Privacy Policy and Data Protection Notice

This is an unofficial English translation provided for convenience. In case of any discrepancy, the Turkish version is legally authoritative. "KVKK" refers to Turkish Law No. 6698 on the Protection of Personal Data.

1. Data Controller and Scope

The data controller is NETMETRİK MOBİL VE GENİŞBANT VERİ ANALİZİ HİZMETLERİ ("NETMETRİK"), registered at Tahtakale Mah. Lilyum Sk. No:3/193 Stüdyo24 Residence, 34325 Avcılar / İstanbul. You can reach us at [email protected].

This notice covers everyone whose personal data we process: visitors who run a speed test on HIZTESTI.COM, people who create an optional account, authorised representatives and team members of organisations using the Partner Portal, and people who contact us.

2. Personal Data We Process

• Measurement data: download, upload, latency, jitter and packet loss results; your IP address, ISP, connection type and the city derived from the IP; device and browser information. If you grant location permission (in your browser or in the mobile app), your device's location at the time of the test (latitude, longitude and accuracy) is also recorded with the measurement; if you do not, only the city derived from your IP address is used. On cellular, the network type (5G/LTE/3G). The name (SSID) and the security type (open, WEP, personal or enterprise) of the Wi-Fi network you are connected to are kept only in the test history on your device and, if you have created an account, in your own synced history; they are not written to share records or statistics and are never displayed on the public share page.
• Anonymous install ID: a random identifier stored on your device on first use in the app, and on the web only if you allow it. If you do not, and in a widget embedded on a customer's site, it is kept only for that session. It is not derived from hardware, advertising or account identifiers. It is used to tell that measurements come from the same installation, to improve location accuracy and to improve the service. If you are signed in, your measurements are linked to your account.
• Account data (optional): a speed test requires no account. If you create one to sync your test history across devices, we process your email address, your name (optional), your password (stored only as an irreversible hash) and your correspondence language. If you sign in with Google or Apple, we receive the email address, name and account identifier that provider shares with us.
• Organisation and billing data: for Partner Portal customers — organisation name, tax number and tax office, billing address and email, phone, payment records and invoice numbers.
• Usage records: session data (IP address, browser information, sign-in time) and audit logs of account actions.
• Error and interruption records: Page and app errors, and the reason a test stopped, are recorded without being linked to your account; if you allowed a persistent install ID, only a short prefix of that anonymous ID is attached. Your IP address is not stored in these records.
• Support content: messages you write in support threads and contact forms, together with your contact details.
• Server partnership data: for organisations hosting a measurement server — host name, IP address, location and capacity information, plus operational telemetry from the server.

Location from a measurement where you granted permission may be used only to correct the province, district and location of other measurements made from the same device or over the same internet connection that are strongly shown to come from the same place. The correction is stored separately, does not change the measurement record and can be reversed.

3. How We Collect Data

• Directly from you: registration, billing details, support threads, contact forms.
• Automatically: the measurement itself, session cookies, security logs and audit records created as you use the service.
• Derived: ISP and city information derived from an IP address using a locally hosted geolocation database. Where that database cannot determine the city or location, the IP address is looked up with an IP geolocation service provider solely to complete the city and approximate location.
• App install source: the Android app reads only the campaign label from the install information of Google Play (on Huawei devices, AppGallery) (for example, which link you came from) and reports it once on first launch and once after your first measurement. This report is not linked to your account, device identifier or measurement results; only the country is derived from your IP address, and the IP address is not stored.

4. Purposes and Legal Bases

Under KVKK Articles 5 and 6, every processing activity rests on a legal basis. Ours are:

5. Speed Test Measurements and Open Data

When you start a test, data is temporarily downloaded and uploaded between your device and our measurement servers to determine your connection's capacity. This traffic is test data only; the contents of your connection are never inspected or recorded. The measurement is made by connecting directly to a test server in our network; that server may belong to NETMETRİK or to an organisation that contributes a server to our network, and by the nature of the connection it sees your IP address. Server partners are contractually bound not to use this information for anything other than the measurement (Terms of Use §4).

Measurement results feed the statistics we publish about internet quality. Those statistics and open data sets are anonymised and aggregated — IP addresses never enter them, and no individual can be identified from them. Where an IP address is displayed on our own screens it is masked (the last block of an IPv4 address is zeroed). This is a display mask; the stored measurement records keep the full address, as described in §9.

6. HIZTESTI Custom End-User Data (Our Processor Role)

When visitors use a test widget embedded on a customer's site, the nature of the measurement means the visitor's IP address, ISP information and measurement metrics are processed. For that data the customer organisation is the data controller; NETMETRİK acts as a data processor while providing the service. Informing their own visitors under KVKK is that organisation's responsibility. Reporting screens and exports apply masking defaults to fields containing personal data.

