1. Data controller
The data controller for this site is Fatih Çalışan, a natural person trading as Algoriel.
Algoriel is a trading name and not a legal entity.
Name: Fatih Çalışan
Brand: Algoriel
Postal address: Ferhatpaşa Mah. Gülendam Sk. Kiptaş K No: 6 K İç Kapı No: 1 Çatalca / İstanbul
Email: info@algoriel.io
Phone: +90 541 565 89 96
Hosting location: Frankfurt, Germany
We publish this notice under Article 10 of Law No. 6698 and the Communiqué on the Procedures and Principles to be Followed in Fulfilment of the Duty to Inform.
This notice is not a consent text. Reading it is not consent or acceptance. The one explicit consent this site asks for is permission for measurement cookies, taken on the band at the foot of the page; refusing it starts and stops nothing else described here.
2. Personal data we process
The table below lists all personal data we process.
| Category | Data | Source |
|---|---|---|
| Identity | Name and surname | Quote form, email |
| Contact | Email address, phone number (optional) | Quote form, email |
| Business information | Organisation name, sector, organisation size, web address, all optional | Quote form |
| Request content | Project type, project description, budget range, timeline, language preference | Quote form |
| Uploaded documents | Content and file names of the documents you attach (PDF, DOC, DOCX) | Quote form |
| Transaction security | IP address and its SHA-256 hash, submission time, reference code, server access log (IP address, requested address, browser information, referrer, time), bot check result | Browser to server connection, fully automated |
| Google Analytics measurement data | The visitor identifier in the cookie, the page address and title, the referring address, device and browser information, approximate location | Only if you allow measurement cookies; the connection between your browser and Google |
| Aggregate measurement data | Page address, page title, referrer, browser and operating system type, device type, screen size, language, country, and a visitor hash that cannot be traced back to a person | Browser to measurement server connection |
We do not ask for special categories of personal data. Please keep health data, religious belief, political opinion and biometric data out of the documents you upload. If such data reaches us by mistake, we read it only to assess your request, process it no further and delete it with the document.
3. Purposes and legal bases
Every processing here rests on a ground in Article 5(2) of Law No. 6698, with one exception. Google Analytics measurement rests on the explicit consent in Article 5(1), which we ask for on the band at the foot of the page.
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Receiving, assessing and answering your quote request, and pre-contract discussions | Identity, contact, business information, request content, uploaded documents | Article 5(2)(c), directly related to the conclusion of a contract; and Article 5(2)(f), our legitimate interest, for an employee or officer writing for an organisation | Six months from the last contact; documents 90 days; statutory periods if work starts |
| Keeping the site and form secure, preventing misuse and automated submissions | IP address and its hash, submission time, reference code, access log, bot check result | Article 5(2)(f), our legitimate interest, and the data security duty in Article 12 | Access log 30 days; rate counter one hour; IP address and time in the notification email follow the quote record |
| Measuring use of the site through Google Analytics | Google Analytics measurement data | Article 5(1), your explicit consent | 14 months |
| Measuring use of the site in aggregate | Aggregate measurement data, with no IP address kept | Article 5(2)(f), our legitimate interest in measuring use | 25 months |
| Meeting legal duties; establishing, exercising or defending a right | The relevant records above | Article 5(2)(ç) and Article 5(2)(e) | The statutory period that applies |
| Continuing the activity through a successor after a transfer | The records held at the time of transfer | Article 5(2)(c) and Article 5(2)(f) | The successor cannot exceed the periods in this table |
4. How we collect your data
We collect your data through the quote form, the only part of this site through which you send us information yourself.
Your browser and our server produce the security and measurement records by fully automated means, and a Google Analytics record is produced the same way if you have allowed measurement cookies. Email you write to us or we write back sits in our mailbox, processed by partly automated means.
We collect no data from other sources, buy no data and take none from social networks.
The box on the fourth step of the form confirms that you have read this notice. It is not consent or acceptance, and ticking it does not change the legal bases above.
5. Transfers
We share your personal data with these recipients and nobody else.
- Hosting provider: hosts our mailbox and the server located in Frankfurt, Germany, can reach the data technically but does not use it for its own purposes. This is a transfer abroad, and Article 9(4)(c) of Law No. 6698 carries the safeguard we apply to it.
