Scope and commitment
KuarkTek Digital designs and builds websites, brands, campaigns, content and digital applications for organisations in Türkiye and abroad. Our work regularly involves personal data: the contact details of the people we talk to, the materials our clients share, and the data that flows through the products we build.
We apply the GDPR (Regulation (EU) 2016/679) to the personal data of people in the European Economic Area, the UK GDPR to people in the United Kingdom, and the Turkish Personal Data Protection Law No. 6698 (KVKK) to everyone. Where the laws differ, we follow the stricter rule.
The principles we follow
Every processing activity at KuarkTek is measured against the principles in GDPR Art. 5 and KVKK Art. 4:
- Lawfulness, fairness and transparency — we process data only on a recognised legal basis and tell people what we do.
- Purpose limitation — data collected for one purpose is not reused for an incompatible one.
- Data minimisation — we ask for what the work needs, and no more. Our enquiry forms are an example: a name, an email address and a description are enough to start.
- Accuracy — we correct or delete inaccurate data when we learn of it.
- Storage limitation — we keep data only for the periods in our Privacy Policy.
- Integrity and confidentiality — we protect data with the technical and organisational measures described below.
- Accountability — we document what we do and can show it.
Our roles: controller and processor
As a controller, KuarkTek decides why and how personal data is processed. This applies to visitors to kuarktek.digital, to the people who contact us, and to our clients' representatives. The Privacy Policy describes this processing in full.
As a processor, KuarkTek processes personal data on a client's documented instructions: for example, when we run a client's newsletter, manage a campaign audience, host a website whose forms collect the client's customer data, or film and photograph the client's staff. In that role we:
- process data only on the client's written instructions, including for transfers outside the EEA or Türkiye;
- sign a data-processing agreement that meets GDPR Art. 28 and KVKK requirements when the client requests one, or offer ours;
- make sure the people who handle the data are bound by confidentiality;
- apply the security measures agreed with the client;
- engage sub-processors only with the client's general or specific authorisation and on equivalent terms;
- help the client respond to data-subject requests and to its own security and impact-assessment duties;
- delete or return the data at the end of the engagement, unless the law requires us to keep it;
- make available the information needed to demonstrate compliance and allow audits on reasonable notice.
Lawful bases we rely on
| Basis | GDPR | KVKK | Typical use at KuarkTek |
|---|---|---|---|
| Contract | Art. 6(1)(b) | Art. 5(2)(c) | Replying to enquiries, proposals, delivering projects |
| Legal obligation | Art. 6(1)(c) | Art. 5(2)(a), (ç) | Invoicing, tax and commercial record-keeping |
| Legitimate interests | Art. 6(1)(f) | Art. 5(2)(f) | Site security, spam prevention, keeping in touch with clients |
| Consent | Art. 6(1)(a) | Art. 5(1) | Publishing testimonials, case studies and portraits; any non-essential cookies |
We do not process special categories of personal data (such as health, biometric or political data) unless a project specifically requires it and a lawful basis under GDPR Art. 9 and KVKK Art. 6 is established first.
Data-subject rights
People whose data we process can exercise the rights listed in GDPR Arts. 15–22 and KVKK Art. 11: access, rectification, erasure, restriction, portability, objection, rights relating to automated decisions, and withdrawal of consent. The full list, and how to make a request, is in the Privacy Policy.
Our procedure for every request:
- We acknowledge the request and, if necessary, verify the requester's identity.
- We locate the data across our mailbox, project tools and files.
- We respond within one month (GDPR) or 30 days (KVKK), and explain any extension or refusal with reasons and the right to complain.
- Where we act as a processor, we forward the request to the client controller without delay and assist it in responding.
Security measures
Our technical and organisational measures include:
- Transport and access: HTTPS on all sites we operate; strong, unique passwords and multi-factor authentication on mailboxes, hosting panels, repositories and collaboration tools; access limited to the people who need it.
- Forms and servers: input validation, size limits, same-origin checks and rate limiting on enquiry forms; source files, drafts and internal documents excluded from public web servers; hosting access restricted by SSH keys.
- Storage: client materials kept in access-controlled workspaces, not on shared drives or personal devices; devices encrypted; regular backups of project files.
- People: every team member and freelancer who touches client data is bound by a confidentiality agreement and briefed on this policy.
- Review: we revisit these measures when tools change and at least once a year.
Personal-data breaches
If we become aware of a breach affecting personal data we hold as a controller, we assess the risk immediately, contain it, and — where the breach is likely to result in a risk to people's rights — notify the competent authority within 72 hours (GDPR Art. 33) or without delay and within 72 hours of learning of it (KVKK Board decision 2019/10), and the affected people where the risk is high. Where we act as a processor, we notify the client controller without undue delay and support its notifications.
Data-protection impact assessments
Before starting a project that involves large-scale, sensitive or novel processing — for instance, an application that profiles users or an AI-assisted production that uses people's likeness or voice — we assess the risks to the people concerned and agree mitigations with the client. Where GDPR Art. 35 requires a formal data-protection impact assessment, we support the client controller in carrying it out.
International transfers
KuarkTek operates from Türkiye. Data about people in the EEA and the UK is transferred to Türkiye on the basis of contractual necessity (GDPR Art. 49(1)(b)) for enquiries and direct engagements, and on the basis of the European Commission's Standard Contractual Clauses where a data-processing agreement is in place. Transfers from Türkiye abroad follow KVKK Art. 9, using the mechanisms recognised by the Personal Data Protection Board. We assess the laws of the destination country and add supplementary measures where needed.
Our processors
We use a small number of service providers to run the studio. As of the date of this policy they include our hosting provider (Hostinger International Ltd.), our email service provider, and the file-sharing, design, project-management and video-conferencing tools we use to collaborate with clients. Each is bound by data-processing terms that meet GDPR Art. 28. A current list is available to clients on request.
Records and accountability
We keep a record of our processing activities, our retention periods, our processors and the data-processing agreements we have signed. This policy, the Privacy Policy and the Cookie Policy are reviewed together at least once a year and whenever our practices or the law change.
Contact
Questions about this policy, requests to exercise your rights, and requests for a data-processing agreement should be sent to info@kuarktek.digital with the subject line "Personal data", or by post to KuarkTek Digital, Filistin Cad. 17/3 GOP, 06700 Çankaya, Ankara, Türkiye. Complaints can also be made to the Turkish Personal Data Protection Board (kvkk.gov.tr) or, for people in the EEA, to the supervisory authority of your country.