Privacy policy

How we process personal data and how you can exercise your rights under Türkiye’s Personal Data Protection Law (KVKK).

Last updated: 28 September 2026

Who is responsible

The provider named below operates as a sole proprietor and is the controller responsible for the personal information described here. In this notice, “we” and “us” refer to that provider.

This notice is provided under Article 10 of Law No. 6698. It covers this website, enquiries, business correspondence and private website proposals. Our official business address is in Türkiye. Reading this notice, visiting the site or sending an enquiry is not consent to marketing or unrelated processing. A client project involving customer or staff data needs its own notice and agreed data-processing arrangements.

We collect data automatically or partly automatically through website requests, forms and email, and from public business sources. We also process manually collected correspondence and business information when it forms part of our records.

Visiting the website

Our Hostinger infrastructure automatically processes connection data, including IP address, request time, requested page or file, response status, browser information and any referring page supplied by your browser. We use these data to deliver the website, diagnose faults and prevent abuse. The basis is Article 5(2)(f) KVKK: necessary legitimate interests in a reliable, secure service, subject to your fundamental rights and freedoms. No account is required.

Fonts, photographs, illustrations and example websites are served from this website. Viewing them does not load an external font service, social-media widget or embedded third-party website.

Language preferences

When you visit an address without a language code, our server briefly uses your IP address and, for some countries, browser language preferences to choose a supported language. The country lookup is local; we do not retain these data for language selection or send them to a geolocation provider. English is the fallback. A language already in the URL takes priority, and you can choose another from the homepage’s language menu.

This temporary language selection relies on Article 5(2)(f) KVKK, for the limited legitimate interest in presenting an understandable website without keeping a location profile.

Aggregate usage counts

We keep separate daily counts (UTC) of the languages used to request public pages and the approximate countries of those requests, to understand website usage. These are request counts, not unique visitors or time spent. We do not store page-by-page counts, combined country-and-language records or individual browsing histories. Our server briefly uses your IP address with a local country database, without sending it to a geolocation provider or retaining it for analytics. Country estimates may be inaccurate or unavailable. The statistics collector receives only the language and country code, not your IP address, visitor identifiers, browser details, page URL, query parameters, form contents or individual request times.

Counting adds no tracking code, cookies, browser storage or extra requests and uses no third-party analytics service. Requests carrying Do Not Track (DNT: 1) or Global Privacy Control (Sec-GPC: 1) are not counted.

The private statistics database keeps at most the latest 30 UTC calendar days, including today, and automatically removes older daily counts. Emailed summaries are separate copies containing only aggregate counts. Any temporary personal-data processing needed to produce the totals relies on the limited legitimate interest in improving the website under Article 5(2)(f) KVKK, subject to your fundamental rights and freedoms.

Cookies, navigation and tracking

The website application does not set cookies, use advertising pixels or cross-site tracking, build marketing profiles or sell personal information.

Browser navigation history restores your chosen room and reading position. It contains no form answers, and the application stores no scene screenshots. Your browser controls its own caching, history, autofill and session restoration.

Using the contact form or email

The contact form requires your name, email address and message. On submission, these are sent over an encrypted connection to our server and forwarded through Hostinger Email to contact@robinbyte.com. Your name and email form the reply-address information; the email body contains your message. No automatic acknowledgement is sent to you.

Answers remain in the page while you write and are processed temporarily on the server. The application does not save them in browser storage, an application database or application logs. Received correspondence is stored in our Hostinger mailbox.

To prevent spam and duplicate submissions, the server checks request origin, message size and frequency. It holds protected connection and submission fingerprints temporarily in memory. These are security records, not anonymous data or advertising profiles. The legal basis is the necessary legitimate interest in protecting contact and unsubscribe services under Article 5(2)(f) KVKK, subject to your fundamental rights and freedoms.

