Data Protection Notice

Controller and scope

For the purposes of Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK), the controller is METAZEN BİLİŞİM VE DANIŞMANLIK LİMİTED ŞİRKETİ, based in Selçuklu, Konya, Türkiye. Registered details and request channels appear at the end of this page.

This notice covers website visits, enquiries, proposal requests, job applications and project-based collaboration applications. It provides information; it is not a request for consent.

Information and collection methods

We receive information electronically through forms you complete, documents you upload, email correspondence and automatic server security records.

• Identity and contact: name, email and phone number.
• Enquiry details: services, budget range, message and project attachment.
• Professional details: area of interest, education, experience, CV and any portfolio you share.
• Security information: IP address, browser, form language, submission and access records.

We do not request special-category information. Please leave out unrelated health information, criminal records and copies of identity documents.

Purposes and legal grounds

• Proposals and contract discussions: assessing a requested service and contacting you, where directly related and necessary to establish or perform a contract, under Article 5(2)(c).
• General enquiries and security: handling communication, preventing abuse and securing the service, based on legitimate interests subject to your fundamental rights and freedoms, under Article 5(2)(f).
• Applications: assessing suitability and taking steps towards employment or a collaboration agreement where necessary under Article 5(2)(c); other assessments rely on a balanced legitimate interest under Article 5(2)(f).
• Legal duties and claims: complying with valid authority requests and required records, or protecting rights in a dispute, under Articles 5(2)(ç) and 5(2)(e) where applicable.
• Optional technologies: explicit consent under Article 5(1) for analytics, marketing and external content where no other processing condition applies. This choice is not required to submit a form.

Form details are not used for advertising targeting or automatic marketing subscriptions. A different future purpose would require appropriate information and, where needed, separate consent.

Recipients and transfers

Authorised people review enquiries and applications. Hosting, technical maintenance, email delivery and form security providers receive only information needed for their service. Public authorities may receive information where legally required, and legal advisers may receive relevant information in a dispute.

Form notifications are sent through Resend. Enquiry details and any project attachment are included in the email; application notifications contain the application details. Resend stores data in the United States.

Cloudflare Turnstile may process IP addresses and technical device and browser signals for form security, including on infrastructure outside Türkiye.

Google provides the map loaded with your permission. The Cookie Policy describes optional tools. International transfers require an assessment of Article 9 adequacy or appropriate safeguards. A privacy notice or a general checkbox does not replace a required transfer mechanism, such as a standard contract.

Retention and security

Retention of enquiries and proposals is determined by completion of the request, ongoing discussions, any resulting contract and the period needed for potential legal claims.

Application records are assessed against the duration of the review and any period needed for potential legal claims. Retention for unrelated future positions is a separate purpose requiring its own information and legal basis.

Technical records are assessed against security needs and applicable legal retention requirements. When the reason for retention ends, information must be deleted, destroyed or anonymised. Uploaded documents are not published in the public media directory. Administration access is permission-controlled.

Your rights under KVKK

Under Article 11 you may:

• Learn whether your information is processed and request details.
• Learn the purpose and whether the information is used for that purpose.
• Learn which third parties receive it in Türkiye or abroad.
• Request correction of incomplete or inaccurate information.
• Request deletion or destruction where Article 7 conditions apply.
• Ask for correction, deletion or destruction to be communicated to recipients.
• Object to a detrimental outcome based solely on automated analysis.
• Seek compensation for harm caused by unlawful processing.

Making a request

You can write to the address below, use registered electronic mail (KEP), a secure electronic or mobile signature, or email us from an address you previously supplied and that is recorded in our system. Include the identity, contact and request information required by the applicable Turkish request procedure. We may seek proportionate information to verify your identity.

Requests are answered as soon as possible and within 30 days. If responding requires an additional cost, a fee may apply within the tariff set by the Turkish Board. If a request is rejected, the answer is insufficient or no answer arrives on time, a complaint may be made to the Board within 30 days of learning the response and, in all cases, within 60 days of the original request.

Where UK GDPR applies, additional rights and complaint routes described in our Privacy Policy remain available.