1. Data Controller
Your personal data is processed by Vevona Digital as data controller, within the scope described below.
- Registered company name
- [to be completed]
- Address
- Folkart Towers Tower A, Floor 35, No:3509, Bayraklı, İzmir
- Telephone
- +90 506 843 94 96
- Trade registry / Tax number
- [to be completed]
- Registered electronic mail (KEP) address
- [to be completed]
- VERBİS registration
- [to be completed]
2. Personal Data We Process
Only the data listed below is collected through the contact / project brief form on our site. We do not request identity documents, financial details or special categories of personal data (health, beliefs, biometrics, etc.).
Data you enter yourself
- Full name — required field; so we can address you correctly and link the request to you.
- Email address — required field; so we can reply to your request.
- Phone number — optional; stored only if you choose to share it.
- Company name — optional; used to route corporate enquiries to the right team.
- Enquiry subject and budget range — optional; used to scope the proposal correctly.
- Message content — required field; it is free text, so please avoid sharing sensitive information unless necessary.
Data recorded automatically for technical reasons
- IP address — to detect form abuse (spam, bots, automated submissions) and to provide evidence in a legal dispute.
- Browser information (user agent) — for the same security purpose; includes device and browser type.
- The address of the page you submitted the form from — to understand which content the enquiry came from.
- Consent record and submission time — to be able to prove when explicit consent was given.
3. Purposes of Processing
- To assess your enquiry, reply to you and prepare proposals and pricing.
- To conduct pre-contractual discussions and manage the process if a business relationship begins.
- To evaluate your application if you submitted a job application.
- To keep the form secure and block spam and automated attacks.
- To meet our legal retention and evidentiary obligations.
Without your explicit consent, your personal data is not used for marketing profiling, automated decision-making or sale to third parties.
4. Legal Basis
Your data is processed on the following legal grounds under Article 5 of the KVKK:
- Explicit consent (Art. 5/1) — the data protection checkbox you tick when submitting the form.
- Formation or performance of a contract (Art. 5/2-c) — data relating to proposals and project work.
- Legitimate interest (Art. 5/2-f) — security records such as IP address and browser information.
- Legal obligation (Art. 5/2-ç) — retention duties arising from legislation.
5. Collection Method
Data is collected entirely electronically — by automated and partly automated means — through the contact form on our site and via email, phone and WhatsApp.
6. Disclosure and International Transfers
The name, email, phone number, company name, message content and enquiry source you submit through the form are transferred to Vevona's own customer relationship management (CRM) system so the request can be tracked. That system is hosted on Vevona infrastructure and access is limited to authorised staff.
Beyond that, disclosures are limited to:
- our hosting and infrastructure providers — solely for the purpose of storing the data.
- our email delivery provider — so that we can reply to you.
- competent public authorities — only where required by law.
As Vevona has offices in Tallinn, London and Delaware, your data may be transferred abroad under Article 9 of the KVKK if your enquiry concerns the team in that country. Such a transfer is based on the explicit consent you give when submitting the form or on the other conditions set out in the applicable legislation.
Current list of service providers used and the countries they operate in: [to be completed]
7. Retention Period
- Form enquiries: 3 years from the last contact, if no business relationship is established.
- If a business relationship is established: for the limitation periods set out in the applicable legislation from the end of the contract (as a rule, 10 years).
- Job applications: 1 year from the assessment of the application.
- Security records (IP address, browser information): 1 year.
Once the period expires, or when you withdraw your consent, your data is deleted, destroyed or anonymised.
8. Your Rights under Article 11 of the KVKK
As a data subject you have the following rights:
- To learn whether your personal data is being processed,
- To request information about it if it has been processed,
- To learn the purpose of processing and whether the data is used accordingly,
- To know the third parties in Türkiye or abroad to whom the data is transferred,
- To request correction if the data has been processed incompletely or incorrectly,
- To request erasure or destruction within the conditions of Article 7 of the KVKK,
- To request that corrections, erasures and destructions be notified to the third parties the data was transferred to,
- To object to an adverse outcome produced solely by automated analysis of your data,
- To claim compensation if you suffer damage due to unlawful processing.
9. How to Submit a Request
You can submit requests concerning your rights in line with the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller:
- In writing, together with documents verifying your identity: Folkart Towers Tower A, Floor 35, No:3509, Bayraklı, İzmir
- From the email address registered in our system: [email protected]
- By secure electronic signature or registered electronic mail (KEP): [to be completed]
Depending on its nature, your request is concluded free of charge within 30 days at the latest. If the process incurs an additional cost, the fee set in the tariff of the Turkish Personal Data Protection Board may be charged.
10. Changes
This notice may be revised due to legislative changes or updates to our processes. The current version is always published on this page.
This text is a draft based on the data actually collected on this site. Before it goes live, the fields marked in square brackets must be completed and the whole text reviewed and approved by a legal adviser. Retention periods and disclosure lists must be confirmed against your company policy.