LEGAL
Privacy Notice
What we do with personal data in the two roles we take: as the controller of our own site and enquiries, and as a processor working on a client’s instructions.
Who we are
Webosentez is a design and engineering studio based in Ankara, Türkiye, working with clients and partners internationally. We operate from Kızılırmak Mah. 1445 Sk. The Paragon No: 2/1 İç Kapı No: 113, Çankaya, Ankara, Türkiye. Every request under this notice reaches us at info@webosentez.com or +90 312 870 11 98, and is answered by a named person rather than a ticket queue.
The two roles we take
The distinction matters, because your rights and our obligations differ between them.
- As a controller. For visitors to webosentez.com, people who write to us, and the contacts at the agencies and brands we correspond with, we decide why and how the data is handled. That is what most of this notice is about.
- As a processor. When we build, host or maintain a system for a client or an agency partner, any personal data inside that system belongs to them. They decide what happens to it; we act only on their documented instructions. If you are an end user of a site we built, the operator of that site is your controller, not us.
What we collect as a controller
- Identity and contact data: the name, company, email address and phone number you give us through the scope form or by email, phone or WhatsApp.
- Enquiry content: what you tell us about the project, your current site address, and a budget range if you choose to share one.
- Booking data: if you book a call, the name, email address and any notes you enter, held by our scheduling provider.
- Security data: the IP address of a form submission, kept briefly to prevent abuse.
- Enquiry source data: when you send a form, the page you arrived on, the site that referred you, campaign tags (utm), the ad click identifier (gclid or fbclid) if you came from a Google or Meta ad, and your cookie choice are added to the enquiry. None of this reaches us unless you send the form.
- Usage data: if and only if you consent, aggregate visit statistics and ad conversion data through analytics and ad measurement cookies; without consent, aggregate measurement signals that carry no cookies or identifiers. See the cookie policy.
- Visit statistics: regardless of consent and without cookies, the page viewed, the referring site and campaign tags, country and city, browser, operating system and device type. Your IP address is not stored; it is used only to derive a one-way hash, changed at regular intervals, so the same visitor is not counted twice.
Why we process it, and on what lawful basis
| Purpose | Lawful basis |
|---|---|
| Answering your enquiry, scoping the work and preparing a proposal | Steps taken at your request before entering a contract (GDPR Art. 6(1)(b)) |
| Delivering a project and supporting it after launch | Performance of a contract (GDPR Art. 6(1)(b)) |
| Business correspondence with people at partner organisations | Our legitimate interest in running the studio (GDPR Art. 6(1)(f)) |
| Keeping the site secure and preventing form abuse | Legitimate interest (GDPR Art. 6(1)(f)) |
| Knowing which page and channel an enquiry came from, and whether our ad spend works | Legitimate interest (GDPR Art. 6(1)(f)) |
| Counting, in aggregate and without cookies, how many people the site reaches and which pages and channels bring them | Legitimate interest (GDPR Art. 6(1)(f)); you can object by enabling Do Not Track in your browser |
| Measuring how the site is used | Your consent, withdrawable at any time (GDPR Art. 6(1)(a)) |
| Ad conversion measurement with Google Ads and Meta, and reporting an enquiry’s later outcome to Google Ads | Your consent, withdrawable at any time (GDPR Art. 6(1)(a)) |
| Aggregate measurement signals without cookies or identifiers, when you have not consented | Legitimate interest (GDPR Art. 6(1)(f)) |
| Accounting, invoicing and tax records | Legal obligation under Turkish law (GDPR Art. 6(1)(c)) |
Under Turkish law the same processing rests on KVKK Art. 5/2-c for contract-related data, Art. 5/2-f for legitimate interest (including enquiry source data), Art. 5/2-ç for legal obligations, and explicit consent under Art. 5/1 for analytics, ad measurement and reporting an enquiry’s outcome to Google Ads. Aggregate measurement signals sent without consent and the cookieless visitor count rest on Art. 5/2-f.
Google Ads conversion measurement
If you allowed ad measurement and arrived from a Google ad, your form, phone or WhatsApp enquiry is reported to Google Ads as a conversion. If the enquiry later becomes a qualified meeting or a contract, we may report that outcome to Google Ads using the ad click identifier. Your name is not sent to Google. Your email address and phone number are hashed in your browser (SHA-256) and only that hash is sent, to match the enquiry to the ad click. An outcome report carries the click identifier, the enquiry record number, the type of outcome and its date. If you did not consent, nothing that identifies you is reported; Google receives only a conversion signal without identifiers. We do not personalise ads or run remarketing.
