Legal
Personal Data Privacy Notice
Version 1.4.0 · digest 55a4a05f22dd5692
Version 1.4.0 · 04.10.2026. This English text is a translation provided for information; in case of any difference, the Turkish text prevails.
Data controller
| Field | Value |
|---|---|
| Trade name | CASTAMON YAZILIM VE DANIŞMANLIK LİMİTED ŞİRKETİ |
| Brand | Castintech |
| MERSIS no · trade registry no | 0074-0010-7250-0001 · 620550-0 (Istanbul Trade Registry Office) |
| Address | Yeşilce Mahallesi Aytekin Sokak No:5/2 Kağıthane / Istanbul |
| Registered e-mail (KEP) | castamon@hs02.kep.tr |
| E-mail · phone | castagent@castintech.com · +90 532 484 72 92 |
| Web | https://castintech.com |
Nature and scope of this notice
This notice is information provided under Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK). It is not an explicit consent text; it is not subject to acceptance or approval, and it is not advance permission for any processing.
Common processes. Whatever Castintech service is concerned, this notice applies to the following processes common to all customer relationships: the website (castintech.com) and the request form, quotes, correspondence on Castintech's own communication channels (e-mail, WhatsApp, Facebook Messenger, Instagram, Telegram), the customer account (My account), quoted project payment, invoicing and accounting, and security and evidence.
Service-specific processing. Some services require additional processing. These are described separately below and apply only when that service is requested or provided, and only to the processing that actually takes place in that service. The mention of a service in this notice does not mean that the service is offered today or that data is being processed for it.
Where a service requires data, a purpose, a recipient or a retention rule not written in this notice, this notice will be updated before that processing begins. Data processed within the applications of Castintech software products (e.g. Castbook) is not covered by this notice. Cookies and data stored in the browser are described in the Cookie Policy.
Roles
Castintech's role is determined not by the name of the service but by how, and for whose purpose, the data is actually processed.
- Castintech's own records: Castintech is the data controller for request, quote, correspondence on Castintech's own communication channels, customer account, payment, order, invoice, support and security records.
- Data processed on the customer's behalf: Within a service, Castintech may process personal data in the customer's site, application, store, accounts, communication channels or content on the customer's behalf. This data may include information about site visitors, the customer's own customers and their messages. This processing may take place in the customer's systems through administrative access, in Castintech's systems, or in other systems used for the service. The customer is the data controller for this data; Castintech is a data processor acting on the customer's behalf and limited by the customer's instructions. The systems and providers used for this data may vary by service and may not be the same as the providers listed below for Castintech's own records. The duty to inform the individuals concerned lies with the customer as the data controller; this notice does not replace the customer's own notice.
- The customer's independent processing: The customer's own processing in which Castintech does not take part (e.g. the customer using its own accounts and providers itself) is not processing by Castintech. Processing that Castintech carries out in the customer's accounts and providers on the customer's instructions falls under "data processed on the customer's behalf" above.
Data processed in common processes, purposes and legal grounds
| Operation | Data processed | Purpose | Legal ground (KVKK Article 5(2)) |
|---|---|---|---|
| Request and contact form, quotes | Full name, e-mail, phone, company name, message and the information selected in the form (such as the service of interest, sector, website); the page the form was sent from and the language; quote correspondence | Assessing and answering the request, preparing a quote if asked | (c) directly related to the conclusion of a contract; for general questions not aimed at a quote, (f) legitimate interest |
| Request and contact form — campaign information | If the site was reached through a campaign link: the campaign parameters in that link (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the landing page | Measuring which campaign the request came from | (f) legitimate interest |
| Castintech's messaging channels (WhatsApp, Facebook Messenger, Instagram, Telegram) | Phone number or the user ID and username on the platform; profile name; message content and time; comments on Castintech's Facebook and Instagram posts; documents and images sent; the technical message record passed on by the platform; contact and request details shared in the conversation, notes and labels on the conversation; where the conversation was started through an advertisement, the ad ID and ad title passed on by the platform | Answering the message, recording and following up the request; measuring which advertisement the conversation came from | For correspondence relating to a quote or contract, (c) conclusion and performance of the contract; for other correspondence and for ad measurement, (f) legitimate interest |
| Draft replies (AI assistance) | The text of the latest messages of conversations on Castintech's Facebook Messenger, Instagram and Telegram channels | Preparing a draft reply for a Castintech employee. A draft is not sent unless an employee approves it | (f) legitimate interest |
| Internal notifications | In alerts about messages awaiting a reply, the person's name and the last four digits of the phone number; in daily request summaries and error notifications, a short reference used instead of the full phone number and message content, which can be linked to the record (for WhatsApp requests it includes the last four digits of the phone number) | Answering requests on time | (f) legitimate interest |
