KVKK notice

01The data controller

The data controller is Codian Limited, a company registered in England and Wales (company number 16333262; registered office: Suite 8791, 5 Brayford Square, London E1 0SG, United Kingdom). For questions about this notice, write to [email protected].

For the business data a company enters in Coudy (its accounts, customers, staff, vehicles and invoices), the controller is the company using Coudy; Codian processes that data only on the company's instructions (as a data processor). Requests from those people go to that company.

02The personal data we process

• Identity: name; company name.
• Contact: e-mail address, phone number.
• Request and meeting: what you asked for (a demo, a quote or a question), your topic, your message, your kind of business and your answers to our questions, the meeting time and format or the call-back time you chose, meeting notes.
• Customer dealings: the company's and its representatives' details for the contract, quotes and invoicing.
• Marketing: whether you want news and offers by e-mail.
• Transaction security: an irreversible, salted digest of your IP address; the page the form was sent from and any campaign tags (utm); the technical data Cloudflare processes to protect the site.
• Site use (only with your consent): what Google Analytics collects — the pages visited, how long the visit lasts, rough location, device and browser type, a cookie identifier — and whether the form was sent, with the request type and product chosen.

03Purposes and legal grounds

• Answering your request, arranging a demo or a meeting and preparing a quote: directly related to entering into a contract (KVKK Art. 5/2-c).
• Installing, running and supporting the Coudy service: performance of the contract (KVKK Art. 5/2-c).
• Meeting tax, accounting and other legal duties: legal obligation (KVKK Art. 5/2-ç).
• Protecting the site and its forms against abuse and automated sends: the controller's legitimate interest (KVKK Art. 5/2-f).
• Measuring how the site is used and improving it (Google Analytics): only if you chose "Accept" on the cookie card, on your explicit consent (KVKK Art. 5/1). You can withdraw it through "Cookie settings" at the foot of every page.
• Sending news and offers by e-mail: only if you ticked that box, based on your explicit consent and your approval under Law No. 6563 (KVKK Art. 5/1). You can withdraw it from the link in every e-mail or by writing to [email protected].

04How the data is collected

The data is collected electronically when you fill in the contact flow on coudy.app, meet with us and become a Coudy customer. Cloudflare Turnstile is used to tell that a form is sent by a person; while doing so it takes technical details from your browser. If you agreed, Google Analytics cookies measure how the site is used.

05Transfers

Your personal data is not sold and not shared with anyone for advertising. It is transferred only as far as the service needs, to:

• Codian's servers (OVHcloud and AWS data centres in the European Union): to keep the site, form and meeting records. This is a transfer abroad made in line with Article 9 of KVKK; there the data is subject to the EU's data protection rules (the GDPR).
• Cloudflare, Inc. (USA): the site's network and the Turnstile check. This too is a transfer abroad made in line with Article 9 of KVKK.
• Google Ireland Limited and Google LLC (USA): measuring how the site is used, only if you agreed (Google Analytics). This is a transfer abroad made in line with Article 9 of KVKK, on the explicit consent you gave on the cookie card. What you type into the forms is never sent to Google.
• An e-mail delivery service: to deliver your request to us and our confirmation e-mails to you.
• Public authorities with legal powers: only when a legal duty requires it.

06Business data in Coudy

Coudy never sends the business data entered in it abroad: on the server in the package it is kept in a Tier III data centre in Turkey, on your own server wherever you choose, and Coudy transfers nothing but telemetry abroad. Telemetry carries no business records and no personal data. The Data Policy has the details.

07Retention

• Form requests and meeting records: at most 2 years after the request is settled, then deleted, destroyed or anonymised.
• The digest of your IP address: kept only to count sends and deleted within 1 day.
• Google Analytics data: at most 14 months at Google; its cookies 13 months in your browser.
• Customer contract and invoicing records: for as long as the relevant laws require.
• Marketing consent: until you withdraw it.

08Your rights

Under Article 11 of KVKK you can apply to the controller to:

• learn whether your personal data is processed and, if so, ask for information about it;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Turkey or abroad it is transferred to;
• ask for it to be corrected if it is incomplete or wrong;
• ask for it to be deleted or destroyed under the conditions of Article 7 of KVKK;
• ask for corrections, deletions and destructions to be passed on to the third parties it was transferred to;
• object to a result against you that comes solely from automated analysis;
• claim compensation if you suffer damage because of unlawful processing.

09How to apply

Send your application by e-mail to [email protected], or in writing to our registered office above. Give your name, your contact details and your request clearly. Depending on its nature, your application is settled free of charge within 30 days at most.

If your application is refused, you find the answer insufficient or it is not answered in time, you can complain to the Turkish Personal Data Protection Board.