Data controller
Sanem Coşan Acar is the data controller for personal-data processing on this website under Turkish Personal Data Protection Law No. 6698 (KVKK). Website enquiries and office operations are handled through the contact channels published here.
Personal data processed
Depending on the channel you use, only the data categories required for that service may be processed.
The website does not request special-category personal data. Please do not include health, criminal-conviction or similarly sensitive information in message fields.
- Identity and contact data: name, email address and an optional phone number.
- Enquiry data: subject, message, service of interest and preferred contact method.
- Tool-report data: assumptions entered in a calculator, the resulting summary and the page from which the report was requested.
- Attribution context: first and submission page paths, the external referring domain only, and permitted UTM campaign fields where present.
- Security data: IP address, request time and limited technical records needed for rate limiting and abuse prevention.
- Preference data: whether you allow external content, stored locally in your browser.
Purposes and legal grounds
Data is processed to respond to consultation requests, deliver requested reports, assess the appropriate advisory scope, measure in aggregate which public pages contribute to qualified enquiries, protect information security and meet legal obligations.
Depending on the circumstances, processing relies on the KVKK grounds for steps directly related to forming or performing a contract, compliance with legal obligations, and legitimate interests that do not prejudice fundamental rights. Marketing communications require a separate lawful basis and, where necessary, explicit consent.
How data is collected
Data is collected electronically through tool-report requests, email, telephone and WhatsApp. Information typed into general contact forms is not saved on the website server; it is composed into a WhatsApp message on your device and reaches us only if you send it through WhatsApp.
For a PDF download, the phone number is formatted and validated only on your device and is not sent to the website server. For email delivery, your email address and result summary are sent to the email-delivery service.
First-page and permitted campaign fields remain in sessionStorage only for the browser session; no persistent user identifier is created. Full referrer URLs, query strings and URL fragments are not recorded. The limited attribution fields may be stored with an enquiry when it is submitted.
Transfers and service providers
Personal data may be shared, only as necessary to handle your request, with authorised team members and Resend, the email-delivery provider. Disclosure to public authorities occurs only where a valid legal request or obligation applies.
According to Resend's current documentation, email metadata, logs and API records are stored in the United States. When email-report delivery is enabled, an international data transfer therefore arises and must be handled in accordance with Article 9 of the KVKK.
The contact-page map is provided by Google. When it loads, Google may process technical connection data; further details are set out in the Cookie Policy.
Retention and security
Data is retained only for the period required by its purpose and any applicable statutory retention period, then deleted, destroyed or anonymised. Rate-limit records are processed briefly to prevent abuse.
Reasonable technical and organisational measures include access controls, input validation, request-size limits, honeypot fields, and IP- and contact-based rate limiting.
Your rights under Article 11 of the KVKK
You may ask whether your data is processed; request information; learn the purpose of processing and whether data is used accordingly; learn the recipients; and request correction of incomplete or inaccurate data or deletion/destruction where the legal conditions are met.
You may also request that corrections or deletions be notified to recipients, object to an adverse result produced exclusively by automated systems, and claim compensation for damage caused by unlawful processing.
How to apply
Send your request to the email or postal address shown above, with enough information to verify your identity, the subject of the request and your preferred response method. Requests are answered as soon as reasonably possible and within the statutory period. Additional verification or proof of authority may be required if another person's data is affected.