KVKK Disclosure Notice

This disclosure notice has been prepared by WxDigitals acting as data controller under Turkish Law No. 6698 on the Protection of Personal Data (KVKK). Our business is a sole proprietorship; since it has no separate legal personality, the data controller is the natural person merchant who operates the business in their own name. Our tax record is held at the Ümraniye Tax Office under tax identification number 6560576690, and our place of business is Ümraniye, Istanbul. For general contact please use [email protected], and for any notification or application concerning personal data please use the dedicated mailbox [email protected]. The controller's full identity, address and telephone details are published in their current form in the identity card at the top of this page; that same card also satisfies the service provider information duty under Law No. 6563 on the Regulation of Electronic Commerce.

The personal data we process through our website falls into the following categories: identity data (first name, last name); contact data (e-mail address, telephone number); customer transaction data (the service you request, the budget range and timeline you indicate, the date and time slot you choose for an appointment, the subject and category of a support request and the WX- prefixed tracking code issued to you); marketing data (the utm_source, utm_medium and utm_campaign values showing which campaign link brought you here, any referral code, and the external referring address of your first visit); transaction security data (the full name, IP address and timestamp recorded when you approve a proposal sent to you through a personal link, together with the consent date, IP address, the surface on which consent was given and a copy of the consent text recorded when you opt in to our newsletter or event notifications); and the message content you voluntarily type into free-text fields. The visitor's browser and device string (user-agent) is not recorded by the application.

Your personal data is collected by wholly or partly automated means, directly from the information you enter on the website. Our collection channels are: the contact form, the quote wizard, the appointment form, the call-back form, the support ticket form, the newsletter subscription form, the free resource and product download gates, the free SEO/GEO analysis form, the expert-review forms on our tool pages, and the AI chat assistant. In addition, when you arrive through a campaign or referral link, the source information written to your browser's local storage is attached to your request and stored at the moment you submit a form. Access logs of the hosting server are kept for technical reasons; we convert them only into daily aggregate counts and the raw entries are not transferred to our database. If you contact us by e-mail or telephone, data is also obtained through those channels.

Your personal data is processed in order to: answer the requests, questions and complaints you send us; prepare proposals and conduct pre-contractual negotiations; schedule appointment and call-back requests; track and resolve support tickets through their tracking code; fulfil free resource and product download requests; manage customer relations and domain, hosting and certificate renewal processes; send newsletters and promotional messages where you have given consent; measure which channel generated a request so that the effectiveness of our promotional activity can be assessed; maintain the security of the website and block automated bot submissions; fulfil our accounting and tax obligations; and serve as evidence in the event of a dispute. The data is not used beyond what these purposes require, and no processing outside these purposes takes place.

The identity, contact and request data you provide through the contact, quote, appointment, call-back and support forms is processed under Article 5/2(c) of the KVKK, as being directly related to the establishment or performance of a contract, and under Article 5/2(f), based on our legitimate interest in answering your request and maintaining communication. Accounting and tax records rely on Articles 5/2(a) and 5/2(d), namely express provision in the law and compliance with our legal obligations; the full name, IP address and timestamp stored when a proposal is accepted, together with dispute correspondence, rely on Article 5/2(e), the establishment, exercise or protection of a right. Newsletter subscription, commercial electronic messages and non-essential measurement and marketing technologies rely on your explicit consent under Article 5/1; withholding that consent does not prevent you from using our services, and you may withdraw it at any time.

Our site uses a strictly necessary cookie together with browser local storage and session storage records. The only HTTP cookie created for visitors is NEXT_LOCALE, which carries the language preference and lasts 365 days. The Auth.js session, CSRF and callback cookies are created only for staff who log in to the administration panel and are never issued to visitors.

Your browser's local storage holds your cookie preference (wxd_cookie_consent), your theme preference, announcement and dialog display records and — only if you give consent — campaign and referral information (wxd_kaynak). If consent is not given, the source information stays in session storage only and is deleted when the tab is closed.

Measurement and marketing tags are never added to the page unless you give consent in the cookie banner. The details of cookies and how to change your preferences are explained in the Cookie Policy.

