GDPR Notice

This website is operated as a public information presence. We do not maintain a CRM, marketing list, customer database, lead-scoring system, or behavioural profiling. The only personal data processed through the website is:

1. Strictly necessary cookies (session, security, language).
2. Google Analytics with anonymised IP, aggregated reporting only — advertising features, remarketing audiences, and cross-device tracking are disabled.
3. Contact channel content — if a visitor voluntarily contacts us by e-mail or phone, only the content of that communication is processed for the purpose of responding; no record is stored beyond what is necessary to answer the request and statutory retention under Turkish tax/accounting law where invoices are issued.

No other personal data category is collected, profiled, sold, or shared with third parties for marketing purposes.

The controller within the meaning of Article 4(7) GDPR is the following legal entity:

DEMSA Yapı is not required to designate a Data Protection Officer (DPO) under Article 37 GDPR and therefore no formal DPO has been appointed. All data protection enquiries may be addressed to the contact point above.

Your personal data is processed for the purposes set out below, on the legal bases provided under Article 6(1) GDPR:

• Performance of a contract (Art. 6(1)(b)): preparation of offers and conclusion/performance of contracts for construction, contracting, project management and consultancy services.
• Legal obligation (Art. 6(1)(c)): compliance with tax, commercial books, employment and audit obligations under applicable law.
• Legitimate interest (Art. 6(1)(f)): site security, prevention of fraud and abuse, service quality improvements and direct marketing (limited to existing clients).
• Consent (Art. 6(1)(a)): non-essential cookies (analytics, marketing, preferences), international marketing transfers and sending of electronic commercial communications.
• Vital interests (Art. 6(1)(d)): processing of contact data required to respond to occupational health and safety incidents on construction sites where applicable.

Personal data is processed in the categories of identity (first name, last name), contact (email, phone, postal address), transaction security (IP address, log records, cookie identifiers), customer transaction (request, offer, contract history) and marketing (cookie-based preferences and interest data).

Your personal data is disclosed only to the following categories of recipients, under contractual and statutory safeguards:

• Subcontractors and business partners: to the extent necessary for the performance of construction, engineering and consultancy contracts.
• Competent public authorities: where required by law or upon the request of an authorised authority.
• Accounting firms and law offices: for tax, accounting, litigation and compliance processes.
• Hosting, email, CDN and analytics providers: acting as processors under Article 28 GDPR and bound by written data processing agreements.

The controller is established in Türkiye, which is considered a country outside the EEA. For data subjects accessing the site from the EU/EEA, personal data is transferred to Türkiye or to other third countries only where one of the following safeguards is in place: (i) a European Commission adequacy decision, (ii) Standard Contractual Clauses (SCCs) under Article 46 GDPR, or (iii) the data subject's explicit and informed consent under Article 49 GDPR. SCC-based data processing agreements are in place with our hosting and analytics providers.

Personal data is retained for the duration required by the purpose of processing or by the minimum retention periods provided by applicable law. As a general rule: contact form data — 2 years; contract and customer data — 10 years from the end of the relationship; invoice and accounting data — 10 years; site log records — 2 years; cookie consent record — 12 months; analytics and marketing cookies — up to 24 months. At the end of the period, data is deleted, destroyed or irreversibly anonymised.

As a data subject resident in the EU/EEA, you have the following rights under the GDPR:

• Right of access (Art. 15) — to obtain information about whether and how your data is processed.
• Right to rectification (Art. 16) — to have inaccurate or incomplete data corrected.
• Right to erasure / right to be forgotten (Art. 17) — to request deletion of your data.
• Right to restriction of processing (Art. 18) — to request that processing be limited in specific situations.
• Right to data portability (Art. 20) — to receive your data in a structured, commonly used, machine-readable format and to have it transmitted to another controller.
• Right to object (Art. 21) — to object to processing based on legitimate interest or for direct marketing purposes.
• Right not to be subject to automated decision-making and profiling (Art. 22).
• Right to withdraw consent at any time without affecting the lawfulness of prior processing (Art. 7(3)).

To exercise your rights, please contact gokdemirbas@hotmail.com. Requests are answered free of charge within 30 days, in accordance with Article 12(3) GDPR.

Data subjects resident in the EU/EEA have the right to lodge a complaint with the competent supervisory authority of the Member State of their habitual residence, place of work or the place of the alleged infringement. Data subjects resident in Türkiye may apply to the Personal Data Protection Authority (KVKK Kurulu — www.kvkk.gov.tr).

Personal data is obtained either directly from you (contact form, email, telephone, contract processes) or indirectly from publicly available sources or from our business partners. In the case of indirect collection, the information required under Article 14 GDPR is provided within a reasonable period and at the latest at the first communication with you.

DEMSA Yapı does not carry out automated decision-making or profiling within the meaning of Article 22 GDPR that produces legal effects or similarly significantly affects the data subject.

Provision of personal data is a contractual requirement for pre-contractual discussions and the provision of services. Failure to provide such data may make it impossible to prepare an offer or to enter into a contract.

This notice may be updated to reflect changes in legislation or processing operations. The current version is always published on this page. Version: 1.0.