| My account | E-mail address; sign-in code (kept only as a digest); session information | Secure sign-in to the account; viewing payments, orders, invoices and requests | (c) performance of the contract; for sign-in security, (f) legitimate interest |
| Quoted project payment | Full name, address and phone entered on the payment page (passed to the payment institution only to start the payment; not written to Castintech's database, acceptance and audit records or application logs); e-mail and billing details; the documents and declarations accepted and their times; the payment result | Taking the payment, performing the service, keeping distance contract records | (c) conclusion and performance of the contract; for distance contract records, (ç) legal obligation |
| Invoicing and accounting | Trade name or full name, billing address; Turkish ID no or tax office and tax no where required for the invoice; payment record | Issuing invoices and keeping them as required by law | (a) expressly provided for by law and (ç) legal obligation (Tax Procedure Law No. 213; Turkish Commercial Code No. 6102, Article 82) |
| E-mail correspondence and support | E-mail correspondence and support records relating to a request, order or service | Handling the request and the service; keeping commercial correspondence | (c) conclusion and performance of the contract; for commercial correspondence, (ç) legal obligation (Turkish Commercial Code No. 6102, Article 82) |
| Security and evidence | A digest of the IP address in acceptance and payment records; truncated IP address, time and request details in server access logs | Security of the service and infrastructure, prevention of misuse; protection of rights in a dispute | (f) legitimate interest; (e) establishment, exercise or protection of a right |
Service-specific processing (only where it actually takes place in the relevant service)
| Service | Additional data | Purpose | Legal ground and role |
|---|---|---|---|
| Project and management services | Content and documents the customer provides; admin panel, hosting, domain and account access details to the extent the work requires; personal data accessed while the work is carried out in the customer's systems | Delivering the project, performing the service | For Castintech's own records, (c) performance of the contract. For data in the customer's systems and data processed on the customer's behalf, Castintech is a data processor (see "Roles") |
| Communication channels managed on the customer's behalf (e.g. the customer response service) | Messages received on and sent from the customer's messaging and social media channels; the channel identity and contact details of the people writing; records and draft replies prepared on the customer's instructions | Answering, recording and following up messages on the customer's behalf | Castintech is a data processor; the customer is the data controller. The systems and providers used vary by service (see "Roles") |
| Managed WordPress — order and hosting (when this service is provided) | Order: full name or trade name, e-mail, phone, billing address; order, payment and service records; customer status declaration, choice on the start of performance, documents accepted and their times. Service: files and database of the customer's site | Taking the order, concluding and performing the contract (setup, service, support, renewal, end of service) | (c) conclusion and performance of the contract; for distance contract records, (ç) legal obligation. For data on the customer's site, Castintech is a data processor |
| Managed WordPress — hosting provider obligation (once the service starts, for the hosted sites) | Hosting provider traffic information required by Law No. 5651; content is not kept | Statutory hosting provider obligation | (a) and (ç) (Law No. 5651, Article 5); Castintech is the data controller for these records |
Domain name registration and renewal — .com and .net (when this service is provided) | Order: registrant details (first name, last name, company name where given, e-mail address, telephone number and postal address: street address, district, province, postal code, country); order, payment and service records; choice on the start of performance, documents accepted and their times. Registrant details are stored encrypted at Castintech. On registration these details are sent to the domain registrar; on renewal only the domain name and the period are sent to the registrar. For payment, full name, address, phone and e-mail are sent to the payment institution | Taking the order, registering and renewing the domain name with the registrar in the registrant's name, concluding and performing the contract | (c) conclusion and performance of the contract; for distance contract records, (ç) legal obligation. Castintech is the data controller for its own records; the registrar's role is described under "Transfers" |
Domain name registration and renewal — .com.tr and .tr (when this service is provided) | Order: registrant details (first name, last name, company name where given, e-mail address, telephone number and postal address) and the details required by the .tr registry system (TRABİS): Turkish ID number for an individual registrant; company title, tax office and tax number for a corporate registrant; the acceptance record of the application declaration (document version and time); order, payment and service records. Registrant details (including ID and tax numbers) are stored encrypted at Castintech. On registration these details are sent to the registrar and, through it, to TRABİS; on renewal only the domain name and the period are sent to the registrar. On payment, name, address, telephone and e-mail are sent to the payment institution | Registering and renewing the domain name in the registrant's name | (c) performance of the contract; (ç) legal obligation (Internet Domain Names Regulation) |
Processing specific to hosting, VPS/server and business e-mail services (e.g. mailbox contents, server administration records) is not described in this notice, apart from Managed WordPress. For domain name services, only the .com, .net, .com.tr and .tr registration and renewal described above is covered by this notice; domain transfers and other extensions are not described. This notice will be updated before such processing begins for any of these services.
