KVKK Privacy Notice

1. Data controller

Metoraz AI & Consultancy
İzmir, Türkiye
Privacy requests: info@metoraz.com

A full street address, MERSIS number and tax number are not published here because they are not available in a form we can show. This notice does not state a VERBİS registration status.

2. Categories of personal data

In practice the following categories may be processed:

• Contact form: name, email, company, service preference, message; Cloudflare Turnstile token; IP address for rate limiting and the internal notification.
• Booking form: name, email, optional company, topic, duration, meeting type (video / phone / in person), phone (only if you choose a phone call), notes, chosen slot.
• Online training registration: name, email, optional company and note, chosen session, language.
• Mobile partner application (API on www.metoraz.com; there is no separate public web form): company name, contact name, email, phone, delivery mode, expertise areas, client count, reference details, listing text; authenticated mobile user record.
• Technical data: IP address, browser and device signals (Turnstile), language preference, cookies and local storage, analytics (only with consent).
• Admin panel: session data for the authorised admin account (tolga@metoraz.com) via Google or email magic link.

The site has no form that asks for special-category data under Article 6 KVKK. If you put such data in a free-text field, it is processed only as you sent it, to handle your request.

3. How data is collected

Data is collected electronically: website forms, booking and training requests, cookie choices, server logs and rate-limit records, admin login, and mobile API calls. Automatic collection covers technical data from your browser, security checks and, if you consent, measurement tools.

4. Purposes

• Receive, answer and fulfil contact, meeting and training requests
• Write the meeting to a calendar and create a Google Meet link when you choose video
• Manage training registrations and seat limits
• Review mobile partner applications
• Protect forms against automated abuse and apply rate limits
• Run the site and apply language and cookie choices
• If you consent, measure site use in aggregate and show embedded third-party content
• Let the admin manage site content

5. Legal bases (KVKK Arts. 5 and 6)

• Art. 5(1) explicit consent: the contact and training checkboxes; the cookie banner for analytics and embedded content (LinkedIn, YouTube, Vimeo, Loom).
• Art. 5(2)(c): processing needed to set up or perform the meeting, enquiry or training you asked for.
• Art. 5(2)(f): site security, rate limiting, remembering language and cookie choice, admin session, where this does not harm your fundamental rights.
• Art. 5(2)(ç) / other law: keeping records if a legal duty or dispute requires it.

6. Recipients

• Vercel Inc.: website hosting
• Supabase: database, file storage and admin/mobile authentication; project region ap-southeast-1 (Singapore)
• Resend: email delivery
• Google: Calendar and Meet; Analytics 4 after consent; YouTube if a video embed is shown
• Cloudflare, Inc.: Turnstile
• LinkedIn, Vimeo or Loom: only after you consent to the relevant embed

For KVKK applications please write to info@metoraz.com.

7. Transfers abroad (KVKK Art. 9, as amended by Law No. 7499)

Some processors are established outside Türkiye or process data on servers outside Türkiye, including Vercel, Supabase in Singapore, and email / calendar / measurement providers. Transfers of analytics and embeds rely on your explicit consent after this information (Art. 9(6)(a)). Hosting and form delivery rely on appropriate safeguards and/or necessity to provide the service (Art. 9(4) and related paragraphs). This page does not claim that standard contracts have already been filed with the Board; the owner should confirm that with counsel.

8. Retention

The codebase does not define an automatic deletion schedule. Contact, booking, training and partner records are kept for a reasonable time to fulfil the request and handle related claims, then deleted or anonymised. Cookie and consent periods are in the Cookie Policy. Rate-limit records are short-lived technical logs.

9. Your rights (KVKK Art. 11)

You may ask whether your data is processed; request information; learn the purpose and whether it is used in line with that purpose; know the third parties to whom it is transferred; request correction; request deletion or destruction under Art. 7; ask that correction or deletion be notified to recipients; object to a result against you from automated analysis; and claim compensation if you suffer damage from unlawful processing.

10. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, send your request in Turkish, with information that identifies you, by email to info@metoraz.com or in writing to the controller in İzmir, Türkiye. Include your name, a contact address for reply, the request and information needed to verify your identity.

We answer within the Communiqué periods, as a rule within 30 days and free of charge. Extra cost may apply only as that Communiqué allows. You may complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu).

11. Cookies

Non-essential measurement and embeds load only after you accept them on the cookie banner. See the Cookie Policy.