Privacy Policy

1. Who we are and what this policy covers

This site at https://algoriel.io is published by Fatih Çalışan, trading as Algoriel.

Algoriel is a brand name and not a legal entity, so the person named above answers for the site and for the data described here.

Law No. 6698 on the Protection of Personal Data, known in Türkiye as KVKK, makes that person the data controller. We call it the Law below.

This policy covers the Turkish and English pages of this site, the quote form, and the email correspondence that starts from the site.

It does not cover work carried out under a signed contract, which carries its own terms and its own notice.

It does not cover the sites we link to, which we do not run.

If a sentence here conflicts with our KVKK Notice, the KVKK Notice prevails.

Turkish law governs this policy. If you write from the European Union or the United Kingdom, we apply the equivalent rights voluntarily, and section 9 sets out how.

2. What data we process

Your data reaches us from three sources: the quote form, where you type it yourself; the fully automated connection between your browser and our server; and email correspondence. The table below names everything we hold.

The form requires your name, your email address, at least one project type and a project description. Every other field is optional.

Uploading a document is optional. The form accepts PDF, DOC and DOCX files, at most 5 files, each at most 10 MB.

We do not ask for special categories of personal data, meaning health data, religious belief, political opinion and biometric data, and we ask you to keep them out of your documents. If this kind of data reaches us by mistake, we read it only to assess your request, we do not process it further, and we delete it with the document.

We do not collect or use any of the following.

• Advertising and tracking cookies, under any circumstance. The only cookies that can reach your browser are measurement cookies, and they are written only after you allow them. Section 5 sets out what they are.
• Advertising or marketing data.
• Profiling that shows you different content, a different price or a personalised advertisement.
• Special categories of personal data. We do not ask for them, and the paragraph above says what happens if they reach us by mistake.
• Data about children. We offer no services to children and do not knowingly collect their data.
• Third party code without your permission. Until you allow measurement cookies, no code that is not ours runs on this site and your browser calls no outside domain.
• Social media measurement pixels.
• Location data finer than country level.
• Data bought from data brokers or gathered from social networks.
• Automated decision-making.

3. Why we process your data and our legal bases

Every processing here rests on a ground in Article 5(2) of the Law, with one exception. Measurement through Google Analytics rests on your explicit consent, which we ask for on the band at the foot of the page. Refusing it stops that measurement and changes nothing else.

When we answer your quote request, that answer replies to a request you made yourself. It is not a commercial electronic message. We send no marketing or campaign email.

When you send the form, the screen shows you a reference code. We do not send you an automatic confirmation email; the reply comes from us and it is written by hand.

The quote form carries two boxes at its fourth step. One confirms that you accept the Terms of Use, the other that you have read the KVKK Notice. Neither box is consent to processing, and we treat neither as consent.

Our processing rests on the legal bases in the table above, not on those boxes. Unticking a box does not stop it: processing stops when the legal basis falls away. Section 9 explains how to ask for erasure or for anything else.

Readers in the European Union or the United Kingdom may find this mapping useful. Answering a quote request matches Article 6(1)(b) of the General Data Protection Regulation, contract and the steps before it. Security, the submission rate limit and aggregate measurement match Article 6(1)(f), legitimate interest. Meeting a legal duty matches Article 6(1)(c).

We give that mapping voluntarily. It does not mean the Regulation governs this site.

4. Who receives your data and transfers abroad

The list below names every recipient. We share personal data with nobody else.

• Hosting provider: it hosts our mailbox and the server located in Frankfurt, Germany. It can reach the data on a technical level and does not process it for its own purposes.
• Public authorities with the power to ask, meaning courts, public prosecutors and the Turkish Personal Data Protection Board (the Board). We answer only a written request that rests on a legal provision, and only within its scope. The legal basis is Article 5(2)(ç) of the Law.
• The successor, if the business is transferred, so that the business can continue and our obligations to you are carried on. We announce the transfer 30 days in advance, the step rests on Article 8 of the Law, and the successor issues its own notice.

We share nothing with advertising networks or social media platforms. We run no data partnership and sell no data. Google Analytics is the one analytics vendor we use, and only if you allow measurement cookies.

Our server and our mailbox sit in Germany, so hosting your data is a transfer abroad under the Law.

