Scope of this policy
This policy covers data processing that happens through the website at morfaxis.com.tr. The detailed statutory notice required by Article 10 of Turkish Law No. 6698 (KVKK) is a separate document: the Data Protection Notice. The two do not replace each other — this policy summarises the approach, the notice performs the legal disclosure.
For visitors in the European Union, the information required by GDPR Article 13 is covered by the same two documents; your additional rights under the GDPR are set out below.
Our basic approach
- We collect only what is needed and do not ask for fields we have no use for.
- Our decision tools run entirely in your browser; we never ask for an e-mail to show a result, and your answers never reach our server.
- Fonts are served from our own server; no request goes to a third-party font network.
- No analytics or marketing script runs before you consent.
- We do not sell, rent or share your personal data for advertising.
- We carry out no automated decision-making and no profiling.
What we collect, and how
Personal data reaches us in two ways. Stated with the precision the Turkish notice regulation requires:
- Non-automated, directly from you: the name, work e-mail, phone, company, role, website and free-text description you choose to enter into the site's forms.
- Partly automated: standard web-server access logs (IP address, browser and operating system, request time, requested path) together with submission timestamps and anti-spam data.
We neither request nor process special categories of data (health, biometrics, religion, trade-union membership and the like). Please do not enter such information into the forms.
Purposes and legal bases
The basis relied on is stated separately for each purpose:
| Purpose | GDPR basis | KVKK basis |
|---|---|---|
| Assessing and answering your enquiry | Art. 6(1)(b) pre-contractual steps | Art. 5/2-(c) |
| Scheduling a fit call, preparing a proposal | Art. 6(1)(b) | Art. 5/2-(c) |
| Keeping records of enquiries, legal obligations | Art. 6(1)(c) | Art. 5/2-(ç) |
| Site security, abuse and spam prevention | Art. 6(1)(f) legitimate interests | Art. 5/2-(f) |
| Sending service and content updates by e-mail | Art. 6(1)(a) consent — separate checkbox | Art. 5/1 |
| Analytics measurement (Google Analytics 4) | Art. 6(1)(a) consent — cookie notice | Art. 5/1 |
You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out beforehand. Access to our services is not conditional on consenting.
Who receives the data
We do not sell your data and do not share it with third parties for marketing. Transfers are limited to the following recipient groups and to the stated purpose only:
- Form delivery provider (processor): to deliver the form contents to us. Its servers are outside Türkiye.
- Hosting and e-mail providers (processors): to publish the site and carry on correspondence.
- Analytics provider (processor): only if you consented, to measure usage.
- Competent public authorities: only where a legal request or obligation exists, limited to its scope.
Processors are engaged under contracts requiring them to process data only on our instructions and to apply appropriate security measures.
International transfers
The form delivery service and the analytics service (Google Analytics 4) are provided from servers outside Türkiye, so data sent through those channels is transferred abroad. Transfers are carried out within the conditions set by Article 9 of the KVKK and, for EU personal data, Chapter V of the GDPR.
If you would rather no data left the country through a form, you do not have to use one: write to iletisim@morfaxis.com.tr or call 0540 548 26 97. No third-party form infrastructure is involved in those channels.
Retention periods
| Data | Period | Criterion |
|---|---|---|
| Form enquiries and correspondence | 24 months | From last contact, where no engagement follows |
| Enquiries that become contracts | 10 years after the contract ends | Turkish Code of Obligations limitation period |
| Server access logs | 12 months maximum | Security and error tracing |
| Marketing consent records | Until consent is withdrawn | Kept for a reasonable period afterwards as proof of withdrawal |
At the end of the period data is deleted, destroyed or anonymised.
Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21), as well as the right to withdraw consent at any time.
Under Article 11 of the KVKK you may learn whether your data is processed; request information about it; learn the purpose and whether it is used accordingly; know the third parties it is transferred to at home or abroad; request correction, deletion or destruction; require those actions to be notified to recipients; object to a result produced solely by automated analysis; and claim compensation for damage caused by unlawful processing.
How to apply, and the time limits, are set out in the Data Protection Notice. We respond within 30 days at the latest. If you are not satisfied you may complain to the Turkish Personal Data Protection Board, or — if you are in the EU — to your national supervisory authority.
Security measures
The site is served over HTTPS only and enforces encrypted connections with HSTS. A Content Security Policy blocks third-party scripts from loading into the page. Instead of a CAPTCHA the forms use an invisible honeypot field and a timing threshold, which protects against spam without harming accessibility. Access to submitted data is limited to the people assessing the enquiry. Should a data breach occur, the Board and the affected individuals are notified within the periods the law prescribes.
Children's data
This is a corporate B2B site and is not directed at anyone under 18; we do not knowingly collect data from that age group. If we become aware that a child's data has been submitted, we delete it without delay.
Changes
When the policy changes, the update date on this page changes with it. If the purpose of processing changes, a fresh notice is given for the new purpose and consent is sought again where required. Users who opted into updates are informed by e-mail of significant changes.