The AI-powered tools on our website (summarising, translation, rewriting, text generation, asking questions about a blog article, and the chat assistant) send the text you type or paste to Google's Generative Language API through our servers for processing. If you show interest in our services, the chat assistant may ask for your name and a telephone number or e-mail address; that information and a summary of the conversation are then written into our system as an enquiry record. This flow operates independently of your cookie choice; if you never use the tools, no such transfer takes place at all. We strongly ask you not to enter other people's personal data, confidential contract texts, CVs or customer lists into these tools: every text you enter is thereby transferred abroad under the conditions explained in the following article.

Your personal data is shared only to the extent necessary, within the framework of Article 8 of the KVKK and the proportionality principle in Article 4. Within Turkey, sharing may take place, in a limited manner, with the hosting provider from which we obtain the server service where the website and database reside, with the persons providing our accounting and financial advisory services, with our lawyer in the event of a legal dispute, and, upon request, with public authorities and judicial bodies legally empowered to demand it. The enquiry, support, newsletter and customer records collected through the website are kept in our own database, and no external cloud CRM service is used for customer relationship management. Your personal data is under no circumstances sold, rented or assigned to third parties for marketing purposes.

Transfers abroad are carried out under Article 9 of the KVKK as amended by Law No. 7499: where the Board has issued an adequacy decision, or, failing that, where appropriate safeguards such as a standard contract, an undertaking or binding corporate rules are in place, or where one of the exceptions provided by the Law applies. The points at which data actually leaves Turkey are: the text you enter into the AI tools being sent to Google; the name, surname, e-mail address, telephone number, service, budget and the opening part of your message being forwarded to the business owner through the Telegram notification service when a new enquiry is created; and the operation of measurement and advertising services where you have given cookie consent. The country of the server we use for e-mail delivery may vary with the provider. Fonts and images are served from our own server, so no request leaves the country that way.

Newsletters and promotional content are sent only with your prior consent, in accordance with Article 6 of Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages. Consent is obtained through the mandatory tick box on the newsletter and event notification forms; the box starts empty and the form cannot be submitted without it. The date of consent, the surface on which it was given and a verbatim copy of the consent sentence you saw at that moment are recorded.

You may withdraw your consent at any time, without giving a reason and free of charge. Every message we send carries an unsubscribe link specific to you; the link takes you to a confirmation page and ends your subscription in one step. The "Unsubscribe" button shown by your mail application in the message header is also supported. You may alternatively send your objection to [email protected].

Each message is sent to a single recipient; your address is not visible to other recipients in bulk sends. After you notify us of your withdrawal, no newsletter or campaign message is sent to you; your consent and withdrawal records are retained for the evidential period required by law. Notices sent to existing clients about the operation of a service under an active contract are not treated as commercial electronic messages.

Your personal data is retained for as long as the purpose of processing requires and for the limitation periods laid down in legislation. Records relating to enquiries that turn into a contractual relationship are kept for ten years under Article 146 of the Turkish Code of Obligations No. 6098; invoices and accounting records for five years under Article 253 of the Tax Procedure Law No. 213; records of consent to and dispatch of commercial electronic messages for three years under Law No. 6563 and its regulation; and access records concerning the internet environment for the period laid down in Law No. 5651 and its secondary legislation. In practice the periods are as follows: enquiries submitted through the contact, quote, appointment, call-back and free-download forms are anonymised after three years, meaning that the first name, surname, e-mail address, telephone number, message content and referring address are erased and only the date, the status of the enquiry and the acquisition channel remain; support requests are anonymised in the same way two years after they are closed, and after three years even if they are not closed; proposals that were not accepted are deleted in full after three years; the acceptance record of an accepted proposal, containing the name, IP address and timestamp, is kept for ten years and then deleted; a customer record is deleted ten years after the relationship ends and the record is removed; a newsletter consent record is deleted three years after your subscription ends; the administration panel activity log is deleted after two years and the destruction records after five years. The daily statistics produced from server access logs are deleted automatically after 365 days. These operations are carried out automatically as part of the periodic destruction cycle, which is run at intervals of no more than six months under the Regulation on Erasure, Destruction or Anonymisation of Personal Data.