Meta ad measurement
If you allowed ad measurement, your page views, form enquiry and clicks on the phone, WhatsApp or email links are reported to Meta (Facebook, Instagram) as ad conversions. For a form enquiry your email address and phone number are sent hashed (SHA-256), together with your IP address and browser details, both from your browser and from our server; Meta counts the two as one event. Your name and the content of your enquiry are not sent. If you did not consent, Meta tools do not run and nothing is sent to Meta. We do not personalise ads or run remarketing.
Unsolicited business email
If we write to your organisation about working together, every message carries a working one-click unsubscribe header and a link that removes you without a reply. We act on a refusal within three business days and keep only the minimum record needed to make sure we do not write again.
Who else sees the data
We do not sell personal data and we do not share it for anyone else’s marketing. Access is limited to the providers that make the service work:
| Provider | What for | Where |
|---|---|---|
| Hostinger International Limited | The server running this site, its database, our mail and the cookieless visitor count | Frankfurt, Germany |
| Cal.com, Inc. | Call scheduling, if you book one | United States |
| Google Ireland Limited and Google LLC | Analytics and ad conversion measurement with your consent; aggregate signals without cookies or identifiers otherwise | Ireland and the United States (Google LLC is certified under the EU-U.S. Data Privacy Framework) |
| Meta Platforms Ireland Limited and Meta Platforms, Inc. | Ad conversion measurement, only with your consent | Ireland and the United States (Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework) |
Worth noting for European buyers: this site, its database and our mail all run on a single server in Frankfurt. Enquiry data stays inside the EU at rest. What crosses a border is our own access to it from Ankara, which is the transfer the safeguards below cover.
On client projects the provider list depends on that project’s architecture and is set out in the agreement covering it. We do not add a sub-processor to a client system without telling the client first.
Transfers out of the EU and the UK
We are established in Türkiye. Türkiye is not covered by a European Commission adequacy decision, so sending personal data from the EEA to us is a restricted transfer and needs a safeguard under Chapter V of the GDPR.
- For EEA clients and partners: we sign the Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) as data importer, together with a transfer impact assessment, before any personal data reaches us.
- For UK clients and partners: we sign the same clauses with the ICO’s International Data Transfer Addendum, or the IDTA on its own.
- In the other direction: when we send personal data out of Türkiye, KVKK Art. 9 as amended in 2024 lets us rely on the Authority’s standard contract, filed with the Personal Data Protection Authority within five business days of signature.
A data processing agreement with the relevant clauses attached is available on request, before a project starts. Ask and we will send the current version the same working day.
How long we keep it
- Enquiries that do not become projects: up to 2 years
- Contract records: 10 years from the end of the relationship, matching the limitation period under the Turkish Code of Obligations
- Accounting and invoice records: 10 years under Turkish tax and commercial law
- Security logs: 1 year
- Enquiry source data: kept with the enquiry it belongs to
- Analytics and ad measurement cookies: the periods listed in the cookie policy
- Cookieless visit statistics: up to 25 months
- Client data we hold as a processor: for as long as the client instructs, then deleted or returned at their choice
Once a period ends, data is deleted, destroyed or anonymised.
How we protect it
Transport is encrypted end to end, credentials are held outside version control, server access is limited to named accounts with key-based authentication, and backups are taken on a schedule and tested. If a breach affects data we hold for a client, we notify that client without undue delay so they can meet their own 72-hour obligation.
Your rights
If the GDPR applies to you, you have the right to access your data, correct it, have it erased, restrict or object to processing, receive it in a portable format, and withdraw consent at any time without affecting processing already carried out. Where we rely on legitimate interest, you can object and we will stop unless we can show compelling grounds that override your rights.
Under Turkish law, KVKK Art. 11 gives you a comparable set: to learn whether your data is processed, to be told the purpose, to know the third parties it has been transferred to in Türkiye or abroad, to have it corrected, erased or destroyed, to have those changes passed on, to object to a decision produced solely by automated analysis, and to claim compensation for unlawful processing.
Making a request
Write to info@webosentez.com with your name, contact details and what you are asking for. We answer within one month under GDPR Art. 12(3) and within thirty days under Turkish law. There is no charge for a first request.
If you are not satisfied with our answer, you can complain to the supervisory authority in your country of residence or work, to the ICO in the United Kingdom, or to the Turkish Personal Data Protection Authority. You can go to a supervisory authority without asking us first.
Last updated: October 2026.