PRIVACY
Privacy notice
How we handle the personal data you send us through this site — under Turkish Personal Data Protection Law No. 6698 (KVKK), and, where you are in the EU or the EEA, under the General Data Protection Regulation (GDPR).
Data controller
ApiPrime® — Kırmızıtoprak Mh. Porsuk Blv. Nilay Sk. Emin Apt. No:11/B, 26020 Odunpazarı/Eskişehir, Türkiye.
Contact: [email protected] · +90 222 606 0200
ApiPrime decides the purposes and the means of the processing described here, and is the data controller for it.
Which law applies to you
ApiPrime is established in Türkiye, so Law No. 6698 (KVKK) governs everything described here, wherever you happen to read it from.
If you are in the European Union or the wider EEA, the GDPR applies on top of that. Article 3(2) extends it to controllers established outside the Union that offer services to people inside it, which is what this site does. That is why a company in Türkiye publishes a GDPR notice.
Both frames describe the same processing; what differs is the rules they attach to it. Where a rule comes from one law and not the other, the section says which.
What we collect
- Contact form Your name, organization, email address, selected project type and message. All of it is entered by you.
- Quote configurator The service type, sector, scope answers, timeline and budget range you select, together with your contact details.
- Technical logs Server access logs containing IP address, browser information and request time, kept for security and error tracking.
Why we process it, and on what basis
We process your data to answer your enquiry, prepare a proposal and conduct the discussions that come before a contract. Unless you separately opt in, your data is not used to send marketing messages. We do not sell or rent what you send us.
Filling in the form or the configurator is neither a statutory nor a contractual requirement. You decide what to tell us; without those details, though, we cannot answer your enquiry.
Under the KVKK the same processing rests on Article 5(2)(c) — directly related to the conclusion or performance of a contract — and on Article 5(2)(f), legitimate interest. Analytics runs on your explicit consent. In GDPR terms:
- Contact form and quote configurator — Art. 6(1)(b) GDPR Processing for steps taken at your own request before a contract: answering the enquiry, preparing a proposal, clarifying scope.
- Technical logs — Art. 6(1)(f) GDPR Our legitimate interest in operating this site, keeping it secure and diagnosing faults.
- Microsoft Clarity — Art. 6(1)(a) GDPR Only with your consent. Reading and writing in your browser’s storage rests on that same consent, under the ePrivacy rules as implemented nationally.
- Withdrawal — Art. 7(3) GDPR You can take back a consent at any time. It takes effect going forward; the processing that happened before it stays lawful.
How long we keep it
Enquiries that do not turn into a proposal are kept for a maximum of 24 months and then deleted. Where a contract is signed, statutory retention periods apply.
If you ask us to delete your data, everything not subject to a legal retention obligation is removed within 30 days of your request.
Technical logs are kept only as long as secure operation and fault diagnosis require.
Hosting and recipients
The site and its form submissions are hosted on DigitalOcean infrastructure in a European Union region. Traffic between your browser and the site is encrypted with TLS. Email you send us directly is delivered through our corporate email provider.
When you submit a form, your request also reaches our team as a notification: a summary containing your name, company, email address and form answers is delivered to ApiPrime’s own corporate WhatsApp line through the WhatsApp Business API. The recipient is ApiPrime itself; the Meta companies operating the WhatsApp Business Platform act solely as a data processor providing the transmission infrastructure.
If you allow analytics in the cookie bar, measurement data about how you use the site is transferred to Microsoft Clarity, operated by Microsoft Corporation. The tool records interactions such as mouse movement, clicks and scrolling, and those recordings can be replayed as a session afterwards; because the contact forms are masked, your name, company, email address, phone number and message text never enter them. If you do not allow it, the Clarity code is never added to the page and not a single request leaves your browser; you can withdraw consent at any time. The Cookie Policy has the detail.
Apart from the hosting, transmission and measurement providers listed above, your personal data is not shared with third parties. Disclosure to competent public authorities may occur where required by law.
