GDPR & Data Protection Policy

1. Introduction

Codefacture is committed to protecting the personal data of our customers, employees, and partners. This policy outlines our approach to data protection, complying with the General Data Protection Regulation (GDPR) and Turkish Personal Data Protection Law (KVKK Law No. 6698).

2. Data We Collect

We may collect the following types of personal data:

Personal identification information (name, email, phone number)
Company and professional details
IP addresses and device information
Communication and correspondence
Website usage and interaction data (via Google Analytics, anonymized)
Advertising interaction and conversion data (via Meta/Facebook Pixel and Google Ads)
Contact requests submitted via WhatsApp, Instagram, and Google Ads channels

3. Purpose of Data Processing

We process personal data for the following purposes:

Providing and improving our services
Customer communication and support
Marketing and promotional activities (with consent)
Compliance with legal obligations
Website performance and usage analysis
Measuring advertising campaign effectiveness and conversion tracking

4. Legal Basis for Processing

We process personal data based on:

Explicit consent
Contractual necessity
Legal obligations
Legitimate business interests

5. Third-Party Service Providers & Data Processors

We use the following third-party services to operate our website and process data. All international transfers are made with appropriate safeguards (Standard Contractual Clauses / SCCs) in compliance with GDPR Article 46:

Service Provider	Purpose	Server Location	Compliance
Vercel Inc.	Website hosting and deployment infrastructure	Frankfurt, Germany (EU) - FRA1	GDPR compliant, DPA & SCCs in place
MongoDB, Inc. (Atlas)	Database hosting (contact form data and customer lead records from WhatsApp, Instagram, and Google Ads channels)	Frankfurt, Germany (EU) - FRA1	GDPR compliant, DPA & SCCs in place
Google LLC (Google Analytics)	Website usage analytics (IP anonymization enabled)	USA / EU	GDPR compliant, DPA & SCCs in place
Meta Platforms, Inc. (Facebook Pixel)	Ad conversion tracking and targeted marketing	USA / EU	GDPR compliant, DPA & SCCs in place

6. Data Subject Rights

Under GDPR and KVKK, you have the following rights:

Right to access your personal data
Right to rectification of inaccurate data
Right to erasure (right to be forgotten)
Right to restrict processing
Right to data portability
Right to object to processing
Right to withdraw consent
Right not to be subject to a decision based solely on automated processing, including profiling
Right to lodge a complaint with a supervisory authority

If you are in the EU or the EEA you can lodge a complaint with the supervisory authority of the country where you live, where you work, or where you believe an infringement took place. In Türkiye the competent authority is the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). You are welcome to come to us first so we can try to resolve it directly, but you do not have to.

7. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

Encryption and secure data transmission (HTTPS/TLS)
Access controls and authentication
Regular security audits
Employee data protection training
Incident response and breach notification procedures
Data stored exclusively in EU-based servers (Frankfurt/FRA1) for contact form data

8. Data Retention

We keep personal data for as long as the purpose it was collected for requires, and for the limitation and record keeping periods set by law. When the period ends the data is deleted, destroyed or anonymised.

Data	Retention Period	Basis
Contact and quote request records that do not become a contract	2 years from the last contact	Legitimate interest
Data on clients we enter into a contract with	10 years after the relationship ends	Turkish Commercial Code art. 82
Invoices and accounting records	5 years	Turkish Tax Procedure Law art. 253
Customer portal account data	Until the account is deleted, then no more than 30 days	User request
Consent records (IP address and timestamp)	As long as the data it relates to	Burden of proof
Google Analytics usage data	The period set on our account, at most 14 months	Google Analytics setting
Meta Pixel advertising interaction data	Under Meta Platforms’ own retention policy	Provider policy

Where a statutory provision requires a longer period, that data is kept for as long as the provision requires. Data whose period has expired is deleted as part of our periodic destruction process.

9. International Data Transfers

Contact form data is stored exclusively in Frankfurt, Germany (EU) via Vercel (FRA1) and MongoDB Atlas (FRA1), ensuring data residency within the European Union. For Google Analytics and Meta Pixel, data may be processed in the United States; however, both providers operate under Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an equivalent level of data protection.

10. Contact Information

For any data protection inquiries or to exercise your rights, contact our Data Protection Officer:

Email: info@codefacture.com
Address: Mustafa Kemal Mah. 2118. Cd. Maidan İş Merkezi 4C Blok - No: 140 Çankaya / Ankara, Turkey