What this site collects about you, and what it never does

Scope of this policy

This privacy policy explains how your personal data is processed when you visit the karacatechnology.com website operated by Karaca Technology. Our formal duty to inform under the Turkish Law No. 6698 on the Protection of Personal Data (KVKK) is fulfilled in a separate document, the Privacy Notice (KVKK); this page summarises the same processing activity in plainer language. If you are located in the European Union, you may also read the GDPR Data Protection Notice.

Data controller	Karaca Technology
Address	İskenderun / HATAY, TÜRKİYE
E-mail	[email protected]
Telephone	+90 534 724 25 32

The site is published at karacatechnology.com; applications and notifications are sent to [email protected].

What data do we collect?

Quotation / contact form

The only channel on the site through which we obtain personal data directly from you is the quotation form on the Contact page. On the form you give us your full name and e-mail address (mandatory) and, if you wish, your telephone number, your company name, the service you are interested in and your budget range; your message is mandatory. You fill in all of these fields yourself — no data is recorded until you submit the form.

Technical data recorded automatically on form submission

Along with the submission, your IP address, browser information (user agent), the address of the page on which you completed the form and the time of submission are recorded. These are kept not for marketing but for security: the counter that blocks more than five submissions from the same IP address within 15 minutes, and the checks that distinguish automated submissions, rest on this data.

Records we add while handling your request

Once your request reaches the administration panel, the authorised user handling it adds a request status (new, in progress, completed or spam) and, where necessary, an internal follow-up note to your record. You do not fill in these two fields; they exist to keep the request from going unanswered and to record the course of the discussion within the team. Only authorised personnel with access to the panel can see them, they are not shared with third parties, and they are deleted together with your quotation record when it is deleted. When you request information, these fields are also among the data processed about you.

While browsing the pages

If you merely browse the site — reading pages, looking at the services or the blog — no personal data is recorded by us. As on every web server, the server keeps technical access and error logs; these logs may contain technical information such as an IP address and are used solely for fault resolution and security. As the site is served through Cloudflare’s content delivery network, your requests pass through Cloudflare’s network before they reach our server; in doing so Cloudflare processes technical information such as your IP address to the extent the service requires (see Sharing and transfers).

Data we do not collect

Membership / account: the site has no membership system open to visitors; you are never asked to create a password.
Payment information: no online payment is taken through the site; credit card or bank details are never requested and never stored at any stage.
Location data: no location permission is requested from your browser.
Advertising profile: no ad network, remarketing or social media tracking pixel is used.
Measurement / analytics: as at the date these lines were written, no measurement tool is installed across the site. If a measurement identifier is defined in the administration panel, the measurement tag is loaded only from that point on; in that case your consent is requested through the cookie preference window and the Cookie Policy is updated.

What do we use the data for?

The form record is used solely to get back to you about your request, to prepare a quotation and, if a business relationship is established, to communicate during the project. Technical data is used only for security and fault resolution. Your data is not added to a newsletter list, not sold to third parties, and no profile is drawn up about you.

Cookies

Only technically necessary cookies are used on the site: the administration panel session cookies, the record that remembers your cookie preference and the security cookies Cloudflare writes when its security features are enabled. For details, the current cookie list and how to manage cookies from your browser settings, see the Cookie Policy page. You may change your preference at any time from the cookie button in the bottom left corner of the page.

Server and error logs

When an unexpected error occurs, the application writes the technical details to an error log. These records exist so that the development team can find the problem; they may contain information such as an IP address or an e-mail address belonging to a form submission. Error logs are kept in a directory that is closed to the web and only authorised technical personnel can access them. These records are limited not by time but by size: when the log file exceeds 5 MB, everything except the most recent 1,000 lines is deleted automatically. The clean-up is performed by the maintenance task that runs at most once a day when the administration panel is opened, and every truncation is written to the audit log of the panel. We do not declare a fixed number of days; how far back the records reach depends on how often errors occur.

Administration panel users

For the authorised users who manage the site content, the following data is additionally processed: e-mail address, full name, optional telephone number and profile image; session and “remember me” records (IP address, browser information, device name, session type, time of creation and of last use); and login attempt logs. Passwords are stored as an irreversible hash; plain text passwords are kept nowhere.

