Privacy Policy
Last updated: 18.09.2026
Türkçe KVKK aydınlatma metni için tıklayın →
This notice explains how Uğur Arslan – Ev & Stil Yapı Dekorasyon processes personal data in connection with this website. It is written to meet the information requirements of Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and applies alongside our Turkish information notice under Law No. 6698 (KVKK), which remains the governing text for data subjects in Türkiye.
1. Controller
| Controller | Uğur Arslan – Ev & Stil Yapı Dekorasyon |
|---|---|
| Represented by | Uğur Arslan |
| Address | Topçu Mah. 1534. Sk. No: 19A, 06796 Etimesgut / Ankara, Türkiye |
| ugursevda22@gmail.com | |
| Telephone | +90 544 741 14 82 |
We have not appointed a Data Protection Officer; there is no statutory obligation to do so given the nature and scale of our processing. Please direct all privacy enquiries to the address above.
2. Categories of data and sources
| Category | Data | Source |
|---|---|---|
| Server log data | IP address, date and time of request, page requested, referrer, user agent | Collected automatically by our hosting provider |
| Contact form | Name, telephone number, email address (optional), selected service, message content, time of submission | Provided by you |
| Form security | IP address, submission timing, reCAPTCHA risk score (only if you consent to reCAPTCHA) | Collected automatically |
| Consent record | Random consent ID, timestamp, text version, language, categories chosen, shortened and hashed origin | Generated when you make a cookie choice |
We do not request special categories of personal data (Art. 9 GDPR). Please do not enter health, religious, political or similar information into the form fields.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Delivering the website and keeping it secure and stable | Art. 6(1)(f) GDPR — our legitimate interest in a functioning, attack-resistant website |
| Responding to your enquiry and preparing a quotation | Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract |
| Performing an agreed renovation contract | Art. 6(1)(b) GDPR — performance of a contract |
| Protecting the form against automated abuse (honeypot, rate limit) | Art. 6(1)(f) GDPR — legitimate interest in preventing spam and misuse |
| Loading Google reCAPTCHA; any non-essential cookies | Art. 6(1)(a) GDPR consent, in conjunction with § 25(1) TDDDG / Art. 5(3) ePrivacy Directive |
| Retaining accounting and tax records | Art. 6(1)(c) GDPR — compliance with a legal obligation |
| Demonstrating a valid cookie consent | Art. 7(1) GDPR — accountability obligation of the controller |
Providing your data is neither required by statute nor by contract. However, without a name, a means of contact and a description of the work, we cannot respond to an enquiry.
4. Recipients and processors
We use the following service providers, each bound by a data processing agreement:
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting, content delivery, server logs, runtime logs | USA / global edge network |
| Plus Five Five, Inc. (Resend) | Delivery of contact form messages by email | USA |
| Google Ireland Ltd. / Google LLC | reCAPTCHA v3 — loaded only with your consent | Ireland / USA |
Beyond this, data is disclosed only to public authorities where we are legally required to do so, and to our tax and legal advisers where necessary. We do not sell personal data and we do not use it for advertising or profiling.
5. Transfers to third countries
The providers listed above process data in the United States. Such transfers take place on the basis of Art. 46(2)(c) GDPR using the European Commission’s Standard Contractual Clauses, supplemented by the providers’ technical and organisational safeguards, and — where the recipient is certified — on the basis of an adequacy decision under the EU–US Data Privacy Framework.
Please note that United States authorities may, under certain conditions, be able to access data held by US providers, and that the legal remedies available to you there may not correspond to those under EU law. Where a transfer depends on your consent, you may withdraw that consent at any time with effect for the future.
6. Retention periods
- Enquiries that do not lead to a contract: up to 12 months
- Records relating to a concluded contract: 10 years after the end of the business relationship (limitation period under the Turkish Code of Obligations, Art. 146)
- Accounting and tax records: 10 years (Turkish Tax Procedure Law and Commercial Code)
- Server and security logs: up to 12 months
- Cookie consent records: up to 3 years after the consent expires, to satisfy the accountability obligation
Once the period ends, data is deleted, destroyed or irreversibly anonymised.
7. Cookies and local storage
Only strictly necessary storage is used without consent. Everything else — currently only Google reCAPTCHA — is loaded exclusively after you have actively agreed. Full details, including a table of every item stored, are in our Cookie Policy.
8. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure of your data (Art. 17);
- restriction of processing (Art. 18);
- data portability in a structured, machine-readable format (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw consent at any time with effect for the future (Art. 7(3)), without affecting the lawfulness of processing carried out beforehand.
To exercise any of these rights, write to ugursevda22@gmail.com. We respond within one month; that period may be extended by a further two months for complex requests, in which case we will tell you why.
9. Right to lodge a complaint
You may lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). Data subjects in Türkiye may apply to the Personal Data Protection Authority (KVKK — Kişisel Verileri Koruma Kurumu) after first addressing us directly.
10. Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. The reCAPTCHA risk score is used solely to decide whether a form submission is accepted for review by a human; it has no legal or similarly significant effect on you.
11. Security
The website is served exclusively over HTTPS. Form data is transmitted over an encrypted connection, API credentials are held server-side only, and access is limited to what is necessary. We apply appropriate technical and organisational measures in line with Art. 32 GDPR.
12. Children
This website is directed at adults. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to this notice
We update this notice when our processing or the applicable law changes. The current version is always published on this page, with the date of the last revision shown at the top.