Privacy Policy

We explain why we process personal information, how we protect it and what rights you have.

Last updated:

Data controller

Fotinos Yazılım ve Teknoloji Limited Şirketi is the data controller for personal data processed under this policy. Our address is Merkez Mah. Abide-i Hürriyet Cad. Palazoğlu Sk. No:1 Kat:4 D:23, Şişli/İstanbul, Türkiye. Contact us at info@fotinos.com.tr with questions or rights requests.

Information we collect

When you submit the contact form or the project proposal form, we process the full name and phone number you enter, your email address (required on the proposal form and optional on the contact form), your company name if you choose to give it on the proposal form, and the message or project description you write. We also record the form language and form type, and your acknowledgement of the Privacy Notice together with its time and the version of this policy.

We do not request sensitive personal data. Please do not enter health data, special-category personal data or confidential information that does not need to be shared in the message or project description fields.

  • Identity and contact information
  • Optional company information
  • Message or project description
  • Privacy-notice acknowledgement and submission records
  • Basic technical data such as IP address, request time and browser headers

Browser storage, analytics and language

Your privacy choice is stored on this device in a localStorage record named 'fotinos-consent:v2'. The record contains the consent schema and privacy-policy versions, your analytics choice and the time the choice was updated; it contains no direct identifiers. The privacy banner asks only for analytics consent, and you can reopen it at any time through the persistent Privacy settings control. A material change to the consent purposes or policy version causes the site to ask again.

The English version is served at the root URL, Spanish under '/es' and German under '/de'. No persistent cookie or localStorage record is used for language selection.

Google Analytics

We use Google Analytics 4 with Google Consent Mode. The Google tag loads when a page opens, with analytics storage denied by default. While analytics storage is denied, Google Analytics does not read or write analytics cookies, but the tag may send the consent state and limited cookieless measurement signals to Google for basic measurement and modelling. If you enable analytics, Google Analytics may use first-party cookies such as '_ga' and related identifiers and process fuller information about pages viewed, interactions, referral source, device and browser characteristics, and approximate location.

Signals sent while analytics storage is denied may include the time, user agent, referrer, consent-state values and a random value generated for the page load. We do not intentionally include names, email addresses, phone numbers, form contents or project descriptions in Google Analytics events.

Advertising storage, advertising user data, ad personalization and Google Signals remain disabled in both consent states. Enabling analytics does not enable Google's advertising or personalization features.

You can withdraw analytics consent at any time through the Privacy settings control in the footer. Withdrawal changes analytics storage to denied, prevents Google Analytics from reading or writing analytics cookies and removes accessible Google Analytics cookies from this device. It does not stop the limited cookieless signals described above while the Google tag remains loaded. Google processes information under its own terms and privacy safeguards.

How do we use information?

We use information to respond to requests, provide services, manage proposals and projects, maintain security, meet legal obligations and improve service quality. When you give permission, we also use analytics cookies and fuller measurement. While analytics storage is denied, limited cookieless signals may support aggregate or modelled reports that we use to understand website usage and improve the digital experience.

Legal bases under GDPR and KVKK

Where the EU or UK GDPR applies, we rely on your consent for analytics cookies and fuller Google Analytics measurement; steps requested before entering into a contract or performance of a contract for project enquiries and services; compliance with legal obligations; and our legitimate interests in securing, operating and improving the website where those interests are not overridden by your rights. Under Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK), we process personal data on the corresponding legal grounds available under that law, including explicit consent where required, contract formation or performance, legal obligation, establishment or protection of a right, and legitimate interest.

Form delivery and service providers

When you submit the contact form or the project proposal form, the information you entered is sent from your browser over HTTPS to the website's own server endpoint, which runs on Cloudflare's infrastructure. The endpoint emails your submission to Fotinos's corporate mailbox, info@fotinos.com.tr, which is run on Google's email service (Google Workspace). No third-party form service is used, and no automatic copy is sent to you. The endpoint processes basic technical data such as your IP address only to deliver the message and to prevent abuse through rate limiting. It does not store submissions itself; they exist only in the mailbox. Our hosting, email and security providers may process data limited to what is necessary for their tasks and subject to appropriate security requirements. We do not sell personal data.

Google may process limited cookieless consent and measurement signals while analytics storage is denied, and fuller website-usage data when you enable analytics. We do not include form fields in Analytics events.

Processing and transfers outside Türkiye

The infrastructure of Cloudflare (hosting and the form endpoint) and Google (email through Google Workspace, and Google Analytics) may be located outside Türkiye and your country of residence. Form information, basic technical data, limited cookieless Analytics signals and, when you authorise analytics, fuller Analytics data may therefore be processed internationally. Our arrangements with providers and transfer mechanisms permitted by applicable law govern these transfers. You may contact us for information about safeguards relevant to your data.

Hosting and technical records

The website and its form endpoint run on Cloudflare infrastructure. Connection records such as IP address, request time, requested address and basic browser information may be technically processed to deliver pages and form submissions, prevent abuse and maintain security. Cloudflare Web Analytics and RUM are disabled. Google Analytics processing under denied and granted analytics-storage states is described separately above.

Retention period

Submitted forms are kept in our corporate mailbox, not on the form endpoint. We retain them and related correspondence for as long as necessary to respond to your request, manage a quotation or potential contract process and meet legal obligations. For Google Analytics user- and event-level data collected while analytics storage is granted, we configure retention to 14 months; aggregated or modelled reports may remain available for longer. Google handles limited cookieless signals sent while analytics storage is denied under its service terms and privacy safeguards. At the end of the applicable period, we delete, destroy or anonymise data and limit service-provider retention through contracts and account settings where reasonably possible.

Data security

We apply reasonable administrative and technical measures to protect personal information against unauthorized access, alteration, disclosure or loss. No internet transmission method can provide absolute security.

Children's privacy

We do not knowingly collect personal data from or market to people under 18. If we learn that such data has reached us, we take steps to delete it.

Your privacy rights

Depending on the law that applies to you, you may have the right to request access, correction, deletion, restriction or portability of your personal data, to object to certain processing, and to withdraw consent at any time without affecting processing carried out before withdrawal. You may also complain to the competent data-protection authority. Under Article 11 of the KVKK, you also have the rights to learn whether and why your data is processed, know recipients, request correction, deletion or destruction, and exercise the other rights provided by law.

Policy changes

We may update this policy in response to service or legal changes. The current version and revision date will be published on this page.

Contact

Send requests about this privacy policy, your data or your rights to info@fotinos.com.tr or use our contact page.