Privacy Notice (KVKK)

Identity of the data controller

Under Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data is processed by Karaca Technology in the capacity of data controller, within the framework of the purposes, legal grounds and periods explained below.

Data controller	Karaca Technology
Address	İskenderun / HATAY, TÜRKİYE
E-mail	[email protected]
Telephone	+90 534 724 25 32
Website	karacatechnology.com

This notice covers the website published on the karacatechnology.com domain and the handling of the requests that reach us through this site. Our corporate e-mail address for applications and notifications is [email protected]. The site has no membership, newsletter subscription, online payment, commenting or file upload function. The only channel through which we obtain personal data directly from a visitor is the quotation form on the Contact page; the explanations below describe that form and the technical data processed by automated means while the site is used.

Personal data we process

What you submit to us on the form

Data	Mandatory?	Data category
Full name	Yes	Identity
E-mail address	Yes	Contact
Telephone number	No	Contact
Company / organisation name	No	Customer transaction
Service you are interested in	No	Customer transaction
Budget range	No	Customer transaction
Your message (free text)	Yes	Customer transaction
Consent checkbox tick	Yes	Transaction security (consent record)

Data recorded automatically when you submit the form

Data	Why is it recorded?
IP address	To limit automated (bot) submissions made from the same address within a short period and to detect misuse
Browser information (user agent)	To distinguish fake or automated submissions and to resolve technical problems
Address of the page on which the form was completed	To understand which service page the request came from
Date and time of submission	To follow the order of requests and the retention period

What we add while assessing your request

Data	What does it serve?	Data category
Request status (new / in progress / completed / spam)	To follow the stage the request has reached, to keep it from going unanswered and to separate automated (bot) submissions	Customer transaction
Request follow-up note (internal free text)	To record internal assessments such as the course of the discussion, the information given and the next step	Customer transaction

You do not fill in these two fields; the authorised user handling the request enters them in the administration panel and they are added to your record. Only authorised personnel with access to the panel can see them, they are not shared with third parties, and they are deleted together with your quotation record when it is deleted. When you request information under Article 11 of the KVKK, these fields are also among the data processed about you.

We kindly ask you not to write special categories of personal data (health, religion, criminal conviction, biometric or genetic data, trade union membership and the like) into the free text field of the form; we do not request such data and do not wish to process it. If it is submitted nonetheless, it is deleted at the first suitable opportunity once your request has been dealt with. Before sending us data belonging to a third person (for example the telephone number of one of your employees), the responsibility for informing that person rests with you.

Purposes for which your personal data is processed

• To assess your quotation request, to get back to you and to prepare pricing
• To follow internally the stage the request has reached and to keep it from going unanswered
• To conduct pre-contractual discussions and, if a business relationship is established, to maintain communication during the project
• To prevent misuse of the form (spam, automated submission, denial-of-service attempts) and to ensure information security
• To fulfil our obligations arising from legislation and to protect our rights in a possible dispute

Your data is not added to advertising or marketing lists, not sold and not rented; no profile is drawn up about you, and no decision producing an adverse result for you is generated by analysing your data solely through automated systems.

Legal grounds

Processing	Legal ground (KVKK Art. 5)
Responding to your request, preparing a quotation	Art. 5/2-c — being directly related to the conclusion or performance of a contract (the request comes from you)
The declaration you give through the consent checkbox on the form	Art. 5/1 — explicit consent (you may withdraw it at any time)
Security records and bot verification: IP address, browser information, source page; the verification token where Cloudflare Turnstile is enabled	Art. 5/2-f — legitimate interest, provided that it does not harm your fundamental rights and freedoms
Request follow-up note and request status (internal assessment in the panel)	Art. 5/2-f — our legitimate interest in following up the request and running our business processes
Statutory retention and exercise of the right of defence	Art. 5/2-ç legal obligation, Art. 5/2-e establishment, exercise or protection of a right

When you withdraw your explicit consent, only the processing that rests on consent is stopped; processing based on other legal grounds (for example a statutory retention obligation) may continue until that period expires.

Method of collection

Your personal data is collected directly from you, by partly automated means and in electronic form, through the form on the website. It is written to the database on our hosting server and the same content is forwarded to our corporate e-mail address for information purposes. Technical data such as your IP address and browser information, on the other hand, is obtained from your browser by automated means while you use the site: it is stored with your record when you submit the form, it may be written to the server error logs, it is processed by Cloudflare on every request you make to the site and, where Turnstile verification is enabled on the contact form, it is collected by Cloudflare when you interact with the form (see the Cloudflare item in the Transfers section). No data is gathered from social media platforms, data vendors or publicly available lists.

