Privacy Policy & Data Protection Notice

1. Data controller

Your personal data is processed by the data controller identified below. You may direct any request to these contact channels.

2. Data we process

Only the following data is processed across our site and services:

• Contact form: full name, email address, phone number, selected service topics, message content and the page the form was submitted from.
• Client and project records: contact person details, billing name, address, tax office and tax number, quote / invoice / service renewal records.
• Payments: amount, date and transaction reference. Card number, expiry date and CVC are never visible to or stored by us; such data is processed solely by the licensed payment institution iyzico Ödeme Hizmetleri A.Ş. on PCI DSS compliant infrastructure.
• Technical logs: IP address, timestamp, browser and requested path in server access logs, plus rate-limiting data used to prevent abuse.
• Site assistant: messages you type into the assistant may be sent to our AI model provider solely to generate a reply. Chat content is not used for marketing.

3. Purposes of processing

• Responding to your enquiry, preparing quotes and conducting pre-contractual discussions.
• Formation and performance of the contract; running project, service and subscription processes.
• Invoicing, collection, accounting and compliance with tax legislation.
• Tracking service renewal dates and sending reminder notifications.
• Ensuring site and system security and preventing abuse.

4. Legal grounds

Processing is based on Article 5 of the KVKK: necessity for the formation or performance of a contract (5/2-c), compliance with a legal obligation (5/2-ç), establishment and protection of a right (5/2-e) and the legitimate interests of the controller (5/2-f). Any processing outside these grounds is carried out only with your explicit consent, which you may withdraw at any time.

5. Recipients

Your data is never sold or transferred to third parties for marketing. It is shared only to the extent required to deliver the service:

• Payment institution (iyzico Ödeme Hizmetleri A.Ş.): to execute payments and refunds.
• Hosting provider: the site and client panel run on servers located in Türkiye.
• Email infrastructure (Google Workspace): to deliver notifications and correspondence.
• AI model provider: only to answer messages you send to the site assistant.
• Certified accountant and competent public authorities: within statutory obligations.

6. Retention periods

• Contact form enquiries: 2 years after the enquiry is closed.
• Contracts, invoices and accounting records: 10 years as required by law.
• Server access logs: up to 12 months.
• At the end of the period data is deleted, destroyed or anonymised.

7. Cookies

No advertising or tracking cookies are used on the public pages and no third-party analytics script is embedded. A single strictly necessary session cookie is used to keep the administrator signed in to the management panel. Your language preference is carried in the URL structure (e.g. /en).

8. Data security

All traffic to the site and panel is encrypted with a valid SSL/TLS certificate. Panel access requires session authentication and uploaded files are never stored in publicly served directories. Payment pages run on the payment institution's 3D Secure enabled infrastructure.

9. Your rights

Under Article 11 of the KVKK you may request to:

• Learn whether your personal data is processed and request information about it.
• Learn the purpose of processing and whether the data is used accordingly.
• Know the third parties to whom data is transferred, domestically or abroad.
• Request rectification of incomplete or inaccurate data.
• Request erasure or destruction of your data.
• Request that rectification, erasure or destruction be notified to recipients.
• Object to a decision produced solely by automated analysis that affects you adversely.
• Claim compensation for damage arising from unlawful processing.

10. How to apply

Send your request by email to info@crabdigital.com.tr or in writing to the postal address above. Requests are answered free of charge as soon as possible and in any case within 30 days. Where the process incurs an additional cost, the tariff set by the Turkish Data Protection Board may apply.

11. Changes

This notice may be updated due to legislative changes or changes in our processes. The current version is always published on this page; the date at the top shows the last update.