Under Article 12 of the KVKK, appropriate technical and administrative measures are taken to prevent the unlawful processing of and unlawful access to personal data and to ensure its safekeeping. Website traffic is encrypted with HTTPS and a strict transport security header is sent to the browser; access to the admin panel is restricted to authorised accounts with an optional two-step verification; and actions and sign-ins performed in the panel are written to an audit log. Bot protection and a per-IP rate limit are applied to form submissions; the IP address used for that purpose is held only temporarily in server memory and is not written to the database. If we determine that personal data has been unlawfully obtained by others, we notify the data subject concerned and the Personal Data Protection Board as soon as possible, and within seventy-two hours as required by the Board's decision.

A limited amount of automated evaluation takes place on our website: the AI chat assistant extracts a name and contact detail from the conversation, and campaign and referral information is associated with your enquiry. Where you have given cookie consent, the measurement services used may produce analyses such as heat maps, click maps or session recordings of your behaviour on the site. However, no decision producing legal consequences against you or significantly affecting you is taken about you solely by means of analysis through automated systems; decisions on proposals, pricing and whether a service will be provided are always made with human assessment. Your right under Article 11/1(g) of the KVKK to object to the outcome of automated analysis is reserved, and you may raise such an objection at [email protected].

The special categories of personal data listed in Article 6 of the KVKK, namely data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, together with biometric and genetic data, are not requested in any form on our website and are not processed by our business. We strongly ask you not to write information of this kind into the free-text and message fields of our forms. If we notice that such data has been sent to us, the record concerned is deleted, or the relevant part of it removed, at the earliest opportunity, since there is no purpose or legal ground requiring its processing. The same rule applies to text entered into the AI tools.

Our website and services are not directed at persons under the age of eighteen; the services we offer are addressed to commercial customers. Our forms do not ask for or verify age, and therefore no personal data belonging to children is knowingly collected. If you believe that personal data concerning a child for whom you are the parent or guardian has been sent to us without your consent, you may apply to [email protected]; on receipt of your application the record concerned is examined without delay and deleted unless there is a legal ground requiring its retention. We also remind you that the AI tools on the site are intended for adult use and that children should not enter personal information about themselves or others into them.

Under Article 11 of the KVKK you have the right, by applying to the data controller, to learn whether your personal data is being processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in accordance with that purpose; to know the third parties in Turkey or abroad to whom your data has been transferred; to request rectification where the data is incomplete or incorrectly processed; to request erasure or destruction within the conditions set out in Article 7 of the Law; to request that rectification, erasure and destruction operations be notified to the third parties to whom the data was transferred; to object to a result against you arising from analysis of the processed data solely by automated systems; and to claim compensation for damage suffered because of unlawful processing of your personal data.

In accordance with the Communiqué on the Principles and Procedures of Application to the Data Controller, you may submit requests concerning your rights to [email protected] by a wet-signed written petition, a registered electronic mail (KEP) address, a secure electronic signature or mobile signature, or from the e-mail address you previously notified to us and which is registered in our system. Your application must state your name and surname, your signature in a written application, your Turkish identity number for Turkish citizens or your nationality and passport number for foreigners, your address for service, your telephone number and e-mail address if any, and the subject of your request. Applications are concluded within thirty days at the latest and as a rule free of charge; where the operation entails an additional cost, the fee in the Board's tariff may be charged. If your application is rejected, answered inadequately or not answered in time, you may complain to the Board within thirty days and in any case within sixty days of your application.

This disclosure notice is updated whenever there is a change in the technologies we use, in our service providers, in the purposes of processing or in the applicable legislation. In accordance with the Communiqué on the Principles and Procedures to Be Followed in Fulfilling the Disclosure Obligation, the disclosure obligation is performed anew where the purpose of processing or the parties to whom data is transferred change. The current version is published on this page together with its last update date and takes effect at the moment of publication; it does not apply retrospectively. In the event of any conflict between the Turkish and English versions of this notice, the Turkish text prevails. Turkish law applies to any dispute arising from this notice, and the Courts and Execution Offices of Istanbul (Anatolian) have jurisdiction.