Privacy notice

Who is the data controller?

Murat Şen is the data controller, as owner of the sole proprietorship trading as Kefken Ahşap Dekorasyon.
Mavigöl, Münteha Sk. No:31, Arnavutköy, İstanbul
info@kefkenahsap.com

For any question or request about your personal data, use the contact details above.

What data do we process?

• What you enter in the quote form: name, phone, e-mail (optional), service, city and district, your message and up to 5 photos you attach.
• Saved with the form: the page, language and time you sent it; campaign link (utm) data if present; the version of the privacy notice you confirmed you had read.
• Your IP address: held only in memory, in a 10-minute counter, to protect the form against abuse, and sent to the Cloudflare Turnstile check. Once the window ends, it is deleted on the next request. It is never written to disk or saved with your request.
• Technical data your browser sends while you browse: IP address, browser type, the page you open and the time. It is processed to show you the site and keep it secure.
• Error logs: if something breaks, a technical error record is kept on our own server. E-mail addresses, phone numbers and similar data are removed automatically before it is stored.
• Cookieless visit statistics: with Umami we count which pages are opened and how often links such as WhatsApp and phone are clicked. Umami runs on our own server, uses no cookies and does not identify you.
• Google Analytics: statistics on how you use the site, only if you accept cookies.
• Cookie details are in the cookie policy.

We do not ask for special categories of personal data such as health, religion or biometric data. Please do not include such information in your message or photos.

How do we collect it?

We collect your data electronically: when you fill in the quote form, from the data your browser sends while you browse, and through cookies. If you contact us directly by WhatsApp, phone or e-mail, we use what you share there only to answer your request.

Why do we process it, and on what legal basis?

• To review your request, call or write to you, and prepare a site visit and a quote. Legal basis: necessary to enter into a contract (KVKK Art. 5/2-c).
• To protect the form and the site against spam, attacks and abuse, and to find and fix errors. Legal basis: our legitimate interest (KVKK Art. 5/2-f).
• To keep the request history and the record that you read the privacy notice for use in a possible dispute. Legal basis: establishing, exercising or protecting a right (KVKK Art. 5/2-e).
• Cookieless visit statistics (Umami): to see which pages are useful and improve the site. Legal basis: our legitimate interest (KVKK Art. 5/2-f).
• Visit statistics (Google Analytics). Legal basis: the explicit consent you give with the cookie banner (KVKK Art. 5/1).
• Transfer to service providers abroad: see “Is your data transferred abroad?” below.

Who do we share it with?

We do not sell your data or share it with anyone for advertising or marketing. We use these service providers to run the site:

• Cloudflare, Inc. (USA): site traffic passes through Cloudflare's network (fast loading and security). It runs the Turnstile check on the form. Site images and the off-server copy of database and photo backups are kept in Cloudflare R2 storage, in a private area. With Cloudflare Web Analytics, performance data measured while a page loads (page address, referrer, browser, operating system and country) goes to Cloudflare; data of visitors in the European Union is excluded from this measurement.
• Resend (USA): sends us a notification e-mail when a new request arrives. The e-mail contains your name, phone, e-mail, service, location, message, and the page and language you sent the form from; photos are not attached.
• Google (Gmail, USA): the mailbox that receives those notifications and where we write to you.
• Meta (WhatsApp, USA): when you write to us on WhatsApp, or we reply there, the messages pass through this service.
• Google (Analytics, USA): visit statistics, only if you accept cookies.
• Google (Maps, USA): the map on the contact page loads from Google only if you click “Show the map”; Google then sees your IP address.
• Competent public authorities: only when the law requires it, and only as far as requested. Legal basis: complying with our legal obligation (KVKK Art. 5/2-ç).

Our site, database and request photos run on a server we rent in Türkiye. The server provider stores the data only on our behalf and on our instructions (data processor). Request photos are never published at a public address; only authorised people signed in to the admin panel can see them.

Your message and photos are not sent to AI services.

Is your data transferred abroad?

Yes. Cloudflare, Resend, Google and Meta (WhatsApp) are US-based companies and process data on servers outside Türkiye. The data in your quote form passes through Cloudflare, Resend and Google; WhatsApp messages pass through Meta.

We make these transfers with appropriate safeguards under KVKK Art. 9/4: we have signed the standard contract published by the Personal Data Protection Board with these companies and notified each one to the Personal Data Protection Authority within 5 business days of signing.

How long do we keep it?

• Requests and attached photos: deleted automatically 2 years after we receive them.
• Backups: the database and photos are backed up daily. Backups are copied to an off-server store (Cloudflare R2) and kept there for 30 days. A copy stays on the server only if the copy fails, and then for 14 days at most. A deleted request leaves the backups within 30 days at the latest.
• Notification e-mails and WhatsApp messages: kept for 2 years, then deleted. We delete them sooner if you ask.
• Error logs: deleted automatically after 30 days.
• Server access logs: kept for up to 30 days. Cloudflare keeps its own security logs for the periods in its privacy policy.
• Umami counts: contain nothing that identifies you; they are kept as site statistics without a time limit.
• Google Analytics data: kept at Google for up to 14 months.

How do we protect it?

Your connection to the site is encrypted (HTTPS). Requests in the admin panel are visible only to authorised people who sign in with a password. The form is protected by a security check, a rate limit and file type and size checks. Backups are kept in private storage.

What are your rights?

Under KVKK Art. 11 you have the right to:

• learn whether your personal data is processed and, if so, request information about it,
• learn the purpose of processing and whether the data is used for that purpose,
• know the third parties in Türkiye or abroad to whom it is transferred,
• ask for it to be corrected if it is incomplete or wrong,
• ask for it to be deleted or destroyed under the conditions of KVKK Art. 7,
• ask that a correction, deletion or destruction be passed on to the third parties it was transferred to,
• object to a result against you that comes solely from automated analysis,
• claim compensation if unlawful processing caused you damage.

How can you apply?

Send your request in writing through one of these channels:

• a signed letter, delivered by hand or by post to the address above,
• a document signed with a secure electronic or mobile signature, sent to info@kefkenahsap.com,
• an e-mail to info@kefkenahsap.com from an address you gave us before and that is in our records.

Your request must include your full name, Turkish ID number (for foreigners: nationality and passport or ID number), postal address, e-mail and phone if any, and what you are asking for.

We answer free of charge within 30 days at the latest. If the action has an additional cost, we may charge the fee set by the Personal Data Protection Board.

If your request is rejected, you find our answer insufficient, or we do not answer within 30 days, you may complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your request (KVKK Art. 14).

Links to other sites

The site has WhatsApp, social media and map links. When you click them, that service's own privacy rules apply. When you write to us on WhatsApp, your message reaches us through Meta's WhatsApp service.

If this notice changes

We update this notice when the data we process or the services we use change. The current version is always on this page; the date of the last update is shown under the title.