Where your data travels
The site and the form data sit in a European Union region. Because ApiPrime is established in Türkiye, we read that data from there — from a third country for which the European Commission has issued no adequacy decision.
For the form and configurator data, that access rests on Art. 49(1)(b) GDPR: it is necessary for steps taken at your own request before a contract. The same goes for the WhatsApp notification that reaches our business number in Türkiye — it leaves the EEA too, and Art. 49(1)(b) GDPR is the basis for it as well.
Measurement data reaches Microsoft Corporation in the United States. That transfer takes place only once you have given explicit consent (Art. 49(1)(a) GDPR). Microsoft states that it applies its own transfer safeguards as well; what we rely on is your consent.
Under the KVKK the direction is reversed: everything outside Türkiye counts as abroad. Our servers sit in the European Union, so keeping the site and your form data there is itself a transfer abroad, and so are the WhatsApp notification and — if you allow it — the Clarity measurement. The measurement rests on your explicit consent alone.
Your rights if the GDPR reaches you
Where the GDPR applies to you — that is, where you are in the EU or the EEA — these are your rights. If it does not reach you, the KVKK rights further down are yours instead. One is worth stating separately: you can object at any time to processing that rests on our legitimate interest, which here means the technical logs (Art. 21 GDPR).
- Access — Art. 15 Find out whether we process data about you and, if so, what it is, why, how long we keep it and who receives it, and get a copy.
- Rectification — Art. 16 Have inaccurate data corrected and incomplete data completed.
- Erasure — Art. 17 Have your data deleted where one of the conditions in Art. 17 is met and no statutory retention duty stands in the way.
- Restriction — Art. 18 Ask us to limit processing to mere storage while a correction or an objection is examined.
- Portability — Art. 20 Receive the data you gave us in a structured, commonly used, machine-readable format, and have it passed on to someone else.
- Objection — Art. 21 Object to processing that rests on our legitimate interest; here that is the technical logs.
- Withdrawal of consent — Art. 7(3) Take back a consent you gave, such as the one for analytics, with effect going forward.
- Complaint — Art. 77 Lodge a complaint with a supervisory authority: the one where you live, where you work, or where the alleged infringement took place.
Your rights under the KVKK, wherever you are
Law No. 6698 applies to us because we are established in Türkiye, and its Article 11 gives you the rights below. They do not depend on where you are: if you are in Türkiye, or anywhere outside the EU and the EEA, this is the frame that speaks to you; if you are inside it, these rights stand alongside the GDPR rights above.
The KVKK route runs through us first: send your request to us, and if the outcome does not satisfy you, you can take it to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
- Access Learn whether your personal data is processed and, if so, request information about it.
- Purpose Learn the purpose of processing and whether the data is used in line with that purpose.
- Recipients Know the third parties in Türkiye or abroad to whom your data has been transferred.
- Rectification Request correction of incomplete or inaccurate data.
- Erasure Request deletion or destruction of your data within the conditions set by law.
- Objection Object to a result produced against you solely by automated analysis.
- Compensation Claim compensation for damage arising from unlawful processing.
No automated decision-making
We take no decisions about you based solely on automated processing that would have legal effects for you or affect you in a similarly significant way, and we do not profile you within the meaning of Art. 22 GDPR. The same holds under the KVKK: no result about you comes out of automated analysis alone, which is what Article 11 lets you object to.
Your enquiry is read and answered by our team.
How to reach us
Send any request about these rights to [email protected], or in writing to the address above. Handling it is free of charge.
Two clocks run on a request like this. The KVKK gives us 30 days; the GDPR gives us one month from receipt, extendable by up to two further months where a request is complex or where there are several of them — and if that ever applies, we tell you inside the first month (Art. 12(3) GDPR). Thirty days is the one we work to.
Questions about your data?
No deck needed. 20 minutes. The rest is up to you.