Last updated: 30 August 2026
Controller
- Webify — Skyport Residence No:151 BEYLİKDÜZÜ/İSTANBUL
- info@webify.com.tr · +90 (850) 885 28 44
Processing activities
| Activity | Data | Legal basis | Retention |
|---|---|---|---|
| Contact and quote form | Name, email, phone, message, requested service | Pre-contract steps — Art. 6(1)(b) | Quote cycle + 2 years; if contracted, term + statutory period |
| Project-start wizard | Project type, scope, budget range, name, email, phone | Pre-contract steps — Art. 6(1)(b) | Quote cycle + 2 years |
| Phone / email | Contact details and correspondence | Contract or legitimate interests — Art. 6(1)(b)/(f) | Relationship + 2 years; books per tax law |
| Hosting and technical logs | IP, browser, timestamps, error logs | Legitimate interests (security) — Art. 6(1)(f) | Logs as a rule 90 days |
| Invoicing | Legal name, tax ID, address, payment data | Legal obligation — Art. 6(1)(c) | At least 10 years under Turkish tax rules |
| Theme preference | localStorage: webify-theme | Legitimate interests / strictly necessary — Art. 6(1)(f) | On your device until you clear it |
Your rights (Art. 15–22)
Access (Art. 15)
Ask whether we process your data and request a copy plus purposes, recipients and retention.
Rectification (Art. 16)
Have inaccurate or incomplete data corrected.
Erasure (Art. 17)
Ask for deletion when the purpose ended, consent is withdrawn or processing is unlawful. Legal retention is an exception.
Restriction (Art. 18)
Freeze processing while accuracy or an objection is assessed.
Portability (Art. 20)
Receive data processed on consent or contract in a structured, machine-readable format.
Objection (Art. 21)
Object to legitimate-interest processing or direct marketing.
Automated decisions (Art. 22)
We do not take solely automated decisions with legal effects.
Scope
This notice covers webify.com.tr, contact forms, project requests and design, e-commerce, SEO and hosting services offered to people in the EU/EEA.
We are established in Türkiye. Where we offer services to people in the Union, Art. 3(2) GDPR applies. For users in Germany this is the same regulation as the DSGVO.
Purposes
We process personal data only to:
- Prepare quotes and perform contracts
- Provide support, invoicing and legal duties
- Secure infrastructure and prevent abuse
- Publish testimonials if you give consent
Special category data
We do not ask for health, biometric, religion, union, racial or sexual-life data. Do not put that data in forms.
Recipients and transfers
Access is limited to staff handling your request and necessary processors: email, hosting, accounting.
Locations: Istanbul; Falkenstein and Nuremberg (Germany); Finland; Singapore. Germany and Finland are in the EEA. Singapore is a third country; transfers are only for service delivery under Chapter V (appropriate safeguards / SCCs).
We do not sell data.
Deadline and identity
We reply within one month (Art. 12(3)). If we extend by two further months for complex requests, we tell you why within the first month.
We may ask for proportionate identity checks (e.g. matching the registered email). The first copy is free.
Breach notification
If a personal-data breach is likely to result in a risk, we notify the authority within 72 hours where required (Art. 33) and you if the risk is high (Art. 34).
Right to complain
Write to us first: info@webify.com.tr. Under Art. 77 you may also lodge a complaint with the supervisory authority in your Member State of residence, work or alleged infringement. In Germany: the competent Landesdatenschutzbehörde or BfDI. In Türkiye: the Personal Data Protection Authority (kvkk.gov.tr).
This page is for transparency. It is not legal advice. Final assessment belongs to your DPO or counsel.