Privacy and personal data
Privacy notice, version 1.0Effective: October 4, 2026. Updated: October 5, 2026
Data controller
This notice explains how your personal data is processed when you visit krafera.com, use the contact form, or email Krafera, as required by Article 10 of Law No. 6698 on the Protection of Personal Data. The data controller is Krafera. For questions and requests about your personal data, the email address is:
Personal data processed
Contact form: your identity information (your name), contact information (your email address), and request and correspondence information (your business name and your message) are processed.
Email: when you write to info@krafera.com or another krafera.com address, your identity information (your name), contact information (your email address), and request and correspondence information (the subject and content of your message) are processed. Krafera asks you not to include special categories of personal data, such as health information, in the form or in emails; if such information arrives, Krafera asks you, if needed, to write again without it, and deletes the message.
Site visits: transaction security information (your IP address and the technical connection details your browser sends with each request, such as the page requested and the time of the request) is processed on the infrastructure of the site’s hosting provider.
Purposes of processing
Krafera processes your personal data for these purposes: to respond to your call request and questions, schedule the introductory call, and, if talks continue, prepare a written proposal; to keep correspondence that turns into a business relationship; to respond to requests about your personal data; and to deliver the site to you and keep it secure. The security purpose includes limiting automated and abusive form submissions. Krafera does not use your data for any other purpose, such as sending you promotional email. Processing that the hosting provider carries out for its own purposes is described separately under “Recipients of your data.”
Collection method and legal grounds
Krafera collects your personal data electronically: automatically through the contact form and the site’s technical infrastructure, and partly automatically through email correspondence. When you request a call in your own name or for a sole proprietorship you own, the legal ground is that, as a party to the contract, processing your data is necessary in direct connection with the formation of a contract (Article 5(2)(c) of the Law). In that case, preparing a written proposal if talks continue and keeping correspondence that turns into a business relationship rest on the same ground: processing directly connected with the formation or performance of a contract (Article 5(2)(c)). When you send the form or an email on behalf of a company, or as an employee or manager of a business, the legal ground, including for proposals and business correspondence, is that processing is necessary for Krafera’s legitimate interests, provided it does not harm your fundamental rights and freedoms (Article 5(2)(f)). The technical data of site visits and rate limiting for security also rest on this ground. When responding to your requests, the legal ground is that processing is necessary for Krafera to fulfill a legal obligation (Article 5(2)(ç)). Krafera does not ask for your explicit consent for this processing, and the form has no consent checkbox.
Recipients of your data
Hosting, network, and email delivery provider: a company that hosts the site, headquartered in the United States and established outside Türkiye. This provider processes your data in two separate roles. In the first, it acts on Krafera’s behalf as a data processor: it manages the domain name (the DNS service that points the domain to the address where the site is served), hosts the site and delivers it to you, receives form messages and forwards them only to email addresses Krafera has specified and verified in advance, and applies rate limiting against abuse. The content of a form message is not stored with the provider; it is only forwarded to Krafera’s mailboxes, and the technical records related to this delivery are described under “Retention period.” The provider may use its own sub-processors, meaning other companies that process data on its behalf, for these services. In the second, it acts for its own purposes as a data controller: it also uses traffic information such as your IP address for the security of its network, preventing abuse (for example, threat assessment based on IP addresses), and improving its services. Krafera has no control over this use, and the provider’s own privacy policy applies. The provider’s legal name and address are listed on this site’s Legal notice page; the provider publishes its privacy policy and list of sub-processors on its own site.
Email service provider: the company that hosts the krafera.com mailboxes on Krafera’s behalf, as a data processor. Form messages and emails you send to krafera.com addresses are kept in these mailboxes so that Krafera can reply to you, for the periods set out under “Retention period.”
Apart from these two providers and their sub-processors, Krafera does not transfer your personal data to third parties, does not sell it, and does not share it with others for advertising or tracking. Requests made in due form by authorized public authorities in cases expressly provided for by law are the exception (Article 8(2)(a) of the Law).
