Privacy policy and KVKK notice

This notice applies to the bakibilisim.com domain and its subpages, and to the email, telephone and WhatsApp correspondence conducted from that address. The full contact record and the application procedure appear in the requests section below; the company record is also set out on our about page.

Baki Bilisim is a digital agency that builds corporate websites, mobile applications and brand identity systems, and engineers visibility in search, answer and generative engines. Because of that focus, the personal data we handle is overwhelmingly corporate: company name, role in the organisation, work email and work telephone. We do not sell a consumer product, so we keep no large customer database.

We include this clause because most readers of the English version of this site sit in an EU, UK or global procurement function and evaluate a Turkish supplier against a framework they already know. The table is an orientation aid, nothing more.

The site carries two forms: the project brief form on the contact page and the request form for the free digital asset audit. Both ask only for the fields needed to assess your request and reply to you, and every field is listed by category in the table below. Nothing is collected outside those forms: the site has no registration, membership, comment, search or basket function.

No data is processed for any purpose outside this list. Concretely: the email address you give is not added to a marketing list, no newsletter subscription is opened, nothing is sent to purchased or rented lists, and your data is not sold. Completing a form is not consent to commercial messaging; once your enquiry is closed, no further message is sent to you for another purpose.

No decision producing an adverse effect on you is taken solely by automated means. The budget band on the form is not an automated filter either: when a band below our threshold is selected the page simply shows an informational note, and the enquiry is still read and answered by a person.

Every transfer takes place under KVKK Article 8, for the purposes listed in clause 04 and limited to what those purposes require. The recipient groups are:

• Hosting and corporate email provider. As a processor, and only to the extent the service requires. Which provider is used, and the country in which its servers are located, is disclosed to you in writing on request.
• Accountant, and legal counsel where needed. Only for invoicing, bookkeeping and dispute matters; both are bound by professional confidentiality.
• Authorised public institutions. Only where expressly provided by law, and where the request cites the provision it relies on.
• Contracted subcontractors. Where they work on your project; each is named in the contract and bound by a confidentiality undertaking. Proposal-stage form data is never passed to a subcontractor.

Is data transferred outside Turkey?

On the effective date of this notice the site contains no third-party code that sends data abroad without your action: no analytics script, advertising pixel, embedded map, embedded video, third-party web font, chat widget or CAPTCHA. Fonts and all images are served from our own origin, so opening a page makes no outbound request whatsoever. You can confirm this yourself in your browser's network panel; the method is written up on the proof page.

Directions and WhatsApp links on the site only reach the relevant service when you click them, and from that point the provider's own privacy policy applies. If a tool requiring transfer abroad is adopted later, the transfer will be made in line with KVKK Article 9 — an adequacy decision, appropriate safeguards, or a statutory exception — and with your explicit consent where that is the ground relied on. This notice would be updated the same day.

You do not have to wait for a period to expire before asking for erasure. If no other legal ground requires retention, your request is carried out within 30 days at the latest and confirmed to you in writing. If a record cannot be deleted because a statutory retention duty applies, we tell you which record it is and on what basis it is being held.

The technical measures taken under KVKK Article 12 that you can verify for yourself are listed below — every one of them is visible in the server response headers:

• Enforced HTTPS and HSTS. Unencrypted requests are permanently redirected to the encrypted address; the Strict-Transport-Security header tells the browser to open the domain over HTTPS only.
• Content Security Policy. The origins for scripts, styles, images, fonts and connections are restricted to our own domain. The form-action 'self' directive prevents the form from being posted anywhere else.
• Additional security headers. X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Cross-Origin-Opener-Policy: same-origin, and a Permissions-Policy that switches off camera, microphone, geolocation and payment access.
• No third-party scripts. Form data leaves your browser for our server and nothing else; there is no form service, validation service or tag manager in between.
• Server-side checks instead of CAPTCHA. Automated submissions are filtered with a hidden field and a submission-timing check. We do not use CAPTCHA, because CAPTCHA sends a visitor's data to a third party.

On the organisational side: access to data is limited to the people handling the request, corporate email accounts use multi-factor authentication, a confidentiality undertaking is written into the contract whenever a subcontractor is engaged, and redundant copies are deleted at the end of a project.

If a breach occurs despite these measures, notification is made to the Personal Data Protection Board as soon as possible — within the 72-hour period set by the Board's decision — under KVKK Article 12/5, and the affected individuals are informed directly within the shortest reasonable time.

As a data subject you may apply to Baki Bilisim and request the following:

1. To learn whether your personal data is being processed.
2. To request information if your personal data has been processed.
3. To learn the purpose of processing and whether the data is used in line with that purpose.
4. To know the third parties in Turkey or abroad to whom your data has been transferred.
5. To request correction where your data has been processed incompletely or inaccurately.
6. To request erasure or destruction of your data under the conditions in Article 7 of the Law.
7. To request that correction, erasure and destruction be notified to the third parties to whom the data was transferred.
8. To object to a result reached against you through analysis carried out solely by automated systems.
9. To claim compensation where you suffer loss because your data was processed unlawfully.

Can you withdraw your explicit consent?

Yes. Where processing rests on explicit consent you may withdraw it at any time, without giving a reason; a single email is enough. Withdrawal takes effect going forward: processing carried out while the consent was valid remains lawful, but once your request reaches us the data is no longer processed for that consent-based purpose. If your request would require erasure of data we must retain under a contractual or statutory duty, we explain in writing which record is retained and why.

What about the GDPR rights that KVKK does not name?

KVKK Article 11 contains no separately named right to data portability, and no general right to restriction of processing in the GDPR sense. In practice this changes little here: the data we hold about you is limited to what you sent us. If you ask, we will send you a copy in a common machine-readable format. We do that as a matter of practice, not because Turkish law obliges us to, and we would rather say so than imply a right that the Law does not grant.

The mechanism used is not a cookie but the browser's local storage: your theme preference is held on your device under the key bb-theme and is never attached to a server request. To remove it, clear the site data in your browser; once cleared, the site falls back to the light or dark setting of your operating system.

Cookie categories, durations, consent management and consent withdrawal are set out in detail on the cookie policy page. For the conditions on using and quoting the content of this site, see the terms of use.

A change in legislation, an extension of our service scope or the adoption of a new tool can all make an update necessary. When that happens, a summary of the change is entered in the table below, so you can see retrospectively what changed and when. If a clause that affects you directly changes while a client relationship is running, the change is also notified by email.

This English text is published for readers who do not work in Turkish. The Turkish version at gizlilik ve KVKK is the version in force; where the two differ in meaning, the Turkish text prevails.