transferred, to request correction or deletion, to object to results reached by automated analysis, and to claim damages where you suffer loss.

Applications are made in writing or through the methods set out in the Communiqué on Application Procedures, using [email protected] or the postal address above. Please state your identity and your request clearly. We respond within 30 days at the latest, free of charge; where the process incurs a cost, the tariff set by the Board may apply.

15. Changes to This Policy

We may update this policy as legislation or our services change. The current version is always published on this page with its effective date; where a change materially affects your rights, we also notify account holders by email.