You can also email us directly. We receive your address, message and any other information or attachments you choose to include. We use the information to answer your question, discuss your requirements and manage any project you pursue. An enquiry does not sign you up for marketing or create a purchase.

Name, contact details, message contents and project correspondence are processed under Article 5(2)(c) KVKK where necessary to establish or perform a contract with you. For general enquiries and people representing a business, Article 5(2)(f) applies only where responding and managing that relationship is necessary and does not harm fundamental rights and freedoms. Please do not send passwords, payment-card details or special-category personal data through the form.

Business information from public sources

To assess a potential business project and prepare a private website proposal, we may use relevant information published on a business’s own website, public business directories or its public business social-media pages. This can include a sole trader’s or business contact’s name and role, business email address, telephone number, business address, opening hours and descriptions of the business and its services. Information identifying an individual remains personal information even when it is publicly available.

A proposal requested for a contract with you may rely on Article 5(2)(c) KVKK. Information you have made public yourself may be used under Article 5(2)(d) only consistently with your purpose in publishing it. Other personal-data research requires a valid basis; reliance on Article 5(2)(f) requires a necessary, proportionate business purpose and a balance that protects your fundamental rights and freedoms. Public availability is not a general reuse licence.

When personal data come from another source, we provide the required information within a reasonable period, at the first communication if used to contact you, or no later than the first disclosure if transferred. Publishing this page alone does not fulfil that individual notice requirement.

A published email address, an enquiry or a private preview is not marketing consent. Commercial messages are subject to Law No. 6563 and its implementing rules, including any required consent and Message Management System (İYS) procedures. The exception for recipients who are merchants or tradespeople does not remove refusal rights or personal-data obligations.

Where promotional data processing requires explicit consent, it is obtained separately under Article 5(1) KVKK and can be withdrawn. Another processing basis is used only if its own conditions are met; it cannot replace permission required to send a commercial message. Refusing marketing does not prevent you from making an enquiry.

You can object to direct marketing at any time, without giving a reason. Email contact@robinbyte.com or use the contact details above. We stop promotional use and keep only the limited refusal record described below.

Unsubscribing from marketing emails

The unsubscribe link in our email signature opens a form asking only for the recipient’s email address. It is sent over an encrypted connection and is not placed in the URL or browser storage. No password, account or reason is required; the form records the supplied address without verifying mailbox ownership.

A personalised link can instead carry an encrypted reference to your email address, removed from the address bar and handled temporarily. Do not share it: another person using it can unsubscribe that address.

Before confirming your request, we save the email address, request date and internal notification status in a private refusal record. We notify our contact@robinbyte.com mailbox to apply your choice to our email activity, retrying failed notifications. No confirmation email is sent to you.

The refusal record is used to stop unwanted commercial messages and demonstrate that your request was handled. Its bases are Article 5(2)(ç) KVKK for the duty to respect refusal under Law No. 6563, and Article 5(2)(e) where evidence is necessary to establish, exercise or protect a right. Refusal is free and commercial messages must stop within three business days. The private record has no automatic expiry; it is kept only as long as needed to honour the refusal or a specific legal duty or claim. It is not another marketing list.

If a link does not work, you can reply to the email you received or email contact@robinbyte.com to object. You do not have to give a reason. The automatic web flow needs JavaScript; email remains available without it.

Recipients and processing outside Türkiye

Connection data are shared with hosting and infrastructure providers to deliver and secure the website. Enquiry and correspondence data are handled by the email provider to send, receive and store messages. Only information necessary for a legal obligation or claim is disclosed to competent authorities or legal advisers, under Articles 5(2)(ç), 5(2)(e) and 8 KVKK, as applicable.

Hostinger’s hosting and email services involve processing outside Türkiye. This includes connection data for website delivery and security, and names, email addresses, messages and correspondence provided when communicating with us. These transfers are subject to the requirements of Article 9 KVKK. Reading this notice or sending an enquiry does not constitute explicit consent to an overseas transfer.

