Data protection notice.

1. Data controller

The data controller is Serhat Kucı (SERHATECH). SERHATECH is the studio brand used on this website. Website: serha.tech. Contact and data subject request address: [email protected].

2. Data categories and collection methods

Data are collected electronically when you visit the website, submit the contact form or correspond by email, through partly or fully automated means and review of correspondence records.

• Identity and contact: name and email address; optionally a phone number and company or brand name.
• Enquiry content: subject, message, optional start time, call-back preference and subsequent correspondence.
• Transaction security: request IP address, its keyed hash, submission time and identifier, submission counts and automated-submission check information.
• Preference: a reduced-motion setting stored on your device only if selected. This preference is not transmitted to the server.

3. Purposes and legal bases

The form cannot be submitted without its required fields; you may email directly instead. Optional fields are not required to use the form. Please do not share unnecessary third-party data or special categories of personal data. Contact information is not collected to create advertising lists.

• Assessing project and proposal enquiries and discussing scope and working terms: Article 5(2)(c), where processing is necessary and directly related to entering into or performing the contemplated contract. Relevant contact details, enquiry content and company information are assessed on that basis.
• Answering general questions and making a requested call back: the legitimate interest in handling communications under Article 5(2)(f), provided your fundamental rights and freedoms are not harmed. Phone numbers are used only for the optional call back.
• Preventing spam and abuse and keeping the service secure and available: proportionate security processing based on legitimate interests under Article 5(2)(f).
• Preserving necessary correspondence in a dispute: Article 5(2)(e), only as needed to establish, exercise or protect a specific right. A legally valid authority request is handled under Article 5(2)(ç) where necessary to comply with the relevant legal obligation.

4. Recipients and transfer purposes

• Resend processes the submitted form details to deliver your enquiry to SERHATECH’s mailbox.
• Upstash Redis processes a keyed hash rather than the raw IP address, together with counters, for rate limiting. Message content and form contact details are not transferred to this system.
• Website hosting and incoming-email infrastructure providers process request or correspondence data necessary to provide their respective services.
• Authorised public bodies and courts may receive necessary information in response to a legally valid request or obligation.

5. Overseas service providers

Email delivery and security processes using Resend and Upstash may involve processing outside Türkiye or access from abroad. The configured data region, subprocessors and mailbox infrastructure affect the scope of any transfer.

An international transfer must separately satisfy Article 9 of the Law. This notice does not assert that the Board’s standard contract has been signed, a notification has been made or a particular transfer safeguard is in place. Submitting the form does not by itself constitute explicit consent to an international transfer. You may request details of relevant recipients and safeguards using the contact address below.

6. Retention criteria

Upstash submission counters are retained for 10 minutes from their creation, including the counter associated with the keyed IP hash. Not storing raw IP addresses in this counter system does not mean the hosting infrastructure creates no access logs.

Enquiries and correspondence are retained by reference to resolving the enquiry, conducting any working relationship, and a necessary legal obligation or specific legal-claims need. No single automatic deletion period is configured for all messages. When the processing conditions end, erasure, destruction or anonymisation is required; you may enquire about the status of a particular record.

7. Your rights under Article 11

• Learn whether your personal data are processed and request information about that processing.
• Learn the purpose and whether use matches it, and identify recipients in Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request erasure or destruction when Article 7 conditions apply, and notification of correction or erasure to recipients of the data.
• Object to an adverse result produced solely by automated analysis, and seek compensation for damage caused by unlawful processing.

8. Requests and responses

You may email [email protected] with the subject “KVKK Request” from an email address you previously supplied and that appears in our correspondence records. This is an ordinary email address, not a registered electronic mail (KEP) address. Your rights to use other methods recognised by the Law and the Communiqué on Applications to Data Controllers remain unaffected.

Include your name, a clear request and the identity and service-address details required by the Communiqué; written applications require a signature. Consult the official procedural guidance linked below for mandatory information and methods. Do not send unrelated information or identity document copies. Where verification is needed, proportionate information appropriate to the request may be requested.

Valid requests are answered as soon as possible and within 30 days at the latest. Requests are generally free; additional costs may be charged only according to the Board’s tariff. If a request is rejected, the response is insufficient or no response is received on time, you may complain to the Board subject to Article 14 conditions and deadlines.

[email protected]