Data Protection Notice
Effective date: 30 July 2026 | Last updated: 23 September 2026
This notice is issued in the capacity of data controller pursuant to Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the “Law” / “KVKK”) and the associated Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
WhatsApp conversations and demonstrations
+90 850 304 43 65 is Oğuz Erol’s WhatsApp Business Platform number for client communication and automation demonstrations. Conversations may concern your enquiry, ongoing work or a demonstration you request.
- What is recorded: Your phone number, WhatsApp profile name, message text, timestamp, message identifier, selected button and the message you replied to. If you send an image, audio recording or document, the relevant content and file information may also form part of the conversation.
- Where messages go: Messages arrive through WhatsApp/Meta and a Cloudflare connection to the server used for this service. Client messages are recorded on the server. The profile name, phone number and message text are also forwarded to Telegram so that Oğuz Erol can follow up. These notifications contain more than a “new message” alert.
- Separate choices: This page provides information; it does not require an acceptance button. Sending an enquiry or approving a particular item of work does not grant general marketing permission or explicit consent for all data processing. Marketing preferences and explicit consent, where needed, are requested separately.
- Changing your preference: To stop promotional messages, write “STOP”, “DUR” or “İPTAL” to the same number, or send an email. Recording a communication preference and deleting previous data are separate actions. The deletion instructions explain how to request erasure.
Demonstrations use sample or synthetic data. Other clients’ private conversations, reports and account information are not shown. If a demonstration requires an AI provider or another service to process your personal data, the processing and service are explained separately before it begins. A demonstration result alone does not place an order, make a reservation, authorise spending or constitute binding approval of work.
Please do not send passwords, verification codes, full payment card details, identity documents or health information to this number. You can use email or telephone if you prefer not to use WhatsApp.
1. Identity of the data controller
Data controller: Oğuz Han Erol (sole proprietorship registered in Türkiye)
Address: Göztepe Mah. Bağdat Cad. No: 201/8 İkar Plaza, 34730 Kadıköy / Istanbul, Türkiye
Tax office: Göztepe | Tax ID (VKN): 3670133479
Email: oguz@oguzerol.com | Phone: +90 549 654 64 89
Website: oguzerol.com
WhatsApp Business Platform number: +90 850 304 43 65
Under Article 3 of the Law, the data controller responsible for the processing of your personal data is the natural person identified above. No data controller representative has been appointed.
2. Categories of personal data processed
| Category | Data included |
|---|---|
| Identity | First name, surname; where an engagement begins, the trading name and tax details required for invoicing |
| Contact | Email address, phone number, website address, postal address |
| Customer transaction | Content of requests and complaints, proposal and contract records, correspondence history, button replies, message and media identifiers |
| Transaction security | IP address, date and time stamps, browser and device information, server access logs, cookie identifiers |
| Marketing | Browsing records obtained via cookies and pixels, traffic source, ad interaction and conversion data |
| Finance | Invoice and payment records — only for clients receiving services |
Special categories of personal data are not requested. Data listed in Article 6 of the Law — such as health, religion, ethnic origin, political opinion, biometric and genetic data — is not requested. Please do not submit such data through the form or by message.
3. Purposes of processing and legal bases
| Processing activity and purpose | Legal basis (Law, Art. 5) |
|---|---|
| Responding to requests received via the contact form, phone, WhatsApp or email; analysing needs and preparing proposals | Art. 5/2-(c): Directly related to the conclusion or performance of a contract; Art. 5/2-(f): Legitimate interest |
| Concluding and performing the service agreement, reporting, and managing client relationships | Art. 5/2-(c): Performance of a contract |
| Issuing invoices, keeping accounting and tax records, retaining statutory books and documents | Art. 5/2-(a): Expressly provided for by law; Art. 5/2-(ç): Compliance with a legal obligation |
| Operating the website, keeping server and access logs, blocking spam and automated bot attempts, ensuring information security | Art. 5/2-(ç): Legal obligation; Art. 5/2-(f): Legitimate interest |
| Statistical analysis of Site usage and improvement of content (analytics cookies) | Art. 5/1: Explicit consent |
| Measuring advertising performance, conversion tracking and remarketing (advertising cookies and pixels) | Art. 5/1: Explicit consent |
| Exercising the right of legal defence in the event of a dispute and securing evidence | Art. 5/2-(e): Establishment, exercise or protection of a right |
| Responding to requests from competent public authorities | Art. 5/2-(a) and (ç) |
You are under no obligation to give consent where processing is based on explicit consent, and you may withdraw consent at any time. Refusing or withdrawing consent does not prevent you from using the Site or receiving services.
