Privacy Policy
Draft pending legal review.
This Privacy Policy summarises how [TeginSoft legal name] (“TeginSoft”) collects, protects, retains and shares the personal data we obtain through our website and contact channels. The legal notice under Turkish Personal Data Protection Law No. 6698 is the Privacy Notice; cookies are described in the Cookie Policy.
1. Our principles
- Data minimisation: we collect only what the purpose needs. We never store your raw IP address or your browser’s full identifying string in our database.
- First-party measurement: the site has no third-party analytics, advertising or social media trackers. Visits are measured on our own servers.
- Your choice: persistent analytics identifiers are stored only with your consent; Do Not Track and Global Privacy Control signals are respected.
- No selling: we do not sell, rent or share your personal data for advertising.
2. Data we collect
- Contact form: name, e-mail, optional company and phone, area of interest, message, language, the time you confirmed reading the privacy notice, and the channel and campaign that brought you to the site.
- Site visits: pages visited, referring site, campaign parameters, device type, browser and operating system name, country code, interaction events; a tab-specific session id and, with your consent, an anonymous visitor id. To count visits within a day, a one-way hash is derived from your IP address and browser string with a secret key that changes every day and is destroyed at the end of the day.
- Short links and QR codes: time of the click, the campaign, the referring domain and the device type. No visitor id or IP address is stored.
- Server logs: request method, path, result, duration and a correlation id. IP addresses and request bodies are not written to the logs.
3. How we protect data
- All communication with the site is encrypted with TLS.
- Access to the admin panel is limited by role-based permissions; administrator accounts are protected with two-step verification [to be confirmed once it is mandatory for all administrator roles].
- Session tokens are stored only as one-way hashes; admin sessions use short-lived access tokens.
- Changes in the content management system are written to audit records; for changes to enquiries, fields containing personal data are masked in those records.
- The contact form is protected against automated submissions by Cloudflare Turnstile and rate limiting.
4. Retention
| Data | Retention and afterwards |
|---|---|
| Enquiries, internal notes and the enquiry’s source data | [To be determined — pending legal review]; immediately on your erasure request. Permanently deleted together with the linked session records. |
| Raw visit data (sessions, page views, events, short-link clicks) | 13 months. Deleted by a daily job; reports use only daily totals that contain no personal data. |
| Daily secret key of the visitor hash | The same day (until midnight Istanbul time). Destroyed; hashes of earlier days can no longer be recreated or linked. |
| Audit records | 24 months. Deleted. |
| Expired admin session records | 30 days after final expiry. Deleted. |
| Application log files | About 30 days (the last 30 daily files). Older files are deleted. |
| Data in your browser | Cookie choice 180 days; analytics data 90 days; tab data until the tab is closed. Deleted by your browser; see the Cookie Policy. |
| Copies in mailboxes and backups | [To be determined — pending legal review]. The deletion method will be set together with the period. |
5. Sharing and transfers abroad
Your data is shared only with the hosting provider [provider name, country] and the e-mail provider [provider name, country] needed to run the service, with Cloudflare, Inc. (USA) for the bot check, and with competent authorities where the law requires. Transfers abroad are made under KVKK article 9 [appropriate safeguards — pending legal review].
6. Automated decision-making
We make no decisions about you based solely on automated processing that have legal effects on you, and we do not build profiles. Channel measurement works on aggregate statistics.
7. Children
Our site and services are aimed at business customers; we do not knowingly collect personal data from anyone under 18.
8. Your rights and contact
Your rights under KVKK article 11 and how to apply are explained in the Privacy Notice. For privacy questions, write to [kvkk@domain].
9. Changes
We may update this policy when our practices or the law change. The current version is always published on this page.
Last updated: [date]