Access to your data
Form messages are read by Krafera employees in the relevant team. Emails sent directly to info@krafera.com or to an employee’s krafera.com address are read only by the employee who uses that mailbox. Employees use this information only for the purposes set out in this notice.
Transfers abroad
The hosting provider serves the site and form messages from data centers in different countries around the world, and a request may be handled at any of them. Your IP address, connection details, and form message may therefore be processed outside Türkiye, and the country where this happens cannot be determined in advance. This transfer serves two purposes: serving the site, forwarding form messages, and security on Krafera’s behalf; and the provider’s own purposes, namely the security of its network, preventing abuse, and improving its services. The provider’s sub-processors include companies located in the United States and other countries. The email service provider’s mailboxes may also be on servers outside Türkiye, in which case your form message and email are stored outside Türkiye. Krafera limits the data transferred to what is listed in this notice.
Retention period
Krafera checks its mailboxes once a month. It deletes form messages and emails that did not lead to a call at the first check after 6 months have passed since they were received. It also deletes correspondence that led to a call but not to a business relationship at the first check after 6 months have passed since the last message. Krafera keeps correspondence that becomes a business relationship for as long as the relationship continues. Technical data from site visits, security logs, and technical records of form message delivery are kept on the hosting provider’s infrastructure on Krafera’s behalf for at most 31 days; the delivery records do not include your name or your business name. No separate processing log is kept for form submissions. For information the provider keeps for its own purposes, the provider’s own privacy policy applies.
Your rights and how to apply
Under Article 11 of the Law, you can apply to Krafera to learn whether your personal data is processed and, if it has been, to request information about it. You can learn the purpose of the processing and whether the data is used in line with that purpose. You can find out which third parties in Türkiye or abroad your data has been transferred to. You can request correction if the data is incomplete or inaccurate, and deletion or destruction under the conditions in Article 7 of the Law. You can request that corrections, deletions, and destructions be notified to the third parties to whom the data was transferred. You can object to an outcome against you that results from analysis of the data exclusively by automated systems. If you suffer damage because of unlawful processing, you can claim compensation.
You can send your request to info@krafera.com from the email address you used in the form or in earlier correspondence. If you are writing from a different address, you can sign your request with a secure electronic signature or a mobile signature and send it to the same address; if such a request is unsigned, Krafera may ask for additional information to verify your identity. Krafera resolves your request free of charge within 30 days at the latest and gives its answer in writing or electronically. If your request is rejected, you find the answer insufficient, or no answer is given in time, you can file a complaint with the Personal Data Protection Board within 30 days of learning the answer and, in any case, within 60 days of the request date.
Cookies and browser storage
This site uses Google Analytics to understand how the site is used, and only if you consent. Before you consent, no request is sent to Google and no cookie is set. If you consent, Google Analytics sets cookies in your browser, and the pages you visit, visit times, device and browser details, your approximate location and your IP address are transferred to and processed by Google LLC (United States). This processing and the transfer abroad are based on your explicit consent. Your accept or decline choice is stored in your browser’s local storage; you can change it and withdraw your consent at any time with the “Cookie preferences” button in the footer of every page. Declining does not prevent you from using any part of the site. Fonts and other files load from the site itself. Your reduced-motion preference is read from your browser settings and is not stored.
Security
Krafera takes technical and administrative measures to protect your personal data. The site is served over an encrypted connection (HTTPS). Form message content is not stored on the site; it is only forwarded to Krafera’s mailboxes, and the message subject line does not include your name or your business name. Accounts and mailboxes are protected with strong passwords, and permission to update the site is kept limited. An invisible check field and rate limiting guard against automated form submissions. If your personal data is obtained by others through unlawful means, Krafera notifies the people concerned and the Personal Data Protection Board as soon as possible.
Changes
Krafera updates this notice when the way data is processed changes, for example when the business is registered or when the services it uses change. The current version and its effective date appear on this page; Krafera keeps earlier versions.