The records held abroad are the quote notification emails, the email correspondence, the uploaded documents, the server access log, the submission rate counter and the aggregate measurement data.

Allowing measurement cookies adds one more transfer. Google Analytics data goes to Google Ireland Limited, and Google processes it across its own infrastructure, which includes the United States. Refuse the cookies and that transfer never arises.

We meet a condition in Article 5(2) of the Law first, then add a safeguard on top. The safeguard is the one in Article 9(4)(c) of the Law: the standard contract published by the Board. We have signed that contract with our hosting provider, and we have notified it to the Personal Data Protection Authority (the Authority).

There is no adequacy decision for any country, so we rely on none. We do not use explicit consent for the repeating transfer to our hosting provider.

The transfer to Google stands apart. Its basis is the explicit consent in Article 9(5) of the Law, which is why we ask for it in advance and separately. Without that consent, nothing is sent.

Three points matter for readers in the European Union or the United Kingdom. Data you send to us directly is not a transfer under European Union or United Kingdom rules, because you are the one who sends it. There is no European Union adequacy decision for Türkiye. Our safeguard towards the hosting provider is the standard contract described above.

5. Cookies, local storage and visit measurement

There is one measurement on this site: Google Analytics. It sets cookies, sends data to Google, and runs only if you allow it.

Until you allow it, nothing is written to your browser as a cookie and your browser calls no Google domain. You give permission on the band at the foot of the page, and you can take it back at any time with the switch in section 3 of the Cookie Policy.

Allow it and the Google Analytics measurement tag loads and writes two cookies:

• _ga: holds the identifier that tells one visitor from another. It lasts two years.
• A second cookie whose name starts with _ga: holds the state of your session. It lasts two years.

Both are written to our own domain, but what they carry goes to Google: the address and title of the page you are on, the referring address, device and browser information, an approximate location, the visitor identifier in the cookie, and the name of the interaction event you triggered (for example "quote form submitted"). No personal data such as an email address, phone number or reference code is sent to Google. We set the retention period in our Google Analytics account to 14 months.

Advertising measurement, remarketing and advertising identifier collection stay switched off. We do not share the measurement data with advertising networks and we do not sell it.

Take your permission back and three things happen: your decision is recorded, the cookies Google Analytics wrote are deleted, and the tag never loads again. Clear your browser data and the decision goes too, so the band asks once more.

The quote form runs a bot check called ALTCHA. Your browser takes a short-lived calculation task from our server, solves it and sends the solution with the form. The task expires after ten minutes.

Our server checks the solution, the signature and the time, and refuses the same solution twice. Nothing is written to your browser, no third party takes part and no request leaves for an outside domain. The request for the task lands in our normal server access log.

6. How we protect your data

We apply the measures below.

• All traffic runs over HTTPS.
• Every field is validated on the server, not only in your browser.
• Uploaded documents sit in a private directory that the web server closes to the internet, under a random name, with permissions that let only the server account read and write.
• Uploaded documents cannot be reached from the internet by address, and only the operator reads them on the server.
• The file type is checked against the content of the file, not against the file name.
• There is no database, which keeps the attack surface small.
• Error logs carry no personal data; on an upload failure they record only the reference code and the file's sequence number.
• If an unexpected error occurs, the screen shows no technical detail.
• The submission rate counter holds a hash of the IP address and never the address itself.
• A submission rate limit and a bot check guard the form.
• The form carries a hidden field that a person never sees. If it arrives filled in, the submission is discarded silently: nothing is recorded, no email is sent and no file is kept.
• The server access log is deleted after 30 days.
• Uploaded documents are deleted automatically after 90 days.
• Apart from the technical access of the hosting provider described in section 4, only Fatih Çalışan reaches the mailbox and the server.

If a personal data breach happens, we notify the Board within 72 hours at the latest, as Article 12(5) of the Law requires. We notify the people affected as soon as it is reasonably possible.

A breach notification says what happened, which data was involved, the likely consequences, the measures we took, and where to reach us.

7. How long we keep your data

We keep each record only as long as its purpose lasts.

One period does not stretch another. Your uploaded documents are deleted after 90 days even while the quote record still sits in our mailbox.

When the reason for keeping a record disappears, we erase it within three months at the latest. The Regulation on the Deletion, Destruction or Anonymisation of Personal Data sets that period in its Article 11.