4. Method of collection
Your personal data is obtained by wholly or partly automated means through the following channels:
- Completing the contact form on the Site,
- Contacting us via the phone, WhatsApp or email links on the Site,
- Records kept automatically by the server and content delivery network during your visit,
- Analytics and advertising measurement cookie/pixel technologies, to the extent you have consented,
- Documents and information you provide during the contract process, where an engagement begins.
5. Transfer of personal data
5.1. Domestic transfers (Law, Art. 8)
| Recipient group | Purpose of transfer |
|---|---|
| Accountant / bookkeeping service provider | Fulfilment of statutory bookkeeping, documentation and filing obligations |
| Legal counsel | Exercise of the right of defence in a legal dispute |
| Competent public authorities, courts and enforcement offices | Meeting requests and obligations arising from law |
5.2. International transfers (Article 9)
Using services such as WhatsApp/Meta, Cloudflare, server hosting, email and Telegram involves processing personal data on infrastructure outside Türkiye. The recipients and purposes are set out below:
| Recipient / recipient group | Relevant data and purpose |
|---|---|
| WhatsApp / Meta | Phone, profile, conversation, interaction and any submitted media information needed to deliver messages; relevant measurement data where advertising measurement is enabled |
| Cloudflare | Connection records used to deliver the website and WhatsApp connection, route traffic and provide security; form and message content in transit |
| netcup server hosting | Hosting WhatsApp message records and the automation service |
| Telegram | Profile name, phone number and message text forwarded to notify Oğuz Erol of client messages |
| Email service providers | Delivering and retaining enquiries and correspondence |
| Security or measurement data, depending on the analytics, advertising and map services used |
Sending a message or accepting cookies does not, by itself, establish a legal basis for international transfers. Article 9 of the Law imposes separate requirements. Adequacy decisions and appropriate safeguards must be considered first. Where neither is available, statutory exceptions apply only under their specific conditions and to occasional transfers. Adding a consent checkbox does not by itself bring a regular messaging infrastructure within those exceptions.
You can request information about the destination and legal basis of transfers involving a particular service by writing to oguz@oguzerol.com. Publication of this notice does not mean that a transfer agreement has been signed or that approval has been granted by the Turkish Personal Data Protection Board.
6. Retention periods
| Data | Duration | Basis |
|---|---|---|
| Enquiries that do not lead to an engagement | 2 years from last correspondence | Legitimate interest |
| Client contract and contact records | 10 years from the end of the relationship | General limitation period (Turkish Code of Obligations) |
| Invoices and accounting documents | 10 years (at least 5 years for tax purposes) | Turkish Commercial Code Art. 82; Tax Procedure Law |
| Server and security logs | Maximum 12 months | Information security |
| Cookie data | Lifetime of the cookie | Cookie Policy |
| Explicit consent records | 12 months | Burden of proof |
WhatsApp records are assessed according to their purpose. A general enquiry and a record needed to perform a contract or handle a dispute are not treated as identical. Sending a deletion request on WhatsApp does not automatically delete records held by Meta or Telegram; the request is assessed for the relevant systems.
At the end of the applicable period, data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
7. Your rights as a data subject (Law, Art. 11)
As a person whose personal data is processed, you have the right to apply to the data controller and:
- Learn whether your personal data is being processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether the data is used in accordance with that purpose,
- Know the third parties, in Türkiye or abroad, to whom the data has been transferred,
- Request correction where the data is incomplete or inaccurate,
- Request erasure or destruction within the conditions of Article 7 of the Law,
- Request that actions taken under (5) and (6) be notified to third parties to whom the data has been transferred,
- Object to an outcome adverse to you arising exclusively from automated analysis,
- Claim compensation where you suffer damage due to unlawful processing.
8. How to make an application
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request by one of the following means:
- In writing: Send a wet-signed letter in person, via notary or by registered post with return receipt to Göztepe Mah. Bağdat Cad. No: 201/8 İkar Plaza, 34730 Kadıköy / Istanbul, Türkiye . Marking the envelope “Information Request under the Personal Data Protection Law” speeds up handling.
- By secure electronic signature or mobile signature: Send your signed application to oguz@oguzerol.com .
- From your registered email address: Write to oguz@oguzerol.com from the email address you have previously notified to us and which is registered in our records.
Your application must include: your name and surname, and signature if made in writing; your Turkish ID number (for foreign nationals, nationality, passport number or ID number if any); your address for service; your email address, phone or fax number if any; and the subject of your request. Relevant information and documents should be attached.
Your application will be concluded free of charge as soon as possible and in any event within 30 days . If the process entails an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.
If your application is rejected, you find the response inadequate or no response is given within the period, you may lodge a complaint with the Turkish Personal Data Protection Boardwithin 30 days of learning of the outcome and in any event within 60 days of the date of application (Law, Art. 14).
9. Changes to this notice
This notice may be updated following changes in legislation or in the Site’s technical setup. The current version is always published on this page and the date at the top is updated.