Method of collection: Data is collected electronically, partly by automated means, through the forms on the website, the payment and order screens, e-mail correspondence, messages sent to Castintech's messaging channels and the system records created while the service is carried out.
Card details: Card details are entered on the payment institution's payment page; Castintech does not receive or store the card number, expiry date or security code.
IP address: Acceptance and payment records keep not the IP address itself but a digest created with a secret key. This digest is not anonymous data; it is a pseudonymous identifier and is protected as personal data. The IP address is written to server access logs in truncated form.
Artificial intelligence: On Castintech's own channels, draft replies are offered only as suggestions to a Castintech employee and are not sent unless the employee approves them; no decision producing legal effects concerning a person is taken solely by automated means.
Marketing: In the operations covered by this notice Castintech does not ask for marketing permission and does not send commercial electronic messages. Replies to requests and order, payment, security, renewal and legal notices are transactional messages.
Transfers
Within Türkiye
| Recipient | In which operation | Role |
|---|---|---|
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. | When a payment is taken and when a refund is made | Payment institution; also processes the payment transaction on its own account under its own legislation |
| Logo Yazılım Sanayi ve Ticaret A.Ş. (eLogo) | When an invoice is issued: e-Archive / e-Invoice | Invoicing service provider acting on Castintech's behalf |
| Atak Domain Bilgi Teknolojileri A.Ş. (DomainNameAPI) | .com.tr and .tr domain registration: registrant details and the ID/tax details required by TRABİS; on renewal only the domain name and the period | Domain registrar; also processes the registration data on its own behalf for its own obligations under the Internet Domain Names Regulation |
| Information and Communication Technologies Authority (TRABİS) | Application and registrant details forwarded by the registrar | Registry system for .tr domain names; recipient within its own authority |
| Revenue Administration, competent public authorities, judicial bodies | Where required by legislation | Recipient within its own authority |
Abroad (KVKK Article 9)
The tables below show the services Castintech uses regularly for its own records, for Managed WordPress hosting and for domain name registration. For data processed on a customer's behalf in other services, the systems and providers used may vary by service (see "Roles").
| Provider | In which operation | Role | Location of the data |
|---|---|---|---|
| Hetzner Online GmbH | Castintech's server: request, correspondence, account, payment, order, acceptance and support records | Data processor acting on Castintech's behalf | Finland |
| Cloudflare, Inc. | Every request to the Castintech website: the request passes through this network together with the IP address and the information entered in forms | Data processor acting on Castintech's behalf | Cloudflare's global server network; the country of processing has not been verified at the date of this version |
| Hostinger | Castintech's e-mail correspondence and sign-in code e-mails; when Managed WordPress is provided, hosting the customer's site | Data processor acting on Castintech's behalf; sub-processor for the data on the customer's site | Managed WordPress site data: the data-centre country shown in the order summary (at the date of this version, the data centre of Castintech's WordPress hosting account: Germany). The location of the e-mail infrastructure has not been verified at the date of this version |
| Google (Google Drive) | Keeping the nightly backups of Castintech's server; the backups are encrypted on Castintech's server and the encryption key stays with Castintech | Storage service on Castintech's behalf | Not verified at the date of this version |
| NameSilo, LLC | .com and .net domain registration: registrant details; on renewal only the domain name and the period | ICANN-accredited domain registrar (IANA registrar ID 1479). Also processes the registration data on its own behalf for its own obligations under its ICANN agreement | United States (law governing the registration agreement). The data-centre country where the data is kept has not been verified at the date of this version |
Messaging and artificial intelligence services:
| Service | In which operation |
|---|---|
| Correspondence on Castintech's WhatsApp line. The line is connected to Castintech's server through WhatsApp Web's linked-device method; messages are carried over WhatsApp's infrastructure | |
| Meta (Facebook Messenger, Instagram) | Messages received on and sent from Castintech's pages and accounts; comments on Castintech's posts |
| Telegram | Messages received by Castintech's Telegram bot; internal notifications sent to Castintech employees |
| Artificial intelligence service: OpenAI Codex (accessed with Castintech's ChatGPT accounts) | The message text of the conversation while a draft reply is prepared |
The legal entity of the provider, the country in which the data is processed and the provider's role have not been verified for these services at the date of this version.
