PepechuraPepechura
Free scoping call →
Privacy

Privacy Policy

In plain language: what data Pepechura collects, why, where it is kept, and what rights you have over it.

Last updated:

1. Scope

This policy covers pepechura.com and its subpages. As a data controller established in Türkiye we are subject to Law no. 6698 (KVKK); because the site is also visited from the European Union, we act so as to meet the requirements of the General Data Protection Regulation (GDPR) for visitors in the EU.

The legal detail (the KVKK articles relied upon, retention periods and the application procedure) lives in the Data Protection Notice. This policy is its plain-language companion; where the two differ, the Notice governs.

2. What we collect

  • When you write to us: the name, e-mail, phone, optional company name, message and wizard selections you enter in the contact form or the quote wizard (no more than you choose to fill in). Your details reach us only when you press one of the send buttons.
  • Automatically: access logs generated by the server hosting the site (IP address, browser, request time). These exist for security and debugging, never for marketing.
  • Only if you agree: which pages were viewed, how long you stayed and approximate country/city location, via Google Analytics 4.

We collect no payment details, no identity documents and no special categories of personal data. The site has no accounts, memberships or profiles.

3. Why we collect it

There is one answer: to be able to reply to you, and to keep the site working and secure. Analytics tells us which content earns its place, which is exactly why it is optional and gated behind your consent.

We do not sell your personal data, do not share it with ad networks, and do not send commercial electronic messages you did not ask for. We run no newsletter or marketing list.

4. Who we share it with

Only with the infrastructure providers needed to deliver the service, acting as our data processors:

  • Vercel Inc. (USA): hosting, content delivery, server logs and the server function that relays form details to our CRM (it stores no content).
  • Railway Corp. (US-based): the infrastructure hosting the customer relationship management (CRM) system where we keep enquiry records.
  • Google: Google Workspace, our e-mail provider, and Google Analytics 4 only if you consented to analytics.
  • WhatsApp (Meta): only if you message us on WhatsApp.

There are no other recipients, save for lawful requests from competent public authorities.

5. Where your data lives

When you e-mail us, the correspondence is kept in Google Workspace, our e-mail provider, and Google may process it on servers outside Türkiye. When you message us on WhatsApp, the conversation stays on WhatsApp’s (Meta’s) infrastructure.

When you submit the contact form or the quote wizard, your details are written to our customer relationship management (CRM) system as an enquiry record. That system runs on Railway infrastructure, on servers outside Türkiye, and the details reach it through the site’s server function on Vercel.

The site itself is published on Vercel Inc.’s infrastructure, and that company is established in the United States. Server access logs are therefore transferred abroad, and if you consent to analytics, Google Analytics 4 data is processed abroad too. The basis for each transfer and the possible risks are set out in section 6 of the Data Protection Notice.

Analytics cookies, by contrast, only come into play if you consent; withhold consent and no such data flows at all.

6. How long we keep it

  • Enquiries that do not lead anywhere: 2 years from the last message.
  • Enquiries that become an engagement: 10 years from the end of the relationship (the general limitation period under art. 146 of the Turkish Code of Obligations, plus tax record-keeping periods).
  • Server access logs: 12 months.
  • Analytics records: 14 months in Google Analytics 4.

Once the period ends, records are deleted or irreversibly anonymised.

7. Your rights

You have the right to access your data, to have it corrected or erased, to have its processing restricted, and to object to processing. These are set out in art. 11 KVKK; if you are in the EU you enjoy the same protection under arts. 15-22 GDPR, including the right to receive your data in a portable form.

Write to contact@pepechura.com and we will respond within 30 days at the latest, free of charge. The detailed application procedure is in section 9 of the Data Protection Notice.

8. Cookies

Analytics cookies load only with your consent; until you give it, no Google script is requested at all. The full list of cookies and local-storage items, and how to change your choice, is in the Cookie Policy.

9. Security

The site is served entirely over HTTPS. Access to data is limited to those who need it for their work. No technical measure is absolute; if a breach occurs we will meet the notification duties KVKK and the GDPR impose.

10. Children

This site is aimed at businesses and we do not knowingly collect personal data from anyone under 18. If we notice such data has reached us, we delete it.

11. Changes and contact

If we update this policy we revise the date above. Questions go to contact@pepechura.com.