Privacy Notice | Didirtech

This notice explains how personal data is processed when you use didirtech.com or contact me. It is written under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and also covers the information listed in Article 13 of the GDPR.

Who is responsible

The data controller is Emre Didir, an individual software developer based in Türkiye who works under the name “Didirtech”. Contact: [email protected]

What data is processed

Contact form: your name, email address, message and, if you choose one, your project category (cloud, web, automation, mobile, not sure).
Direct email: if you write to [email protected], your name, email address, message and anything else you choose to include.
Technical data: your IP address, the time of submission and how long the form took to fill in, used only to block automated (bot) submissions and abuse.
Connection data: when you connect to the site, Cloudflare may process technical data such as your IP address for security and connection management.
Visit statistics: Cloudflare Web Analytics measures which pages are opened, the address that referred you, your browser and device type, country and how long the page took to load. It uses no cookies, writes no identifier to your browser, does not follow you across other sites and is not meant to identify individual visitors; I only see the results as aggregate counts.

There are no accounts, payments or advertising trackers on this site. The only analytics are the cookieless visit statistics above.

Why, and on what legal basis

To review your project or quote request and reply to you: steps taken at your request before entering into a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)); for business enquiries not directly related to a contract, legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
To answer general questions and protect the form against abuse: legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
To see which pages people find useful and how fast the site loads, so I can improve it: legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
Where a legal obligation arises, such as a request from a competent authority: legal obligation (KVKK Art. 5(2)(a) and (ç); GDPR Art. 6(1)(c)).

You do not need to accept this notice to use the contact form. Personal data sent through the form is processed on the legal bases listed above.

Who receives it, including abroad

I don’t sell your personal data or use or share it for marketing. To run the site and email, I use these providers:

Cloudflare (USA): domain, content delivery, security, cookieless visit statistics (Web Analytics) and forwarding of email sent to didirtech.com addresses. Site traffic and email to those addresses pass through Cloudflare.
Resend (USA): delivers contact-form messages to me and the replies I send from didirtech.com addresses (from Gmail, over SMTP).
Google Gmail (USA): the mailbox where messages and correspondence are stored.
OVHcloud (France): the server in the European Union that runs this site.

Because of these services, your personal data may be processed on systems outside Türkiye and transferred abroad. Transfers abroad are subject to KVKK Art. 9.

Otherwise, data is shared with public authorities only where the law requires it.

How long it is kept

Form data: what you send through the form is not saved to a database or file on the site’s server; it is delivered straight to me as an email.
IP address: after a valid form submission, held in server memory for about 10 minutes from your last submission to prevent abuse, then deleted automatically; never written to a database.
Bot checks: the hidden form field and fill-in time are only checked at the moment you submit and are not stored.
Visit statistics: kept by Cloudflare as aggregate counts; no per-visitor profile is built.
Resend records: Resend keeps delivered emails and logs for 30 days.
Email correspondence: enquiries that don’t lead to a project, or are closed, are deleted 12 months after the last message. Correspondence about a project is kept for the duration of the contract and afterwards for the limitation periods that apply to possible legal claims.
Server: no visitor access logs are kept. The server only produces the application’s runtime and error logs, which are not used to track visitors and are rotated automatically by size: only a few files are kept, and older entries are deleted as new ones are written.

Cloudflare and other infrastructure providers may also keep their own technical logs to secure and run their services.

Cookies

No advertising, analytics or marketing tracking cookies are used; the visit statistics also work without cookies. Cloudflare may set strictly necessary security cookies such as __cf_bm to protect the site against attacks; consent is not requested for these. Your light/dark theme choice is stored only in your browser (localStorage) and is never sent to the server.

Your rights

Under KVKK Art. 11 you can ask whether your data is processed and get information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to in Türkiye or abroad, have incorrect data corrected, have it deleted under the conditions in KVKK Art. 7, have third parties notified of corrections or deletions, object to a result against you produced solely by automated analysis, and claim compensation for damage caused by unlawful processing.

If you are in the EU or EEA and the GDPR applies, you also have the rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests, and you can lodge a complaint with your local data protection authority.

How to make a request

Email [email protected] from the address you used in the form or in our correspondence. If you’d like to send a written request by post, you can ask for my postal address at the same email. Requests are answered within 30 days at the latest and are, as a rule, free of charge; a fee set by the Turkish Data Protection Board may apply only where handling the request involves an additional cost. If your request is refused, you find the answer insufficient or you get no answer in time, you can complain to the Turkish Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your request (KVKK Art. 14).

Changes

This notice is updated whenever the way data is processed, the services used or the applicable law change. The current version is always on this page.