Who we are
Aktays is an independent design studio based in Istanbul, Türkiye. For the purposes of the Turkish Personal Data Protection Law No. 6698 (KVKK) we are the data controller (veri sorumlusu), and for the purposes of the EU General Data Protection Regulation (GDPR) we are the controller of the personal data described below.
- Legal name
- [Registered company name]
- Registered address
- [Street address], [District], Istanbul, Türkiye
- Trade registry no.
- [Trade registry number]
- Tax office
- [Tax office]
- Tax number
- [Tax number]
- privacy@aktays.com
What this policy covers
This policy covers personal data we process through this website. It does not cover data we process under a signed client contract — that is governed by the data processing terms in the contract itself.
What we collect
Information you give us. If you submit the enquiry form, we receive your name, email address, company name, the project type, budget range and timeline you select, and whatever you write in the message field. Nothing on the form is collected covertly — what you can see is what we receive.
Information collected automatically. Our hosting provider records standard server logs for every request: IP address, timestamp, requested URL, referring page and user-agent string. These are generated by the infrastructure for security and reliability purposes, not by tracking code we have added.
Cookies. This site sets one cookie, and only when you actively choose a language. Full detail is in our Cookie Policy.
What we do not collect
We want to be specific about this, because most privacy policies are not. This website runs no analytics, no advertising pixels, no session recording, no heatmaps, no A/B testing tools and no third-party tracking scripts of any kind. We do not build a profile of you, and we do not sell or share data with advertisers, because we do not have any to sell.
Why we use it, and our legal basis
- To reply to your enquiry and to have the conversation that follows. Legal basis: performance of, or steps prior to entering into, a contract (GDPR Art. 6(1)(b)); KVKK Art. 5(2)(c).
- To keep the site secure, available and free of abuse. Legal basis: our legitimate interest in operating a functioning website (GDPR Art. 6(1)(f)); KVKK Art. 5(2)(f).
- To remember your language choice. Legal basis: our legitimate interest in the site working as you expect (GDPR Art. 6(1)(f)). This cookie is strictly functional and is set only when you pick a language.
- To meet accounting and tax obligations, if you become a client. Legal basis: compliance with a legal obligation (GDPR Art. 6(1)(c)); KVKK Art. 5(2)(a).
Who we share it with
We use a small number of service providers, each acting as a processor on our instructions. We do not share your personal data with anyone else.
Our typefaces are served from this domain rather than a font CDN, so simply loading a page sends nothing to any third party.
- Vercel Inc. — website hosting and server logs.
- Resend (Plus Five Five, Inc.) — delivery of enquiry emails sent through the form.
- Our email provider — because your enquiry arrives in, and remains in, our inbox.
International transfers
Our providers listed above operate infrastructure outside Türkiye and, in some cases, outside the European Economic Area. Where personal data is transferred out of the EEA, those transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by the provider. For transfers abroad under KVKK, we rely on your explicit consent where required, or on the conditions permitted by Art. 9 of the KVKK.
How long we keep it
- Enquiries that do not become projects: up to 24 months, so we have context if you come back to us, then deleted.
- Enquiries that become projects: for the duration of the engagement and for as long afterwards as Turkish tax and commercial law requires us to retain the records — generally 10 years.
- Server logs: retained by our hosting provider on a short rolling window, typically no more than 30 days.
- The language cookie: 12 months, or until you clear it.
Your rights
Under the GDPR you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on it.
Under Art. 11 of the KVKK you have the right to learn whether your data is processed, to request information about it, to learn its purpose and whether it is used accordingly, to know the third parties it is transferred to, to request correction or deletion, to require that correction or deletion be notified to those third parties, to object to a result produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing.
How to exercise them
Email us and we will respond within 30 days, as both the GDPR and the KVKK require. We may ask you to confirm your identity before acting on a request, but only where we genuinely cannot otherwise be sure who is asking.
If you are unhappy with our response, you can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr), or — if you are in the EEA — to the supervisory authority in your country of residence.
Security
The site is served over HTTPS. Enquiry submissions are validated and rate-limited on the server before being sent on. Access to our inbox is protected by multi-factor authentication. No system is perfectly secure, and we would rather say that plainly than imply otherwise.
Children
This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.
Changes to this policy
If we change how we handle personal data, we will update this page and the date at the top of it. Material changes will be described here rather than quietly absorbed into the text.