Transfers

Your personal data is not sold or rented to third parties and is not shared for marketing purposes. The environments in which the data is held are as follows:

• Our hosting provider: the servers on which the website and the database run. The provider may access the data in the capacity of a data processor and only to the extent the service requires.
• Our corporate e-mail infrastructure: the form notification arrives at our corporate e-mail address.
• Cloudflare, Inc. (content delivery network and security service): our site is served through Cloudflare’s network; every request you make to the site first passes through this network, and in doing so Cloudflare processes your IP address and the request information sent by your browser (such as the requested address and browser information) to the extent the service requires. Where Cloudflare Turnstile verification is enabled on the contact form, your browser loads the verification widget directly from Cloudflare when you interact with the form; in doing so Cloudflare collects technical signals such as your IP address, browser information (user agent) and the TLS fingerprint of the connection, and the widget leaves a record in your browser’s local storage area on Cloudflare’s domain (see the Cookie Policy). On submission, your IP address and the verification token produced by the widget are forwarded from our server to Cloudflare. In its Turnstile Privacy Addendum, Cloudflare states that it processes this data as a data processor to provide the service and as a data controller to improve its bot detection.
• Authorised public institutions and organisations: only where legislation makes it compulsory and upon request.

Transfer abroad

We do not, of our own initiative, transfer your personal data to third parties abroad; we do not send it abroad for marketing, analytics or profiling purposes. That said, we obtain the hosting and corporate e-mail services listed above from external providers; the server and backup locations of these providers are set out in the service agreements between us. Should a provider’s infrastructure be located abroad, the transfer is not made unless the conditions in Article 9 of the KVKK are satisfied: if the Personal Data Protection Board has announced an adequacy decision, that decision is relied upon; if not, appropriate safeguards such as standard contractual clauses, undertakings or binding corporate rules, or the exceptions in Article 9/6, are relied upon.

Our site is served through the content delivery network and security layer of Cloudflare, Inc. (USA). Your IP address and the request information relating to your requests to the site may therefore also pass through Cloudflare data centers outside Türkiye; which data center is used is determined by Cloudflare’s network. The principle stated above applies to this transfer as well: no transfer is made unless the conditions in Article 9 of the KVKK are satisfied. The security cookies that Cloudflare may write to your browser are listed in the cookie inventory in the Cookie Policy.

Retention periods

Record	Period
Quotation form record — requests that do not turn into a contract	At most 2 years from the closure of the request
Quotation form record — requests that turn into a contract	10 years from the end of the business relationship (general limitation period, Turkish Code of Obligations No. 6098 Art. 146)
Form security data (IP address, browser information)	The same period as the record it belongs to; the misuse check uses only the last 15-minute window
Request follow-up note and request status (internal assessment in the panel)	The same period as the quotation record it belongs to; deleted together with that record
Server error logs	A size limit applies rather than a time limit: when the log file exceeds 5 MB, everything except the most recent 1,000 lines is deleted automatically
Administration panel login attempt records (authorised users only)	90 days; records that exceed the period are deleted by an automatic maintenance task

Once the period expires, records are deleted, destroyed or anonymised. These deletion operations run automatically: a maintenance task that runs at most once a day when the administration panel is opened permanently deletes from the database the records whose retention period has expired — closed (completed) quotation requests, submissions marked as spam, login attempt records older than 90 days and expired session records — and every deletion is written to the audit log of the panel. As there is no scheduled task on the server, in periods when the panel is not entered for a long time the clean-up runs at the first login; an authorised user may also start the clean-up manually from the panel. The same explanation applies to the Privacy Policy; if you notice a difference between the two texts, this notice is the one to be taken as the basis, and we kindly ask you to report the difference to us.

Your rights as a data subject

Pursuant to Article 11 of the KVKK, by applying to the data controller you have the right:

1. To learn whether your personal data is being processed
2. To request information if it has been processed
3. To learn the purpose of processing and whether the data is used in accordance with that purpose
4. To know the third parties in the country or abroad to whom the data is transferred
5. To request rectification where the data has been processed incompletely or inaccurately
6. To request erasure or destruction within the framework of the conditions in Article 7 of the KVKK
7. To request that rectification, erasure and destruction operations be notified to the third parties to whom the data has been transferred
8. To object to a result arising against you through analysis carried out solely by automated systems
9. To claim compensation if you suffer damage owing to unlawful processing

How to apply

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, your application must include your full name, your signature in a written application, your Turkish identity number (for foreign nationals, your nationality and passport number), your residential or business address for service of notice, your e-mail address and telephone number for notification if any, and the subject of your request. You may submit your application:

• bearing a wet signature, by post, to İskenderun / HATAY, TÜRKİYE,
• or from the e-mail address registered in our system to [email protected]

Depending on its nature, your request is concluded free of charge as soon as possible and in any event within 30 days at the latest; if the operation additionally entails a cost, the fee in the tariff determined by the Personal Data Protection Board may be charged. If your application is rejected, if you find the response given insufficient, or if no response is given within the period, you may file a complaint with the Personal Data Protection Board within 30 days of the date you learn of the response and in any event within 60 days of the date of application.

Data security

The principal technical and administrative measures we take to protect your personal data are: serving the site over HTTPS, running database queries as parameterised (prepared) statements, storing administration panel passwords with an irreversible hash function, protecting session cookies with the HttpOnly and SameSite flags, limiting failed login attempts, applying bot and rate limit checks to form submissions (including Cloudflare Turnstile verification once its key is defined in the administration panel), and allowing only authorised personnel to access the records.

Changes

This notice may be updated in line with developments in legislation or with changes in our systems. The current version is always published at this address.

Last updated: October 28, 2026