.com and .net domain name registration (registrar: NameSilo): Registration is made with NameSilo's free WHOIS privacy service switched on; the public WHOIS/RDAP record then shows the privacy service's details instead of the registrant's. The registrant details are still sent to NameSilo. Under ICANN rules NameSilo may disclose registration data to ICANN, to the relevant registry (for .com and .net: VeriSign, Inc.) and to the data escrow service required by ICANN. This paragraph does not cover .com.tr and .tr registrations; no privacy service is promised for those extensions.
At the date of this version, Castintech's records contain no standard contract signed with any of the providers above under KVKK Article 9 and no notification made to the Personal Data Protection Authority; the Article 9 mechanism to be applied to these transfers has not yet been determined. Castintech does not ask for explicit consent for these transfers.
Retention
- Invoices, commercial books and supporting documents: 10 years (Turkish Commercial Code No. 6102, Article 82; Tax Procedure Law No. 213, Article 253).
- Commercial correspondence (including commercial correspondence by e-mail and on messaging channels): 10 years (Turkish Commercial Code No. 6102, Article 82).
- Distance contract records (pre-contractual information, document acceptances, choice on the start of performance, withdrawal): at least 3 years (Distance Contracts Regulation, Article 20); those that support commercial books or are commercial correspondence, 10 years.
- Managed WordPress — hosting provider traffic information (once the service starts): the period required by Law No. 5651 (at least 1, at most 2 years).
- Managed WordPress — the customer's site: during the service and for 30 days after it ends for export; then deleted from the hosting account. The deletion period of copies that may remain in the hosting provider's own backups has not been verified at the date of this version. This rule applies only to Managed WordPress.
.comand.netregistrant details — at the registrar (NameSilo): under ICANN rules, for the life of the registration and for two years after it ends (the registrar's own obligation). For Castintech's order and registrant records, the rules above and below apply..com.trand.trregistrant details — at the registrar and at TRABİS: kept under those bodies' own obligations; the period had not been verified as of the date of this version. For Castintech's order and registrant records, the rules above and below apply.- Data processed on the customer's behalf: data in the customer's systems stays in the customer's systems; after the service ends, the data held by Castintech is returned or deleted according to the customer's instructions. For Managed WordPress, the rule above applies.
- Server access logs: kept in size-limited rotating files; when the limit is reached, the oldest entries are deleted.
- Other data (including request and contact form records and correspondence of a non-commercial nature): kept for as long as needed for the purpose for which it is processed; when that period ends, or on the data subject's request, data not subject to a statutory retention obligation is deleted, destroyed or anonymised under KVKK Article 7. For copies in backups, the item below applies.
- Backups of Castintech's server: local backups in the server's regular backup directory are deleted within 5 days at the latest. At the date of this version no deletion period is applied to copies taken manually before maintenance and kept outside that directory, or to the encrypted remote copies (Google Drive); data deleted from the live record may continue to exist in those copies. Whether the server provider's (Hetzner) server backup feature is used has not been verified at the date of this version. Backups are not the archive of invoices and commercial records kept as required by law.
Rights and applications
Under KVKK Article 11 you have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose of processing and whether it is used for that purpose, to know the third parties in Türkiye or abroad to whom it is transferred, to request its correction if it is incomplete or inaccurate, to request its deletion or destruction, to request that these actions be notified to the third parties to whom it was transferred, to object to a result against you arising exclusively from analysis by automated systems, and to claim compensation if you suffer damage from unlawful processing.
You may submit your application in writing to the address above, to the KEP address castamon@hs02.kep.tr, to castagent@castintech.com from the e-mail address you previously notified to Castintech and that is registered in our system, or by other methods set by the Personal Data Protection Board. Applications are concluded free of charge within 30 days at the latest; if the action requires an additional cost, the fee in the Board's tariff may be charged (KVKK Article 13). Applications concerning data that Castintech processes on a customer's behalf (e.g. data on a customer's site, store or communication channels) are made to the customer as the data controller; any such application reaching Castintech is forwarded to the customer without delay.