When you ask us to erase a record, we act within 30 days at the latest. The mailbox follows the same calendar.

8. If the business is transferred

The business may become a legal entity or pass to one. Our relationship with you can then pass to the successor.

You give permission for that step in advance through the Terms of Use, and the permission covers that case alone.

Our commitments and safeguards do not shrink in a transfer. The successor cannot keep your data longer than the periods in section 7.

What passes to the successor is limited to the records we hold at the moment of transfer. A transfer does not bring back a record we already erased.

We announce a transfer on the site at least 30 days beforehand, and by email where we hold your address.

If you would rather not continue, you can end the relationship and ask us to erase your data.

Until the transfer takes effect, the data controller does not change and this policy keeps applying.

On the data protection side, the transfer to the successor rests on Article 5(2)(c) and Article 5(2)(f) of the Law, is carried out under Article 8, and follows the announcement above. The successor then issues its own notice.

9. Your rights and how to use them

Article 11 of the Law gives you the rights below.

• (a) to learn whether we process your personal data;
• (b) to ask for information about that processing, if we have processed your data;
• (c) to learn the purpose of the processing, and whether your data is used in line with that purpose;
• (ç) to know the third parties inside Türkiye or abroad to whom your data has been transferred;
• (d) to ask for correction, if your data is incomplete or wrong;
• (e) to ask for erasure or destruction of your data within the conditions in Article 7 of the Law;
• (f) to ask us to report a correction or an erasure to the third parties your data was transferred to;
• (g) to object to a result reached against you through analysis carried out solely by automated systems;
• (ğ) to ask for your loss to be made good, if you suffer damage because your data was processed against the Law.

We carry out no automated decision-making. No decision about you comes out of an automated system.

You can apply through two channels.

• In writing to Ferhatpaşa Mah. Gülendam Sk. Kiptaş K No: 6 K İç Kapı No: 1 Çatalca / İstanbul, with your wet signature.
• By email to info@algoriel.io, from the email address you gave us earlier and that our records hold.

Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller sets out what an application must carry.

• Your name and surname.
• Your signature, when the application is on paper.
• Your identity number, when you are a citizen of the Republic of Türkiye.
• Your nationality and passport number, or your identity number where you hold one, when you are a foreign national.
• The address of your home or your workplace for service.
• Your email address and telephone number, where you gave them for notification.
• The subject of your request.

We answer as soon as we can, and within 30 days at the latest.

A written answer is free up to ten pages. Above ten pages we can charge the fee set in the Communiqué, 1 TL per page. On a recording medium, the charge does not exceed the cost of that medium.

You can complain to the Board under Article 14 of the Law if we refuse your application, if our answer does not satisfy you, or if we do not answer within 30 days. You have 30 days from the day you learn our answer, and 60 days from your application date in every case. The route to the Board opens only after you apply to us.

If you write to us from the European Union or the United Kingdom, we apply the equivalent rights voluntarily. Those rights are access, rectification, erasure, restriction, objection and portability. We answer within one month.

You can also complain to your local data protection authority, the Information Commissioner's Office in the United Kingdom, or to the Board.

10. Changes to this policy

We change this policy for four reasons only: a change in the law, a change in how the site works, a change in a recipient or a retention period, and the correction of an error.

Every version carries a date, and that date names the version. The version you are reading dates from 15 September 2026.

A change does not reach backwards. The version that applies to a quote request is the one in force when you sent it.

The versions of the Terms of Use and the KVKK Notice you accepted, and the moment of acceptance, are kept in the notification record that reaches our mailbox with your request.

A change to this policy does not change the version of the Terms of Use you accepted earlier in the quote form.

We send you an earlier version if you ask for it.

If the purpose of processing changes, we publish a new notice before acting on it.

11. Contact and operator details

You can send questions about this policy, and applications under the Law, to the addresses below.

The lines below are the site operator details.

Name: Fatih Çalışan

Brand: Algoriel

Postal address: Ferhatpaşa Mah. Gülendam Sk. Kiptaş K No: 6 K İç Kapı No: 1 Çatalca / İstanbul

Email: info@algoriel.io

Phone: +90 541 565 89 96

Hosting location: Frankfurt, Germany