You may request information about the recipients of your personal data and its processing outside Türkiye using the contact details above. We handle these requests under the rights and application procedure explained below. Your own email provider determines how it handles your messages.

How long information is kept

• Browser navigation: retention follows your browser’s history and restoration settings.
• Contact-form protection: connection counters and repeated-content fingerprints normally expire after 10 minutes. Submission references, uncertain-delivery records and site-wide send counters cover up to 24 hours. Expired records are removed on subsequent requests or by a minute-by-minute cleanup; all are held in memory and cleared on service restart.
• Unsubscribe protection: separate connection fingerprints and request counters are cleared on the next unsubscribe request after the minute changes, or when the service restarts.
• Technical records: the web application keeps no routine page-access logs. Diagnostic and entry-point operational logs rotate by storage size, so their lifetime varies with traffic and errors. Records needed for an unresolved security incident or legal preservation duty are retained for that purpose. Hosting-provider records follow the provider’s service and legal retention requirements.
• Enquiries and project correspondence: retention is assessed against whether your enquiry is resolved, a resulting project or agreed support is ongoing, and whether a specific legal claim or statutory record-keeping duty applies. A general enquiry is not automatically treated as an invoice or an accounting record.
• Commercial-message records: where applicable, consent records are retained for three years after consent ceases to be valid, and other commercial-message records for three years from recording, as required by the commercial electronic-message rules. A longer-lived refusal record remains limited to preventing unwanted contact or a specific legal duty or claim.
• Business research: personal information collected for a possible project is kept only while it is needed to assess or discuss that project. When that purpose ends, it is deleted unless a specific legal duty or claim requires retention. If you object to marketing, a minimal do-not-contact record can remain for as long as needed to honour the objection and prevent reintroduction of the same contact.
• A declined website draft: if you decline, we remove the private preview from the internet and delete the draft website and its assets. Separate correspondence and any legally required records follow the criteria above.

Records required for a specific statutory duty are retained under Article 5(2)(ç) KVKK; evidence needed for a legal claim may be retained under Article 5(2)(e). These grounds do not justify keeping every enquiry indefinitely or using retained records for marketing. When all processing grounds end, the data must be erased, destroyed or anonymised under Article 7 KVKK and the applicable disposal rules.

Your rights

You may exercise your rights under Article 11 KVKK, including information about processing and recipients, correction, deletion where the legal conditions are met, notification of relevant corrections or deletion to recipients, objection to an adverse result based solely on automated analysis, and compensation for damage caused by unlawful processing. Where processing relies on explicit consent, you may withdraw it.

Send a signed written request to the postal address above, or email contact@robinbyte.com from an address you previously gave us and that is recorded in our systems. Other methods permitted by the applicable application rules remain available. Include your name, request, notification address and the identity or authority information those rules require. We request only information necessary to process the request and verify identity; do not send unrelated identity documents.

We conclude requests as soon as possible and within 30 days under Article 13 KVKK, giving a written or electronic response and reasons for any refusal. The identity, contact and request information necessary to fulfil this duty is processed under Article 5(2)(ç). Requests are normally free; only additional costs permitted by the Board’s tariff may be charged. A fee caused by our error is refunded.

Privacy concerns and complaints

Apply to us before lodging a complaint with the Personal Data Protection Board. If your request is refused, the response is insufficient or no response arrives within 30 days, Article 14 KVKK permits a Board complaint within 30 days of learning the response and, in any event, within 60 days of your application. The right to seek judicial remedies and compensation remains unaffected.

Official application guidance · Official complaint guidance

Automated decisions and external links

This website does not make decisions about you through automated profiling. The animated scenes and illustrative faces do not use your camera, microphone or facial information.

External websites and email applications operate under their own privacy information when you choose to use them. We publish changes to this notice here and update the date above. Where a material change requires further information or permission, we provide that information or obtain the required permission before using your information for the new purpose.