Data Protection — GDPR & KVKK

Data Controller

The controller responsible for personal data arising from the operation of the straitcore.com root address is the company identified below. All requests described on this page should be addressed to it. Written applications may be sent to the registered address; electronic applications to the general contact address.

Where the GDPR applies to a specific processing activity, the same company acts as controller within the meaning of Article 4(7) GDPR.

Legal entity

Straitcore Teknoloji Anonim Şirketi (STRAITCORE TEKNOLOJİ A.Ş.)

Address

Fulya Mah. Büyükdere Cad. Quasar No: 76, İç Kapı No: 188, Şişli / İstanbul 34394, Türkiye

Tax office & number

Mecidiyeköy Tax Office / 7811154317

General contact

hello@straitcore.com

Billing

fatura@straitcore.com

Scope of This Page

straitcore.com is a statically published corporate information website in English. It exists to describe the company and to point visitors to the products we operate. It performs no commercial transaction of any kind.

This matters for your rights, because it determines how little personal data there is to act upon. In ordinary use of this website, the only personal data that arises is the technical record your browser leaves on the web server and any message you voluntarily choose to send to a published email address.

This page covers the straitcore.com root address only. Our products run on their own addresses, including subdomains of straitcore.com, under their own terms and their own privacy documentation; see the section on product-related requests below.

• No cookies are set. No local storage or session storage is used. Our Cookie Policy at straitcore.com/cookies/ explains this in full.
• No analytics, tag manager, or advertising or tracking pixel of any kind is present.
• No registration, account, login, subscription, order, or payment function exists.
• No form exists. Contact is a plain mailto: link, so nothing is submitted to us through the page itself.
• Fonts are served from our own infrastructure; no third-party font or asset network is called.
• Standard web server access records are generated as a technical necessity of delivering the pages you request.

Your Rights Under KVKK (Law No. 6698, Article 11)

If you are a data subject under Turkish law, you may apply to us and exercise each of the following rights. The list below is the complete set granted by Article 11 of Law No. 6698.

• To learn whether your personal data is being processed.
• To request information about the processing, if your personal data has been processed.
• To learn the purpose of the processing and whether your data is used in accordance with that purpose.
• To know the third parties to whom your personal data is transferred, in Türkiye or abroad.
• To request the correction of your personal data where it is incomplete or inaccurate, and to request that the correction be notified to third parties to whom the data has been transferred.
• To request the erasure or destruction of your personal data where the reasons for processing have ceased, within the framework of Article 7 of the Law.
• To request that any erasure or correction be notified to third parties to whom the data has been transferred.
• To object to a result reached to your detriment through the analysis of your data exclusively by automated systems.
• To claim compensation for damage suffered as a result of unlawful processing of your personal data.

Your Rights Under the GDPR

If you are in the European Economic Area, or the GDPR otherwise applies to the processing in question, you hold the following rights in addition to the KVKK rights above. Some of them have no practical field of application on this website — for example, no profiling or automated decision-making takes place here — but they are stated in full so that you can rely on them.

• Right of access to your personal data and to the information listed in Article 15 GDPR, including a copy of the data.
• Right to rectification of inaccurate personal data and completion of incomplete data (Article 16).
• Right to erasure, also known as the right to be forgotten, where the grounds in Article 17 apply.
• Right to restriction of processing in the circumstances set out in Article 18.
• Right to data portability, that is, to receive the data you provided in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible (Article 20).
• Right to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation (Article 21). We will then stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
• Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22). This website performs no profiling and takes no automated decisions.
• Right to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint with a supervisory authority (Article 77), as described below.

Legal Bases: KVKK Article 5 and GDPR Article 6

Every processing activity that can arise from this website, or from the contact addresses published on it, rests on one of the grounds below. The mapping is given so that you can identify which right applies: the right to object, for instance, is available against processing grounded in legitimate interests, while erasure is assessed differently where a legal obligation requires retention.

Retention. Server access records and correspondence are kept only for as long as the purpose that justifies them requires, and are deleted or anonymised once that purpose has lapsed and no legal retention period still applies to them — in particular the periods imposed by tax and commercial legislation on billing correspondence. The file opened for a data protection request is kept only for as long as we must be able to demonstrate that the request was handled correctly. If you wish to know the period applied to a specific record, ask us at hello@straitcore.com and we will tell you.

Web server access records (IP address, time of request, requested address, browser identification string), including their examination where a security incident affecting the server has to be investigated

KVKK Art. 5(2)(f) — legitimate interest of the controller, provided the fundamental rights of the data subject are not harmed | GDPR Art. 6(1)(f) — legitimate interests in network and information security, availability, and abuse prevention

Correspondence you send to hello@straitcore.com

KVKK Art. 5(2)(f) — legitimate interest in answering enquiries; Art. 5(2)(c) where the message concerns the establishment or performance of a contract | GDPR Art. 6(1)(f); Art. 6(1)(b) in a pre-contractual or contractual context

Correspondence sent to fatura@straitcore.com

KVKK Art. 5(2)(c) where the message relates to the establishment or performance of a contract; Art. 5(2)(a) — expressly provided for by law — where tax and commercial bookkeeping obligations attach to it | GDPR Art. 6(1)(b); Art. 6(1)(c). This address is published for identification purposes. No commercial relationship is created through this website; where such correspondence concerns a subscription to one of our products, the data belonging to that relationship is governed by the legal documentation of the product site in question.

Handling and documenting a data protection request you send us

KVKK Art. 5(2)(a) — obligations arising from Law No. 6698 | GDPR Art. 6(1)(c) — compliance with Articles 12 to 22

How to Exercise Your Rights

Send your request to hello@straitcore.com, or in writing to the registered address given above. A clear subject line such as "Data Protection Request" helps us route it without delay. There is no form to complete and no account to open.

