Legal Document · Personal Data Protection Law

KVKK Disclosure Notice (Personal Data Protection)

This disclosure notice is prepared in accordance with Turkish Personal Data Protection Law No. 6698 ("KVKK"). It explains, in plain language, the identity of the data controller, the categories of personal data processed, the legal basis and purposes of processing, the parties with whom data may be shared, the methods and grounds of collection, your rights as a data subject, and how you can exercise those rights.

Last updated April 13, 2026
Data controller Koray Çetintaş Advisory
Contact koray@cetintas.com.tr
01

Data controller

  • Data controller: Koray Çetintaş Advisory (Çetintaş Yazılım Danışmanlık).
  • Address: İstiklal Mah. Piyalepaşa Bulvarı 22/1 Ticari, Hanspace B Blok, Beyoğlu / İstanbul, Türkiye.
  • Contact: koray@cetintas.com.tr · +90 549 221 10 08.
  • Registered as a data controller for the purposes of the Personal Data Protection Law No. 6698.
02

Categories of personal data processed

  • Identity data: full name, title, company, role.
  • Contact data: business email, phone number, postal city.
  • Customer transaction data: contact request content, appointment requests, conversation history.
  • Assessment and lead data: assessment responses, score, level, recommendations, optional notes.
  • Marketing/visit data: pages visited, referrer URL, anonymised IP, device type, cookies.
  • Audio/visual data: only if you voluntarily share files (e.g. screenshots) through forms.
03

Purposes of processing

  • Conducting business activities and providing advisory services.
  • Responding to contact, appointment, and discovery call requests.
  • Preparing and sharing assessment reports you have explicitly requested.
  • Improving service quality, content relevance, and site performance.
  • Fulfilling legal, contractual, and regulatory obligations.
  • Ensuring information security, fraud prevention, and incident response.
04

Legal basis (Article 5/6 of KVKK)

  • The express request and consent of the data subject.
  • The performance of a contract or the fulfilment of pre-contractual measures requested by the data subject (Art. 5/2(c)).
  • Compliance with a legal obligation to which the data controller is subject (Art. 5/2(ç)).
  • The legitimate interests of the data controller, provided that fundamental rights and freedoms of the data subject are not harmed (Art. 5/2(f)).
05

Methods and grounds of collection

  • Collected via website forms, the assessment engine, the live chat widget, email, telephone, and physical or online meetings.
  • Collected automatically through cookies and server logs to the minimum extent necessary for security and analytics.
  • All collection is performed in line with the legal grounds listed above and only for the purposes disclosed.
06

Transfer of personal data

  • Personal data is not sold or rented under any condition.
  • Data may be shared with limited operational sub-processors strictly for service delivery: hosting provider, email/SMTP delivery, anonymised analytics, and the self-hosted live chat platform.
  • Data may be disclosed to authorised public institutions and organisations when legally required by Turkish law.
  • Cross-border transfers are kept to the minimum necessary and protected by contractual safeguards.
07

Storage period

  • Contact and lead data are kept for as long as the engagement context remains relevant, and at most 24 months after last interaction unless a longer period is legally required.
  • Assessment responses are kept only for as long as needed to interpret the result with you; aggregated/anonymised data may be retained for service improvement.
  • Live chat conversations are retained for up to 12 months.
  • Server access logs are retained for the technical minimum required for security and incident response.
  • When the retention period ends, data is deleted, destroyed, or anonymised in accordance with KVKK secondary regulations.
08

Your rights as a data subject (Article 11 of KVKK)

  • Learn whether your personal data is processed.
  • Request information about the processing if your data has been processed.
  • Learn the purpose of processing and whether the data is used in line with that purpose.
  • Know the third parties to whom personal data has been transferred at home or abroad.
  • Request correction of incomplete or inaccurate data.
  • Request deletion or destruction of personal data where legally possible.
  • Request notification of correction, deletion, or destruction operations to third parties to whom data has been transferred.
  • Object to outcomes that arise solely from automated processing.
  • Claim compensation for damages arising from unlawful processing.
09

How to exercise your rights

  • You may submit a written request to koray@cetintas.com.tr including your name, contact details, and the specific right you wish to exercise.
  • You may also submit your request in writing to the registered address provided in section 1.
  • We respond to KVKK requests free of charge and within 30 days, in accordance with Article 13 of KVKK.
  • If your request requires additional cost, the official tariff published by the Personal Data Protection Authority will apply.
10

Updates to this notice

  • This KVKK disclosure notice may be updated as legal requirements or our processing activities change.
  • Material updates will be reflected by changing the "Last updated" date at the top of the page.
11

Related documents

Have questions?

For any request related to this document or to your personal data, please contact us. We respond to KVKK requests within 30 days.

Send an email Contact page