EN TR – Türkçe
Start a project

§ Legal

Privacy Notice

This notice, provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), explains who is responsible for the personal data processed automatically when you visit hikaz.com.tr and the personal data you share through its contact form, why and how we process it, who we may share it with and what your rights are.

Last updated:

01 Data controller

The data controller for the personal data processed when you visit our site and use the contact form is hikaz, referred to in this notice as “we” or “us”.

Controller details:

  • Email: iletisim@hikaz.com.tr
  • Website: hikaz.com.tr

02 All website visitors

This section applies to everyone who visits our site, whether or not you use the contact form. The sections that follow describe the processing of contact form submissions; the “Recipients and transfers”, “Your rights” and “How to apply” sections also apply to all visitors.

When our pages load, the following processing takes place electronically and automatically:

  • Security: every request to our site passes through Cloudflare’s security services, such as DDoS protection, the web application firewall (WAF), bot management and rate limiting. Your IP address and request data (for example the address of the page requested, your browser’s user agent and the time of the request) are processed to detect and block attacks and misuse and to keep the site secure and available.
  • Visit statistics: Cloudflare Web Analytics runs on every page load and processes your IP address (transiently), your browser and operating system, the path of the page you visit, the page that referred you to our site (referrer) and performance measurements such as page load times. It does not use cookies or your browser’s local storage and does not fingerprint visitors; we only receive aggregate statistics (such as page view counts) that are not used to identify you.

We process this data only to keep the site secure and to measure visit statistics, on the basis of our legitimate interests, provided this does not harm your fundamental rights and freedoms (Article 5(2)(f) of the KVKK). Cloudflare, Inc. carries out this processing on our behalf as a data processor; see “Recipients and transfers” for details of transfers to Cloudflare, including transfers abroad. We do not store this page-visit data in our own systems.

This site does not use advertising, marketing or tracking cookies. Cloudflare’s security services may set strictly necessary, security-only cookies where needed to tell malicious traffic apart.

03 Data processed through the contact form

Through the contact form we process the following personal data:

  • Identity and contact details: your name and surname, your email address and, if you choose to provide them, your phone number and company name
  • Request details: the topics you select on the form and the message you write
  • Transaction security data: your IP address and a truncated form of it (IP prefix), the approximate country derived from your IP address, your browser’s user agent, the date and time of submission, how long the form took to fill in, the result of the Cloudflare Turnstile bot check, and any security flags added to the submission (for example, a suspicious or automated submission flag)

Please do not include sensitive (special category) personal data in your message, such as information about your health, religion or ethnic origin, or personal data about other people that is not relevant to your request.

04 Purposes

We process the personal data you submit through the contact form to:

  • Review the request or question you send us through the contact form and respond to you
  • Prepare an offer based on your request and send it to you
  • Communicate with you about your request, for example to arrange an introductory call
  • Keep our systems secure and prevent misuse of the form, spam and automated (bot) submissions
  • Comply with our legal obligations and respond to information requests from authorised bodies

We do not use your data to send you marketing messages unless you separately agree to receive them.

06 How we collect data

We collect your contact form data electronically, by automated means, when you fill in and submit the contact form on hikaz.com.tr.

Transaction security data such as your IP address, approximate country, user agent and submission time is obtained automatically when you submit the form, and the result of the bot check is generated by Cloudflare Turnstile, which loads once you start interacting with the form. Your full IP address is not stored; see “Retention” for how it is used. We process this data only for the purposes and on the legal grounds described above.

07 Form security and bot protection

The contact form uses Cloudflare Turnstile to block automated (bot) submissions. Turnstile does not load when the page opens; it loads only once you start interacting with the contact form (for example, when you click into a form field or submit the form) and, for this security purpose only, processes your IP address and certain technical signals from your browser and device. The result of the check is used only to decide whether to accept your submission and is not stored separately; submissions that fail the check are not delivered to us and their content is not recorded.

The form also contains a hidden trap field (honeypot) that real visitors do not see. Submissions that fill in this field are flagged as automated; they are not emailed to us and are only recorded. Forms completed unusually quickly are not discarded; they are marked as suspicious and delivered to us like any other submission.