Under the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller, an application may be made in writing, through registered electronic mail (KEP), using a secure electronic signature or mobile signature, or from an email address previously notified to the controller and registered in its system. No KEP address is published for this website, and this website keeps no user records, so no email address of yours is registered in a system here. The two channels actually open to you are therefore the ones listed below: an ordinary email to hello@straitcore.com, or a signed written application sent to the registered address. Neither is disadvantaged — in both cases the statutory period starts on the day your request reaches us. Under the GDPR, no particular form is required; a plain email is sufficient.

So that we can act on your request rather than return it for clarification, please state your name and surname, your Turkish identity number if you are a Turkish citizen or your nationality and passport or identity number if you are a foreign national, an address for notification, your email address or telephone number if you wish to be reached electronically, and the subject of your request. Written applications should be signed. Attach any document that supports your request.

We verify identity before acting. Where we have reasonable doubts about the identity of the person making the request, we may ask for further information solely for that purpose, as permitted by Article 12(6) GDPR. Information supplied for verification is used for nothing else and is retained only within the file of your request, for as long as we must be able to demonstrate that we handled it correctly. A request made by a representative should be accompanied by a power of attorney.

• Electronic channel: hello@straitcore.com
• Written channel: Fulya Mah. Büyükdere Cad. Quasar No: 76, İç Kapı No: 188, Şişli / İstanbul 34394, Türkiye
• We reply through the channel you used, unless you ask us to reply differently.
• If a request is unclear or too broad to act on, we will say so and ask you to narrow it, rather than refuse it silently.

Response Times and Costs

Under KVKK, we conclude your request as soon as possible and in any event within thirty days of receiving it. The response is free of charge. Where responding requires an additional cost, we may charge a fee not exceeding the tariff determined by the Personal Data Protection Board; if the cause of the request is an error on our side, any fee collected is refunded.

Under the GDPR, we respond within one month of receipt. Where a request is complex, or where you have made a number of requests, that period may be extended by up to two further months; if we need the extension we will tell you within the first month and explain why. Action taken under Articles 15 to 22 is free of charge. Only where a request is manifestly unfounded or excessive, in particular because of its repetitive character, may we charge a reasonable fee reflecting administrative costs or refuse to act — and if we refuse, we will tell you why and inform you of your right to complain to a supervisory authority.

If we cannot fulfil a request, we will state the legal ground for that outcome instead of leaving it unanswered.

International Transfers

Loading a page of this website sends no data about your visit to any third-party service: there is no analytics provider, no advertising network, no external font or asset network, and no embedded third-party component. The access records described above are generated and held within the hosting environment that serves this website; any provider involved in operating that environment acts on our instructions as a data processor, under Article 12(2) of Law No. 6698 and Article 28 GDPR, and does not use those records for its own purposes. Outbound links on this site — to our product sites and to our LinkedIn and Instagram profiles — lead to organisations that are separate controllers governed by their own policies; nothing about you is sent to them unless you choose to follow a link.

Email is different in nature. When you write to us, your message necessarily passes through the email infrastructure of your provider and of ours, and a message sent from outside Türkiye reaches us across a border by definition. Where any transfer of personal data outside Türkiye takes place in connection with our correspondence with you, it is carried out in accordance with Article 9 of Law No. 6698, and where the GDPR applies, on the basis of the safeguards required by Chapter V of the Regulation.

We do not sell personal data, and we do not transfer it to third parties for their own marketing purposes.

Complaints and Supervisory Authorities

We ask that you contact us first, because most requests can be resolved directly and quickly. Under Turkish law this is more than a courtesy: the two steps are sequential.

Article 14(2) of Law No. 6698 provides that a complaint may not be brought before the application route to the data controller has been exhausted, so please write to us first and allow the thirty-day period to run before applying to the Board. If your application is then rejected, if you find our response insufficient, or if we do not respond within thirty days, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning our response, and in any case within sixty days of the date of your application to us. The Board operates under the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), which publishes its application procedures at kvkk.gov.tr.

Under the GDPR there is no equivalent requirement: you may lodge a complaint with a supervisory authority at any time, whether or not you have contacted us first, and doing so is without prejudice to any other administrative or judicial remedy. You may address the supervisory authority of the EU or EEA member state of your habitual residence, of your place of work, or of the place where the alleged infringement occurred.

Requests Concerning Our Products

Adspotz, Horecas, TripaWise and OtOrder are operated on their own domains. Subscriptions, payments, user accounts, and the customer and end-user data associated with them are handled there, not on this website. Each product publishes its own legal documents — at minimum a privacy notice and terms of service — and the controller relationship for that data is defined in those documents.

A request about data held in one of those products should therefore be addressed through the contact route published on the relevant product site. If you send such a request to hello@straitcore.com because you are unsure where it belongs, we will not leave it unanswered: we will tell you which channel applies and how to reach it, so that no time is lost against the statutory response periods.

• This page and its commitments apply to the straitcore.com root address.
• Product sites may operate different retention periods, processors, and contact channels.
• Nothing on this page overrides or replaces the legal documentation of a product site.

Updates to This Page

We revise this page when our practices change, when the structure of this website changes, or when the applicable legislation or the guidance of the competent authorities changes. The version published at straitcore.com/gdpr/ is always the current one, and it supersedes any earlier version on publication. The related documents are our Privacy Policy at straitcore.com/privacy/, our Terms of Service at straitcore.com/terms/, and our Cookie Policy at straitcore.com/cookies/.

If you have a question about anything written here, or you believe a statement on this page no longer matches how the website behaves, write to hello@straitcore.com and tell us what you observed. We would rather correct the text than defend it.