Data protection notice (KVKK)

This is an English translation provided for convenience. The Turkish version is the binding text and prevails in case of any difference.

This notice has been prepared by Berkay Abay under Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK), Türkiye's personal data protection law, to inform people who visit the site, fill in a form or contact us.

1. Identity of the data controller

Name / trade name: Berkay Abay
Address: Kütükçü Mah. 2975 Sk. No:39 İç Kapı No:3 Kepez/Antalya
Phone: +90 542 896 82 02
Email: info@berkayabay.com
KEP (registered electronic mail): berkay.abay@hs01.kep.tr

2. Data processed, purposes of processing and legal grounds

Contact, quote and purchase forms

Data: Name, business name, email, phone, subject, message, declaration of commercial or professional purpose, selected package, for custom quotes the budget, project type and requested date, the page from which the form was sent, optionally where you heard about the site and the phrase you wrote to the AI assistant, the time the form was sent and the version of this notice
Purpose: Responding to your request, preparing a quote and conducting pre-contract discussions
Legal ground: Processing is directly related to the conclusion or performance of a contract (KVKK Art. 5(2)(c))

Package finder

Data: Business name, declaration of commercial or professional purpose, package finder answers (project type, needs, budget range, requested date), contact details, the page from which the form was sent, optionally where you heard about the site and the phrase you wrote to the AI assistant
Purpose: Identifying the package that suits you and preparing a quote
Legal ground: Processing is directly related to the conclusion or performance of a contract (KVKK Art. 5(2)(c))

Free website audit

Data: Website address, name, business name, email, phone, message, declaration of commercial or professional purpose, the page from which the form was sent, optionally where you heard about the site and the phrase you wrote to the AI assistant
Purpose: Carrying out the audit you requested and sending you the result
Legal ground: Legitimate interest, provided that it does not harm your fundamental rights and freedoms (KVKK Art. 5(2)(f))

Support assistant (AI)

Data: The messages you write to the assistant and the assistant's replies; if you create a call-back or meeting request, your name, business name, phone or email, a suitable time and a summary of the request; the time of the conversation
Purpose: Answering your questions about services, prices and contract terms, creating a request for us to get back to you when you ask for it, and notifying us of that request
Legal ground: Processing is directly related to the conclusion of a contract (KVKK Art. 5(2)(c)) and legitimate interest, provided that it does not harm your fundamental rights and freedoms (KVKK Art. 5(2)(f))

WhatsApp, phone and email conversations

Data: Name, phone number, email address and content of the correspondence
Purpose: Answering your questions and running the project
Legal ground: Conclusion or performance of a contract (KVKK Art. 5(2)(c)) and legitimate interest (KVKK Art. 5(2)(f))

Online orders and payment

Data: Company trade name, tax number or Turkish national ID number, tax office, billing address, name of the authorized person, email, phone, selected service, package and billing period, payment amount, method and result, for card payments the PayTR order number, for bank transfer (havale/EFT) payments the sender name, IBAN and description in the bank account transaction, the contract acceptance record (time of acceptance, IP address, contract version and the declarations ticked), and for monthly services the card storage token issued by PayTR
Purpose: Creating the order, receiving and verifying the payment, collecting the payment for each period of monthly services, proving acceptance of the contract, issuing the order form and the invoice
Legal ground: Conclusion or performance of a contract (KVKK Art. 5(2)(c)), compliance with a legal obligation (KVKK Art. 5(2)(ç)), establishment, exercise or protection of a right (KVKK Art. 5(2)(e))
Card details: The card number, expiry date and security code are sent directly to PayTR; they do not reach this site's servers and are not kept on the site. For monthly services, if you give your consent, the card is stored by PayTR.

Contract, invoice and payment records

Data: Identity and contact details, tax details, contract and payment records
Purpose: Performing the contract, issuing invoices and fulfilling legal obligations
Legal ground: Performance of a contract (KVKK Art. 5(2)(c)), compliance with a legal obligation (KVKK Art. 5(2)(ç)), establishment or protection of a right (KVKK Art. 5(2)(e))

Analytics and ad measurement (only if you consent)

Data: Cookie identifiers, IP address, browser and device information, pages visited and actions taken on the site (e.g. form submission)
Purpose: Producing visit statistics
Legal ground: Explicit consent (KVKK Art. 5(1)). If you do not consent, this processing does not take place and you can continue to use the site.