Rate limiting blocks large numbers of submissions sent in a short time from the same IP address (for IPv6 addresses, from the same /64 network block). There is also a site-wide limit on the number of submissions accepted in a short time; submissions received while this limit is exceeded are recorded but not emailed to us.

08 Recipients and transfers

We share your personal data only as far as needed for the purposes above and in line with Articles 8 and 9 of the KVKK, with the following recipients:

  • Cloudflare, Inc., our hosting, security, analytics and email delivery provider: we use Cloudflare to host the site, provide security services for all visitors, process and store form submissions, run the Turnstile bot check, measure visit statistics and deliver your message to our inbox. Cloudflare’s servers may be located outside Türkiye, including in the United States.
  • Our email provider: your message is delivered to and stored in our inbox. This provider may also process data on servers outside Türkiye.
  • Authorised public institutions and authorities: only where we are legally required to disclose data, and only to the extent required.

Transfers abroad are subject to Article 9 of the KVKK, as amended by Law No. 7499 in 2024. We do not sell your personal data or share it with third parties for advertising.

09 Retention

The personal data you submit through the contact form, together with the related transaction security data, is deleted automatically from our systems 365 days (one year) after we receive it; this also applies to submissions that are recorded but not emailed to us (those flagged as automated and those received while the site-wide submission limit is exceeded). Copies of your message delivered to our email inbox are reviewed periodically and deleted no later than the end of that same period.

These records do not contain your full IP address, only a truncated IP prefix (the first three parts of an IPv4 address, for example 203.0.113.0/24, or the first 48 bits of an IPv6 address, /48). Your full IP address is used only momentarily while your submission is processed, for rate limiting and the Turnstile check, and is not stored by us.

These periods do not apply if your request leads to a contract between us; in that case the relevant data is kept for the periods required by applicable law, in particular the Turkish Commercial Code and the Tax Procedure Law.

When the retention period ends or the reasons for processing no longer apply, we delete, destroy or anonymise your personal data in accordance with Article 7 of the KVKK and the related regulations.

10 Your rights

Under Article 11 of the KVKK, you can apply to us to:

  • Find out whether your personal data is being processed
  • Request information about the processing if your personal data has been processed
  • Find out the purpose of the processing and whether your data is used in line with that purpose
  • Know the third parties in Türkiye or abroad to whom your personal data has been transferred
  • Ask for your personal data to be corrected if it is incomplete or inaccurate
  • Ask for your personal data to be deleted or destroyed under the conditions set out in Article 7 of the KVKK
  • Ask for any correction, deletion or destruction to be notified to the third parties to whom your personal data has been transferred
  • Object to an outcome that is to your detriment and results from the analysis of your data exclusively by automated systems
  • Claim compensation for any damage you suffer because your personal data has been processed unlawfully

11 How to apply

You can send requests about your rights under Article 11 of the KVKK using one of the methods below, as set out in the Communiqué on the Procedures and Principles for Applications to the Data Controller:

  • In writing: by handing a signed (wet-ink) application to us in person at our address, or by sending it there by registered mail or through a notary (you can ask for our postal address by writing to iletisim@hikaz.com.tr)
  • With a secure electronic signature or mobile signature: by signing your application with one of these and emailing it to iletisim@hikaz.com.tr
  • By email: by sending your application to iletisim@hikaz.com.tr from an email address you have previously given us and that is registered in our system

Your application must include your name and surname and, if it is made in writing, your signature; your Turkish ID number if you are a Turkish citizen, or your nationality and passport number (or ID number, if any) if you are not; your residential or business address for notifications; your email address, phone and fax number for notifications, if any; and the subject of your request. Please attach any relevant information and documents.

We may ask you for additional information to confirm that you are the person concerned and to clarify your request.

We will respond as quickly as possible depending on the nature of your request, and within 30 days at the latest, free of charge. If responding involves an additional cost, we may charge the fee set in the tariff determined by the Personal Data Protection Board. We will either accept your request or reject it with reasons, and inform you of our response in writing or electronically.

If your application is rejected, you find our response insufficient or we do not respond in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning of our response, and in any case within 60 days of the date of your application.

12 Changes to this notice

We may update this notice to reflect changes in our processing activities or in the applicable law. The current version is always published on this page.

This notice was last updated on 20 October 2026.