Legal
Privacy notice
This notice covers personal data processed through this website. It does not cover data processed inside Nasirus or Congirus on behalf of a licensing institution — there, the institution is the controller and we act on its instructions.
Last updated:
01Who is responsible
The controller for the processing described here is CND Studio Yazılım Teknolojileri Limited Şirketi, Musalla Bağları Mah., Gürsesler Sk. No:1 İç Kapı No:47, Esmira Office Center, 42060 Selçuklu/Konya, Türkiye.
For visitors in Türkiye this notice serves as the clarification text (aydınlatma metni) required by Law No. 6698 on the Protection of Personal Data (KVKK). For visitors in the European Economic Area it serves as the information required by Articles 13 and 14 of the GDPR.
02What we process and why
| Context | Data | Purpose | Legal basis |
|---|---|---|---|
| Visiting the site | IP address, request time, requested URL, HTTP status, user agent, referrer — recorded in server and CDN logs. | Delivering the site, keeping it available and defending against attacks and abuse. | GDPR Art. 6(1)(f) legitimate interest in a secure, functioning site · KVKK Art. 5(2)(f) legitimate interest. |
| Contact form | Name, email address, organisation, role, telephone, country, subject, message, plus the IP address the message was sent from. | Answering your enquiry and keeping a record of the correspondence. | GDPR Art. 6(1)(b) steps prior to a contract and Art. 6(1)(a) consent · KVKK Art. 5(1) explicit consent, confirmed by the checkbox on the form. |
| Bot protection | IP address, user agent and device signals, processed by Cloudflare Turnstile when you interact with the form. | Distinguishing people from automated submissions. | GDPR Art. 6(1)(f) legitimate interest in preventing abuse of the form. |
| Analytics | Pseudonymous identifiers, truncated IP address, pages viewed, approximate region, device and browser type. | Understanding which pages are useful so the site can be improved. | GDPR Art. 6(1)(a) consent · KVKK Art. 5(1) explicit consent. Nothing is loaded before you consent. |
| Consent record | The categories you accepted or rejected and the date. | Demonstrating that consent was given or withheld. | GDPR Art. 6(1)(c) legal obligation to demonstrate consent. |
03Who else is involved
We keep the number of third parties deliberately small. Each one below has a defined role and processes only what that role requires.
| Recipient | Role | Data reached | Location |
|---|---|---|---|
| Hosting provider | Runs the server that serves this site. | Server logs, and the contents of a submitted form while it is in transit. | Türkiye |
| Cloudflare, Inc. | CDN, TLS termination and bot protection (Turnstile). | Connection metadata, IP address, user agent, device signals. | Global edge network |
| Google Ireland Ltd. / Google LLC | Google Analytics 4 — only with your consent. | Pseudonymous analytics identifiers and truncated IP address. | EU and USA |
| Google Ireland Ltd. / Google LLC | Google Workspace — the mailbox that receives contact form messages. | The content of your message and your contact details. | EU and USA |
04Transfers outside Türkiye and the EEA
Cloudflare and Google may process data outside Türkiye and outside the EEA, including in the United States. For EEA transfers these providers rely on the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
For transfers abroad under KVKK we rely on the mechanisms available under Article 9 of the Law as amended, applied per recipient. Where a transfer cannot be placed on a valid mechanism, the corresponding service is not used.
05How long we keep it
- Server and CDN logs: kept short-term for security and troubleshooting, then deleted or aggregated.
- Contact form messages: kept as long as needed to handle the enquiry and any resulting business relationship, and thereafter for the periods required by commercial and tax law.
- Analytics data: retained under the Google Analytics 4 retention setting, at most 14 months.
- Consent record: kept in your own browser until you clear it or change your choice.
06Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You may also lodge a complaint with a supervisory authority in your country of residence.
Under KVKK Article 11 you may learn whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, request correction or deletion, request that these be notified to recipients, object to a result produced solely by automated analysis, and claim compensation for damage caused by unlawful processing. You may also complain to the Turkish Data Protection Authority (KVKK Kurumu).
07How to exercise them
Write to the email address below with enough detail for us to identify your records. We answer within thirty days under KVKK and within one month under the GDPR. We do not charge for a first request.
For analytics and preference storage, the “Cookie settings” link in the footer lets you withdraw or change your consent directly, without contacting us.
08Changes to this notice
When this notice changes we update the date at the top of the page. If a change materially affects a consent-based purpose, the consent version is raised and you are asked again rather than being carried over silently.
Contact for data protection matters
Requests, questions and complaints about personal data reach us here: