Data Protection Notice (KVKK)

Data controller

Under Personal Data Protection Law No. 6698 ("KVKK"), the data controller is Abdullah Şahan, operating under the Şahan Design brand. Requests and contact: hello@sahandesign.com.

Data processed and purpose

Identity and contact details (name, email, phone) and message content submitted through the contact and quote forms are processed to assess your enquiry, provide a quote and communicate with you. For applications that come from an ad, it is also processed to measure the result of that ad.

When you place an order, we also process your billing details (individual or company name, tax details, address), the contents of your order and records relating to your payment method (amount, date, order number). We do NOT store your card details. Payments are processed through the infrastructure of a licensed payment institution.

Legal basis and transfer

Data is processed on the legal grounds of the establishment or performance of a contract and of legitimate interest. To provide the service, it is shared on a limited and purpose-bound basis with the following service providers: hosting and database infrastructure (Vercel and Supabase, whose servers may be located abroad), payment infrastructure (a licensed payment institution), SMS notifications (NETGSM), email communication (Google Workspace) and advertising measurement (Google Ads and Google Tag Manager: the ad click ID and, from the application form, a hash of your email address and phone number. Meta: visits, applications and contact clicks on the Digital Renewal page, the same hashes, your IP address and browser information. Servers are located abroad). The transfer made for AI-assisted tools and WhatsApp messaging is described in the next section. Apart from this, it is not shared with third parties except to comply with legal obligations.

When you sign in by phone, the verification SMS sent to your number is part of the performance of the service and has no marketing purpose.

AI-assisted tools and communication via WhatsApp

We use AI-assisted tools to prepare draft replies in project correspondence, to organise project information and to carry out the website design and coding process. For these purposes we process the content of correspondence, the files you share, and your brief and project details.

National ID numbers, card numbers, IBANs and passwords are masked before any content is sent to an AI tool. When draft replies are prepared, phone numbers and email addresses are masked as well. In the website design and coding process, phone numbers and email addresses are not masked. The contact details that will appear on your website are used in this process.

AI only prepares drafts. Every reply sent to you and every change to your website is checked by our team before it is sent or published. No decision about you is made solely on the basis of automated processing. Draft replies are deleted after ninety days.

When you write to our business line on WhatsApp, your message is saved to your correspondence in the client panel. Messages from a number that does not match a registered account are kept for no more than seven days so that we can match you with the right project, and are then deleted. Using this channel is your choice.

The AI service is provided by Anthropic PBC (United States) and WhatsApp messaging by Meta Platforms (WhatsApp Business Platform). The source code of websites is stored on GitHub (United States). The data described in this section and the phone number you use on WhatsApp are processed on the providers' servers abroad. The AI service provider does not use this data to train its models. We do not use your WhatsApp conversations to train AI models.

This processing is based on the establishment and performance of a contract and on our legitimate interest (Article 5(2)(c) and (f) of the KVKK). You can exercise your rights under Article 11 of the KVKK, including the right to object to a result against you that arises from your data being analysed solely by automated systems, by writing to the address given in the "Rights of the data subject" section.

Retention period

Your personal data is kept for as long as the purpose of processing requires and for the limitation periods set out in the relevant legislation, and is then deleted or anonymised.

Rights of the data subject

Under Article 11 of the KVKK, you have the right to access your data, to request its correction or deletion and to object to its processing. You can send your requests to hello@sahandesign.com.