GDPR Data Protection Notice

Who is this notice for?

This notice is for people who contact our website while located in the European Union (EU) or the European Economic Area. The General Data Protection Regulation (GDPR — (EU) 2016/679) may also apply where an organisation established outside the Union offers goods or services to people in the EU (Art. 3(2)). As we also provide our services to clients abroad, we take this scope seriously and provide here the information the GDPR requires. If you are located in Türkiye, the Privacy Notice (KVKK) is the document that applies to you; the two texts describe the same processing activity within the framework of different legislation.

Controller and representative

Controller	Karaca Technology
Address	İskenderun / HATAY, TÜRKİYE
E-mail	[email protected]
Telephone	+90 534 724 25 32
EU representative (Art. 27)	Not appointed
Data protection officer (Art. 37)	Not appointed — the nature and scale of the processing activity do not meet the conditions for mandatory appointment

The site is published at karacatechnology.com; your requests and applications are sent to [email protected].

No EU representative has been appointed: there is no regular and systematic monitoring of people located in the EU, and the processing is limited to individual contact records arriving upon request. You may address any question or request to us directly through the details above.

Data processed and purposes of processing

Our website has no membership, payment or profile creation. The only channel through which we obtain personal data directly from you is the quotation form, and it contains the following data: full name, e-mail address, optional telephone number, optional company name, service of interest, budget range, message text and the consent record. When you submit the form, your IP address, browser information, the address of the page on which you completed the form and the time of submission are also recorded. The purpose is to get back to you about your request, to prepare a quotation and to prevent misuse of the form. Separately, the technical data Cloudflare processes on your requests to the site and, where Turnstile verification is enabled on the contact form, the technical signals Cloudflare collects are explained below in the Recipients and transfers to third countries section.

After your request reaches us, the authorised user handling it adds two further fields to your record: request status (new / in progress / completed / spam) and an internal request follow-up note (free text). These are not data provided by you; they are kept in order to keep the request from going unanswered and to record the course of the discussion, are visible only to authorised personnel and are deleted together with your record. When you request access under Art. 15, these fields are also among the data processed about you.

Legal bases (Art. 6)

Processing	Legal basis
Responding to your request, preparing a quotation	Art. 6(1)(b) — performance of a contract or steps taken at your request prior to entering into a contract
The declaration you give through the consent checkbox on the form	Art. 6(1)(a) — explicit consent (withdrawable at any time under Art. 7(3))
Security records, spam and misuse checks (including the Cloudflare security layer and, where enabled, Turnstile bot verification)	Art. 6(1)(f) — legitimate interest (network and information security, see Recital 49)
Request follow-up note and request status (internal assessment)	Art. 6(1)(f) — legitimate interest (following up the request and running business processes)
Statutory retention and handling of legal claims	Art. 6(1)(c) legal obligation and Art. 6(1)(f) legitimate interest

Special category data (Art. 9) is not requested and is not knowingly processed. No automated decision-making or profiling (Art. 22) takes place.

Recipients and transfers to third countries

Your data is not sold, rented or shared for advertising purposes. The recipients are our hosting provider, our corporate e-mail infrastructure and Cloudflare, Inc., which runs in front of the site (content delivery network and security service; Turnstile verification on the contact form where enabled). The hosting and e-mail providers act in the capacity of processor and only to the extent the service requires; in its Turnstile Privacy Addendum, Cloudflare states that it processes Turnstile data as a processor to provide the service and as a controller to improve its bot detection. As we obtain these services externally, the server and backup locations of the providers are set out in the service agreements between us.

The controller is established in Türkiye; therefore every request reaching us from the EU is, in GDPR terms, a transfer to a third country. There is no adequacy decision (Art. 45) issued by the European Commission in respect of Türkiye. For this reason the transfer rests on the derogation in GDPR Art. 49(1)(b), “necessary for the implementation of pre-contractual measures taken at the data subject’s request”, and/or on your explicit consent under Art. 49(1)(a). When you choose to reach us through the form, you act in the knowledge that your data is transferred under these conditions. The volume of transfer is individual and irregular; no bulk or systematic transfer takes place.

If the infrastructure of one of our service providers is located in a country other than Türkiye, the conditions of Chapter V (Art. 44-49) are likewise required for the transfer made there: an adequacy decision; failing that, appropriate safeguards such as standard contractual clauses, or the derogations in Art. 49. Rather than giving an unverified undertaking about server location, we state the principle we apply: the location is determined by contract, and the transfer is made only where these conditions are satisfied.