- Competent public authorities, the courts, the public prosecutors and the Turkish Personal Data Protection Board (the Board): only on a written request that rests on law and within its scope, under Article 5(2)(ç). This recipient is inside Türkiye.
- The successor legal entity if the business is transferred, so that the business can continue and our obligations to you are carried on. This rests on Article 8, is announced 30 days in advance, and the successor issues its own notice.
Our server and our mailbox sit abroad. For that transfer we look first for a condition in Article 5(2) of Law No. 6698, and then we add the safeguard in Article 9(4)(c).
The transfer to Google stands apart: if you allow measurement cookies, the data goes to Google Ireland Limited and Google processes it across its own infrastructure, which includes the United States. Its basis is the explicit consent in Article 9(5) of the Law, and without that consent nothing is sent.
No adequacy decision exists for any country, so we rely on the standard contract published by the Board. We have signed that contract with our hosting provider and notified it to the Personal Data Protection Authority (the Authority). We do not rely on your explicit consent for a repeating transfer.
We transfer your data to nobody else. We send nothing to advertising networks, data partners or social media platforms, and we sell no data.
6. Retention and erasure
We keep each record only as long as its purpose lasts.
- The quote request record, the notification email in our mailbox: six months from the last contact.
- Documents you upload, held in a private directory closed to the internet: 90 days, then deleted automatically.
- The server access log: 30 days.
- The submission rate counter, a file named after the SHA-256 hash of the IP address: one hour.
- The bot check record, the hash of a used solution, holding no personal data: ten minutes.
- Aggregate visit measurement, which keeps no IP address: 25 months.
- Google Analytics measurement: 14 months, and only if you allow it.
- Email correspondence in our mailbox: six months from the last contact.
- Records of a relationship that became a contract, in the project file: ten years under Article 146 of the Turkish Code of Obligations (Law No. 6098), and ten years for commercial books and documents under Article 82 of the Turkish Commercial Code (Law No. 6102).
When the reason for keeping a record falls away, we erase it within three months at the latest. When you ask us to erase your data, we act within 30 days, and our mailbox follows the same calendar.
7. Your rights and how to apply
Article 11 of Law No. 6698 gives you rights over your personal data, which you exercise by applying to us. The full list is in section 9 of the Privacy Policy.
You can apply in writing, with a wet signature, to Ferhatpaşa Mah. Gülendam Sk. Kiptaş K No: 6 K İç Kapı No: 1 Çatalca / İstanbul, or write to info@algoriel.io from the email address you have already given us and we hold on file.
Under Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller, your application needs to carry:
- your name and surname, and your signature on a written application;
- your identity number if you are a citizen of the Republic of Türkiye, or, if you are a foreign national, your nationality and passport number or the identity number you hold;
- your address for service, at home or at work;
- your email address and phone number for notification, if you gave them;
- the subject of your request.
We answer as soon as we can, within 30 days at the latest. A written answer is free up to ten pages. Above that, the fee set in the Communiqué, which is 1 TL per page, may be charged. An answer on a recording medium costs no more than the medium.
If we refuse your application, if our answer is not enough or if none arrives within 30 days, you can complain to the Board under Article 14. The limit is 30 days from the day you learn our answer, and in any event 60 days from your application. That route opens only after you apply to us.
If you write from the European Union or the United Kingdom, we answer within one month. You can complain to your local data protection authority, the Information Commissioner's Office in the United Kingdom, or to the Board.
If a personal data breach affects you, we notify the Board within 72 hours at the latest and tell the people concerned as soon as we reasonably can, as Article 12(5) requires. The notification says what happened, which data it touched, the likely consequences, the measures we took and where to reach us.
8. Effect and updates
This notice takes effect on 15 September 2026, which is also its version name, and we publish it at https://algoriel.io in Turkish and English.
If the notice changes, we update the date and version name. A new version applies from the day we publish it and does not reach backwards.
If our purposes change, we inform you again before the new processing starts.
If the business is transferred, the successor issues its own notice.
If you have a question about this notice, write to the data controller Fatih Çalışan at info@algoriel.io.