Site security and technical logs

Data: IP address, date and time, requested page and browser information
Purpose: Keeping the site running and secure, and detecting errors
Legal ground: Legitimate interest, provided that it does not harm your fundamental rights and freedoms (KVKK Art. 5(2)(f))

3. Transfer of data

Recipient groups

Hosting: Cloudflare, Inc. (USA): serving the site, processing forms and storing online order records
Payment institution: PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (Türkiye): receiving card payments, verifying the payment result and, for monthly services, storing the card
Form notifications: Resend, Inc. (USA; sending servers in Ireland): delivering form content and order emails by email
Support assistant: Anthropic, PBC (USA): answering messages written to the assistant with an AI model
Request notifications: Telegram FZ-LLC (United Arab Emirates): notifying us instantly of a call-back or meeting request created in the assistant
Email: Natro: hosting of the info@berkayabay.com mailbox
Accounting: Certified public accountant and accounting service: invoicing and tax matters
Public authorities: Legally authorized institutions and organizations: upon request
Measurement and advertising: Google (USA): producing visit statistics, only with your explicit consent

The hosting, form notification, support assistant and request notification providers are located abroad. When you use the site, send a form or write to the assistant, your data may be transferred to these providers' servers abroad. Cloudflare serves the site from its servers around the world. These transfers are necessary to provide the service and are made under the providers' data processing agreements.

For analytics and advertising tools, data is transferred abroad only if you give explicit consent in the cookie preferences. You can withdraw your consent at any time through the "Cookie preferences" link at the bottom of the site.

The countries to which data is transferred may not offer the same level of protection as Türkiye. You can write to us with any questions about transfers abroad.

If you choose to write to us on WhatsApp, your message is processed under WhatsApp's own terms.

4. Method of data collection

Data is collected from you through the forms on the site, the payment page, the support assistant, email, WhatsApp and phone conversations and the contract process; technical logs are collected automatically during your visit to the site. Analytics and advertising cookies are collected automatically through your browser, only if you consent.

5. Retention period

Support assistant conversations and requests: 14 days from the conversation; if the request turns into contract discussions, the relevant information is kept together with the contract records
Requests that do not lead to a contract: 1 year from the conclusion of the request
Contract, online order, payment and contract acceptance records and project correspondence: 10 years from the end of the contract
Invoice and accounting records: for the period set by tax and commercial legislation
Technical logs: for the log retention period of the hosting service
Analytics and advertising cookies: the periods stated in the cookie policy; retention on the provider's side is subject to the provider's terms

At the end of the period, the data is deleted, destroyed or anonymized.

6. Your rights under KVKK

Under Article 11 of KVKK, you can apply to us to exercise the following rights:

To learn whether your personal data is processed
If it has been processed, to request information about it
To learn the purpose of processing and whether the data is used in line with that purpose
To know the third parties in Türkiye or abroad to whom the data is transferred
To request correction if the data is incomplete or incorrectly processed
To request deletion or destruction of the data within the conditions of Article 7 of KVKK
To request that correction, deletion and destruction be notified to the third parties to whom the data was transferred
To object to a result against you arising from the analysis of the data exclusively by automated systems
To claim compensation for damage if you suffer damage due to unlawful processing

You can submit your application in Turkish and in writing, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, stating your name, surname, signature, Turkish national ID number (for foreign nationals, nationality and passport number), address for notification, email address and phone number if any, and the subject of your request. The application can also be made by registered electronic mail (KEP), secure electronic signature, mobile signature or from the email address you previously provided to us and that is in our records.

Application addresses: info@berkayabay.com, Kütükçü Mah. 2975 Sk. No:39 İç Kapı No:3 Kepez/Antalya, berkay.abay@hs01.kep.tr.

Applications are concluded free of charge within 30 days at the latest. If the process requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, you find the response insufficient or no response is given in time, you can file a complaint with the Board.

Last updated: November 11, 2026