The site is served through the content delivery network and security layer of Cloudflare, Inc. (USA); your requests may also pass through Cloudflare data centers outside Türkiye, and Cloudflare may write its own security cookies to your browser when its security features are enabled (see the Cookie Policy). Where Turnstile verification is enabled on the contact form, your browser loads the verification widget directly from Cloudflare when you interact with the form; in doing so Cloudflare collects technical signals such as your IP address, browser information (user agent) and the TLS fingerprint of the connection, and the widget leaves a record in your browser’s local storage area on Cloudflare’s domain (see the Cookie Policy). On submission, your IP address and the verification token produced by the widget are forwarded from our server to Cloudflare. The Chapter V (Art. 44-49) principle stated above applies to these transfers as well.

Retention period (Art. 13(2)(a))

Requests that do not turn into a contract are kept for at most 2 years from the closure of the request. For relationships that turn into a contract, the records are kept for the 10-year general limitation period under Turkish law running from the end of the relationship. Technical data kept for security purposes, together with the request follow-up note and the request status, are subject to the same period as the record concerned. Once the period expires, the data is deleted, destroyed or anonymised. These deletion operations run automatically: the maintenance task that runs at most once a day when the administration panel is opened removes closed (completed) requests from the database at the end of 2 years and submissions marked as spam at the end of 30 days, and every deletion is written to the audit log. Open requests and the records of relationships that have turned into a contract fall outside this automatic deletion; when their period expires, the assessment is made manually.

Your rights (Art. 15-22)

• Right of access (Art. 15): to learn whether we process data about you and to request a copy of the data.
• Right to rectification (Art. 16): to request the correction of inaccurate or incomplete data.
• Right to erasure — the “right to be forgotten” (Art. 17): to request the erasure of your data; if we are under a statutory retention obligation, we inform you of its scope.
• Right to restriction of processing (Art. 18): in certain cases, to request that the data be only stored and not otherwise used.
• Notification obligation (Art. 19): notification of rectification, erasure or restriction to the recipients to whom the data has been disclosed.
• Data portability (Art. 20): to receive the data you have provided, where it is processed by automated means on the basis of consent or a contract, in a structured, commonly used and machine-readable format (for example CSV or JSON); and, where technically feasible, to have it transmitted directly to another controller.
• Right to object (Art. 21): to object, on grounds relating to your particular situation, to processing based on legitimate interest. You may object unconditionally to processing for direct marketing purposes — although no processing for direct marketing purposes takes place on the site.
• Automated decision-making (Art. 22): not to be subject to decisions based solely on automated processing that produce legal effects concerning you. No such decision mechanism is used.
• Withdrawal of consent (Art. 7(3)): for processing based on consent, you may withdraw the consent you have given at any time; withdrawal does not affect the lawfulness of processing carried out up to that point.

How do you exercise your rights?

You may send your requests to [email protected] or to our address at İskenderun / HATAY, TÜRKİYE. Your application is answered free of charge within one month pursuant to Art. 12(3); this period may be extended by a further two months owing to the complexity or number of the requests, and in the event of an extension you are informed together with the reasons. If reasonable doubt arises as to your identity, we may request additional information (Art. 12(6)); this is to ensure that your data is not given to someone else.

Right to lodge a complaint with a supervisory authority (Art. 77)

If you consider that your data has been processed in breach of the GDPR, you have the right to lodge a complaint with the data protection supervisory authority in the EU Member State of your habitual residence, place of work or the place of the alleged infringement. As regards Türkiye, the competent authority is the Personal Data Protection Authority. You are not obliged to contact us before exercising your right of complaint; however, we would prefer to resolve the matter directly and quickly.

Data security (Art. 32)

The measures we apply to protect the data include encrypting transmission with HTTPS, running database queries as parameterised statements, storing administration panel passwords as an irreversible hash, protecting session cookies with the HttpOnly/SameSite flags, limiting failed login attempts and allowing only authorised personnel to access the records. In the event of a personal data breach, notification is made to the competent authority and, where necessary, directly to the data subjects, pursuant to Art. 33 and Art. 34.

Are you obliged to provide data?

No. Completing the form is entirely optional. However, without the name, e-mail and message fields we cannot receive your request or get back to you; these fields are the minimum information required for a pre-contractual discussion to begin.

Changes

This notice is updated whenever our processing activity or the legislation changes; the current version is always published at this address.

Last updated: October 28, 2026