01Data Controller
The data controller is Emrah EMREZ, the individual operating under the "Virtual Ajans" brand.
Contact: email [email protected].
02Categories of Personal Data Processed
- Identity: full name
- Contact: email and/or phone number (at least one required)
- Request content: need type, budget (optional), project description
- Transaction security: a unique record ID and record timestamp for the request
- Limited security-purpose data: a hashed form of your IP address for abuse/misuse prevention (rate limiting) — the raw IP address is not stored in the primary database. This hashing makes the data pseudonymous; it does not amount to irreversible anonymization, and infrastructure providers carrying the traffic (e.g. Cloudflare) may see your raw IP address within their own systems.
03Collection Method
The data is collected electronically through the site's offer form, entered directly by you; some fields, such as the record ID, timestamp and the security-purpose IP hash, are generated automatically by the system.
04Processing Purposes
- Evaluating and responding to the submitted offer/request
- Conducting the pre-contractual discussion and proposal process
- Preventing misuse (spam, automated bots) and securing the form and system
No processing for marketing/newsletter purposes is carried out through the form; the form does not contain a mandatory consent checkbox.
05Legal Grounds
- KVKK Art. 5/2-c: being directly related to and necessary for the establishment or performance of a contract — limited solely to carrying out the proposal/pre-discussion steps
- KVKK Art. 5/2-f: the data controller's legitimate interest — securing the system through IP hashing and rate limiting, balanced against the data subject's fundamental rights and freedoms
- KVKK Art. 5/2-e: where mandatory for the establishment, exercise or protection of a right (e.g. managing a possible legal claim or dispute)
06Data Flow and Service Providers
When form submission is active, the form data is saved to an SQLite database on the primary server hosted in Istanbul, Turkey; only Emrah EMREZ can access this database. Once the record is successfully completed, a notification covering your full name, contact information and request content is sent via Telegram. In cases where the primary server cannot be reached, a separate backup function — which only attempts to send a notification — is triggered; this backup path does not write any record to the database, so a database record for every request cannot be guaranteed.
Cloudflare is used to host the site, route traffic, and secure it (e.g. via Tunnel; and also via Turnstile when enabled). In this context, technical data such as your IP address and request information passes through Cloudflare's infrastructure; the backup notification data sent when the primary server is unreachable is also carried over the same infrastructure. Yandex is used solely for conducting email correspondence. Communication via WhatsApp is an entirely optional channel you initiate yourself, independent of the form data.
The primary server is located in Istanbul, Turkey, and is accessed only by Emrah EMREZ. However, the providers mentioned above may also process your data abroad; it is therefore not claimed that all data is kept solely in Turkey.
07Retention Periods
- Requests that do not turn into a contract: 12 months from the last meaningful contact
- System/transaction logs: 30 days — may be exceptionally extended for a justified reason such as investigating a security incident
- Backups: a 30-day cycle is targeted
- Records that turn into a contract: for as long as required by applicable law (e.g. tax, commercial law)
These periods reflect the approved retention policy; there is no automated deletion/destruction mechanism that operates strictly by these periods.
08Your Rights Under KVKK Article 11
By applying to the data controller, you have the right to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of processing and whether it is used in accordance with that purpose; know the third parties to whom it is transferred domestically or abroad; request correction if it has been processed incompletely or incorrectly; request its deletion/destruction within the conditions set out in KVKK; request that correction and deletion be notified to the third parties to whom the data was transferred; object to a result arising against you from analysis carried out exclusively through automated systems; and request compensation for damages suffered as a result of unlawful processing.
09Application Method (KVKK Art. 13)
You can submit your application to the data controller in writing, in accordance with Article 13 of KVKK and the procedures set by the Board, or through other methods determined by the Board. Applications are concluded within 30 days at the latest and are generally free of charge; if the process requires an additional cost, only the fee tariff set by the Board may apply. For your application to be evaluated, it is enough to share the minimum information verifying your identity (e.g. your name and the contact information you previously provided us); you will not be asked for more identification documents than necessary.
For detailed privacy practices, see the Privacy Policy page.