Data Protection Notice

1. Data controller

Your personal data is processed by the following legal entity, acting as data controller under Turkish Law no. 6698 on the Protection of Personal Data ("KVKK").

2. Personal data we process

We process only what you send us and what arises technically while the site is served. We do not collect special categories of personal data (health, biometrics, religion, membership and the like) — please do not enter any into our forms.

• Identity and contact data: the name, e-mail address and optional company name you type into the contact form.
• Content of your enquiry: the message itself.
• Security data: the IP address, browser and operating system, and request time recorded in server access logs.
• Usage data: only if you consent, the cookie identifier, pages viewed, session duration and approximate location (country/city level) generated by Google Analytics 4.

3. Purposes

• Responding to your enquiry, answering questions and preparing proposals.
• Conducting pre-contractual discussions and, if an engagement follows, delivering the work.
• Keeping the site secure and detecting abuse or attack attempts.
• Only with your consent, understanding which parts of the site are useful so we can improve the content and structure.

4. Legal bases

Each processing activity rests on one of the conditions listed in art. 5 KVKK:

• Enquiries and proposals: art. 5/2-c — directly related to the formation or performance of a contract.
• Replying to you and retaining the record for a reasonable period: art. 5/2-f — our legitimate interest, provided your fundamental rights are not harmed.
• Server logs and security measures: art. 5/2-ç — compliance with a legal obligation, and art. 5/2-f.
• Analytics cookies: art. 5/1 — your explicit consent. Withholding it blocks access to nothing, and you can withdraw it at any time.

We deliberately do not ask for "explicit consent" for the contact form itself: KVKK treats reliance on consent where another lawful condition exists as misleading. Submitting the form means you have been informed of the processing described here — it is not a declaration of consent.

5. How we collect it

Your personal data is collected electronically and by fully automated means when you visit the site and submit the contact form. If you contact us directly by e-mail or WhatsApp, the records held on that channel fall within the same scope.

6. Transfers

Your data is shared, strictly for the purposes above, with the hosting and e-mail providers that act as our data processors. All of that infrastructure is located within Türkiye or the European Union.

If you consent to analytics, that service is provided by Google Ireland Limited. Beyond this we do not transfer your personal data abroad, do not sell it, and do not share it with third parties for advertising. Should our transfer arrangements change, this notice will be updated and you will be informed before the change takes effect.

Lawful requests from competent public authorities fall outside this scope under art. 8/2-a KVKK.

7. Retention

We keep your data for as long as the purpose requires and for the limitation periods set by law. Once the period ends, records are deleted or anonymised.

• Enquiries that do not lead anywhere: 2 years from the last message.
• Enquiries that become an engagement: 10 years from the end of the relationship (the general limitation period under art. 146 of the Turkish Code of Obligations, plus tax record-keeping periods).
• Server access logs: 12 months.
• Analytics records: 14 months in Google Analytics 4.

8. Your rights under art. 11 KVKK

By applying to the data controller you may:

• Learn whether your personal data is being processed.
• Request information about it if it has been processed.
• Learn the purpose of processing and whether the data is used accordingly.
• Know the third parties, in Türkiye or abroad, to whom it has been transferred.
• Request correction if it is incomplete or inaccurate.
• Request erasure or destruction under the conditions in art. 7 KVKK.
• Request that any correction, erasure or destruction be notified to the third parties concerned.
• Object to a result reached solely through automated analysis that works against you.
• Claim compensation if you suffer loss through unlawful processing.

9. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request in writing to the postal address above, to our registered electronic mail (KEP) address, or from the e-mail address on record with us to contact@pepechura.com. Your application should state your name, signature (for written applications), Turkish ID number, notification address and the subject of the request.

We respond as soon as possible and in any case within 30 days, free of charge. Where the action incurs a cost, the fee set by the Board may apply. If our answer does not satisfy you, or none arrives in time, you may lodge a complaint with the Turkish Personal Data Protection Board.

10. Changes

We may update this notice as the law or our processes change. The current version always appears on this page and the date above is revised. If a change is material, your cookie preference is reset and you are asked again.