The login attempt log records the following for each attempt: the e-mail address used at login, the IP address, the browser information (user agent), the device name, whether the attempt succeeded and the time of the attempt. The record is kept for failed attempts as well, because the protection that spots repeated password attempts and temporarily restricts the account and the IP address rests on this log. Records are kept for 90 days; those that exceed the period are deleted automatically by the maintenance task that runs at most once a day when the administration panel is opened — the clean-up can also be started manually from the panel. This section concerns not visitors but only personnel who hold a panel account.

Data security

The site and the panel are served over HTTPS.
All database queries are run as parameterised (prepared) statements.
Panel passwords are stored with an irreversible hash function; failed login attempts are limited on an e-mail and IP basis.
Session cookies are protected with the HttpOnly and SameSite flags and are sent as Secure over an HTTPS connection.
A bot trap and a per-IP rate limit operate on the form; once its key is defined in the administration panel, submissions are additionally verified with Cloudflare Turnstile.
Rich text uploaded through the panel is cleaned by passing it through a safe tag list.

No measure provides absolute security; however, if a security breach affects your personal data, notification is made to the data subjects concerned and to the Personal Data Protection Board as soon as possible pursuant to Article 12/5 of the KVKK.

Your data is not sold to third parties and is not shared for marketing purposes. The parties with access are our hosting provider (server infrastructure), our corporate e-mail infrastructure and Cloudflare, which runs in front of the site (content delivery network and security service). The hosting and e-mail providers act in the capacity of data processor and only to the extent the service requires; the capacity in which Cloudflare processes this data is explained in the transfer section of the Privacy Notice (KVKK). Information may be given to authorised public institutions where legislation makes it compulsory.

We do not, of our own initiative, transfer your data to third parties abroad. However, since we obtain hosting and e-mail services externally, the server locations of these providers are set out in the service agreements between us; if a provider’s infrastructure is located abroad, the transfer is made only where the conditions of Article 9 of the KVKK are satisfied (and, if you are located in the European Union, additionally those of Chapter V of the GDPR). For details you may read the transfer section of the Privacy Notice (KVKK).

The site is served through the content delivery network and security layer of Cloudflare, Inc. (USA); your requests may therefore also pass through Cloudflare data centers outside Türkiye, and Cloudflare may write its own security cookies to your browser when its security features are enabled (see the Cookie Policy). Where Cloudflare Turnstile verification is enabled on the contact form, the verification widget is loaded from Cloudflare when you interact with the form; in doing so Cloudflare collects technical signals such as your IP address and browser information, and the widget leaves a record in your browser’s local storage area on Cloudflare’s domain (see the Cookie Policy). On submission, your IP address and the verification token are forwarded to Cloudflare. The principle of Article 9 of the KVKK (and, if you are located in the European Union, additionally Chapter V of the GDPR) stated above applies to this transfer as well.

Retention and deletion

Quotation records are kept, for requests that do not turn into a contract, for at most 2 years from the closure of the request; for relationships that turn into a contract, for the 10-year general limitation period running from the end of the relationship. Once the period expires, the record is deleted, destroyed or anonymised. You may request deletion at any time; records that are not subject to a statutory retention obligation are deleted upon your request. Records whose period has expired are deleted automatically: the maintenance task that runs at most once a day when the administration panel is opened removes closed (completed) requests from the database at the end of 2 years and submissions marked as spam at the end of 30 days, and every deletion is written to the audit log. Open requests and the records of relationships that have turned into a contract fall outside this automatic deletion; when their period expires, the assessment is made manually.

Your rights and how to apply

You have the right to learn whether your data is being processed, to request information, to have it rectified or erased, to know the parties to whom it has been transferred, to object to the result of automated analysis and to claim compensation for your damage. For the full list of rights and the information your application must contain, see the Privacy Notice (KVKK). You may send your applications to [email protected] or to our address at İskenderun / HATAY, TÜRKİYE; the response time is at most 30 days.

Our site links to external addresses such as WhatsApp, LinkedIn, Instagram, Facebook, GitHub and the sites of our clients. When you click these links, the privacy and cookie policies of the platform concerned apply; we are not responsible for the practices of those platforms. There is no embedded social media component (like box, embedded feed) on our pages — only plain links are given, so no data reaches those platforms until you click.

Children’s privacy

Our site and services are aimed at corporate and commercial counterparts; we do not knowingly collect personal data from anyone under the age of 18. If we notice that data belonging to a child has been submitted, we delete the record.

Changes to this policy

This policy is updated whenever there is a change in our systems or in legislation; the current version is always published at this address. When a significant change occurs, the version of your cookie preference record is also renewed and your preference is requested again.

Last updated: October 26, 2026

Privacy Policy