7. Cookies and Local Storage

We use only cookies that are necessary for the service to work: the session cookie that keeps you signed in, the security cookie set by our bot-protection layer, and a preference cookie that remembers your language. In addition, your own test history and preferences (such as theme choice) may be kept in your browser's local storage — that data stays on your device and is not transmitted to us as a separate record. If you allow it, an anonymous install ID is also kept in your browser's local storage and sent to us with your measurements (§2). You can withdraw this permission at any time in Settings; withdrawing it deletes the ID from your browser.

hiztesti.com shows Google ads. Google may use cookies in your browser to show and measure ads. Ads based on your interests are shown only with your permission; you can change this in Settings. We treat your browser's Global Privacy Control signal as a refusal. Details: policies.google.com/technologies/partner-sites. There are no ads on netmetrik.com.

Google ads are shown in the HIZTESTI iOS and Android apps. Google may use your device's advertising ID to show and measure ads. Interest-based ads are shown only with your permission, asked through the tracking prompt on iPhone, the in-app ad choice on Android, and Google's consent form in Europe. If you decline, ads are not personalised. You can change your choice in the app's Settings.

You can clear cookies and local storage from your browser; note that clearing the session cookie signs you out and clearing local storage removes the locally kept test history.

8. Who We Share Data With

We share your data only with:

• Infrastructure providers: the providers we use for DNS, CDN, bot protection, email delivery and storage (encrypted backups and share images) — strictly to deliver the service and only to the extent it requires.
• IP geolocation provider: only when our own database cannot determine your city or location, and only your IP address, to complete that information.
• Identity providers: only if you choose to sign in with Google or Apple, and only for that sign-in.
• Map providers: when you open the route map, your device requests the map images directly; your IP address and the area being viewed reach the map provider.
• Server partners: only where an organisation hosts a measurement server, and only the operational information required for that relationship; in addition, the partner server that runs your test sees your IP address by the nature of the connection (see §5).
• Google (ads): when ads are shown on hiztesti.com or in the apps, your IP address, browser or device details, cookies and, in the apps, your advertising ID reach Google, which may process them abroad. Interest-based ads rely on your consent.
• Authorities: where required by law, upon a duly issued request.

9. Retention Periods

• Account data: for as long as the account exists. When you delete your account, your account details, sessions and synced test history are deleted immediately; anonymised measurement statistics and any billing records are kept for the periods stated here.
• Billing and payment records: 10 years, as required by tax legislation.
• Session records: until the session expires; audit logs for 2 years.
• Support threads: 3 years after the thread is closed.
• Password reset and verification links: single-use and expire within hours.
• Measurement records: the IP address is kept in full with the measurement record for security, abuse prevention and service quality, on access-restricted systems. The anonymous install ID stays with the measurement record. If you delete your account, the account link is removed from measurement records; anonymous measurement statistics remain and are kept indefinitely.

10. Data Security and Breach Notification

Passwords are stored only as irreversible hashes, all traffic is encrypted in transit, backups are encrypted, access to systems is restricted and account actions are written to an audit log. Should a breach occur, we notify the Personal Data Protection Board within 72 hours of becoming aware of it and inform affected data subjects, in line with KVKK Article 12 and the Board's decisions.

11. Commercial Electronic Messages

Service notifications (approval, quota, invoice, security) are part of performing the contract and are not commercial electronic messages. Should we send marketing messages, they are sent only with your consent and through the Message Management System (İYS); every such message carries an opt-out and you may also write to [email protected].

12. Automated Decision-Making and Profiling

No decision producing legal effects concerning you is taken by fully automated means. Automated checks such as quota enforcement and rate limiting act on the account, not on the person, and are always reviewable by a human operator. Per-device and per-member measurement counts are for internal analysis only; no automated decisions are made about you.

13. Children's Data

Our services are not directed at children and we do not knowingly process children's data. The Partner Portal in particular is a business service intended for people aged 18 and over. If you believe a child's data has reached us, write to [email protected] and we will delete it without delay.

14. Your Rights Under KVKK and How to Apply

Under KVKK Article 11 you have the right to learn whether your data is processed, to request information, to learn the purpose of processing, to know the third parties to whom it is transferred, to request correction or deletion, to object to results reached by automated analysis, and to claim damages where you suffer loss.

Applications are made in writing or through the methods set out in the Communiqué on Application Procedures, using [email protected] or the postal address above. Please state your identity and your request clearly. We respond within 30 days at the latest, free of charge; where the process incurs a cost, the tariff set by the Board may apply.

15. Changes to This Policy

We may update this policy as legislation or our services change. The current version is always published on this page with its effective date; where a change materially affects your rights, we also notify account holders by email.