GDPR & Data Protection Policy

1. Introduction

Codefacture is committed to protecting the personal data of our customers, employees, and partners. This policy outlines our approach to data protection, complying with the General Data Protection Regulation (GDPR) and Turkish Personal Data Protection Law (KVKK Law No. 6698).

2. Data We Collect

We may collect the following types of personal data:

• Personal identification information (name, email, phone number)
• Company and professional details
• IP addresses and device information
• Communication and correspondence
• Website usage and interaction data (via Google Analytics, anonymized)
• Advertising interaction and conversion data (via Meta/Facebook Pixel and Google Ads)
• Contact requests submitted via WhatsApp, Instagram, and Google Ads channels

3. Purpose of Data Processing

We process personal data for the following purposes:

• Providing and improving our services
• Customer communication and support
• Marketing and promotional activities (with consent)
• Compliance with legal obligations
• Website performance and usage analysis
• Measuring advertising campaign effectiveness and conversion tracking

4. Legal Basis for Processing

We process personal data based on:

• Explicit consent
• Contractual necessity
• Legal obligations
• Legitimate business interests

5. Third-Party Service Providers & Data Processors

We use the following third-party services to operate our website and process data. All international transfers are made with appropriate safeguards (Standard Contractual Clauses / SCCs) in compliance with GDPR Article 46:

6. Data Subject Rights

Under GDPR and KVKK, you have the following rights:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten)
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

7. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption and secure data transmission (HTTPS/TLS)
• Access controls and authentication
• Regular security audits
• Employee data protection training
• Incident response and breach notification procedures
• Data stored exclusively in EU-based servers (Frankfurt/FRA1) for contact form data

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or to comply with legal obligations. Data is regularly reviewed and deleted when no longer required.

9. International Data Transfers

Contact form data is stored exclusively in Frankfurt, Germany (EU) via Vercel (FRA1) and MongoDB Atlas (FRA1), ensuring data residency within the European Union. For Google Analytics and Meta Pixel, data may be processed in the United States; however, both providers operate under Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an equivalent level of data protection.

10. Contact Information

For any data protection inquiries or to exercise your rights, contact our Data Protection Officer:

Email: info@codefacture.com
Address: Mustafa Kemal Mah. 2118. Cd. Maidan İş Merkezi 4C Blok - No: 140 Çankaya / Ankara, Turkey

11. Policy Updates

This policy may be updated periodically. We recommend reviewing it regularly for any changes.

Last Updated: March 2026