1. Data controller

Metoraz Finansal Yazılım A.Ş.
Adalet Mah. Manas Bulv. No:39 İç Kapı 3408 Folkart Towers B Kule, Bayraklı / İzmir
Phone: +90 232 808 03 32
Privacy requests: info@metoraz.com

For privacy and KVKK requests please write to info@metoraz.com.

2. Categories of personal data

In practice the following categories may be processed:

• Contact form: name, email, company, service preference, message; Cloudflare Turnstile token; IP address for rate limiting and the internal notification.
• Booking form: name, email, optional company, topic, duration, meeting type (video / phone / in person), phone (only if you choose a phone call), notes, chosen slot.
• Online training registration: name, email, optional company and note, chosen session, language.
• Metoraz AI in BS Field products: text and context you send for the operations assistant and analysis (Groq and Google Gemini models; we do not use OpenAI or Cerebras).
• Technical data: IP address, browser and device signals (Turnstile), language preference, cookies and local storage, analytics (only with consent).
• Admin panel: session data for the authorised admin account (tolga@metoraz.com) via Google or email magic link.

The site has no form that asks for special-category data under Article 6 KVKK. If you put such data in a free-text field, it is processed only as you sent it, to handle your request.

3. How data is collected

Data is collected electronically: website forms, booking and training requests, cookie choices, server logs and rate-limit records, and admin login. Automatic collection covers technical data from your browser, security checks and, if you consent, measurement tools.

4. Purposes

• Receive, answer and fulfil contact, meeting and training requests
• Write the meeting to a calendar and create a Google Meet link when you choose video
• Manage training registrations and seat limits
• Protect forms against automated abuse and apply rate limits
• Run the site and apply language and cookie choices
• If you consent, measure site use in aggregate and show embedded third-party content
• Let the admin manage site content

5. Legal bases (KVKK Arts. 5 and 6)

• Art. 5(1) explicit consent: the contact and training checkboxes; the cookie banner for analytics and embedded content (LinkedIn, YouTube, Vimeo, Loom).
• Art. 5(2)(c): processing needed to set up or perform the meeting, enquiry or training you asked for.
• Art. 5(2)(f): site security, rate limiting, remembering language and cookie choice, admin session, where this does not harm your fundamental rights.
• Art. 5(2)(ç) / other law: keeping records if a legal duty or dispute requires it.

6. Recipients

• Vercel Inc.: website and API hosting; region fra1 (Frankfurt, EU)
• Supabase: database, file storage and admin authentication; AWS eu-central-1 (Frankfurt, EU)
• Resend: email delivery
• Groq, Inc. and Google (Gemini): Metoraz AI features in BS Field products only
• Google: Calendar and Meet; Analytics 4 after consent; YouTube if a video embed is shown
• Cloudflare, Inc.: Turnstile
• LinkedIn, Vimeo or Loom: only after you consent to the relevant embed

For KVKK applications please write to info@metoraz.com.

7. Transfers abroad (KVKK Art. 9, as amended by Law No. 7499)

Primary hosting and the database are kept in Frankfurt in the European Union (Vercel fra1; Supabase on AWS eu-central-1). Some processors are established in the United States or process data there, including Resend, Google (Calendar, Meet, Analytics, YouTube, Gemini), Cloudflare (Turnstile), Groq (Metoraz AI) and, if you consent, LinkedIn / Vimeo / Loom. Depending on the purpose, transfers may cover identity and contact details, message content, AI chat text, IP addresses, cookie identifiers and technical logs. Transfers of analytics and embeds rely on your explicit consent after this information (Art. 9(6)(a)). Hosting, the database, form delivery and email rely on appropriate safeguards and/or necessity to provide the service (Art. 9(4) and related paragraphs). This page does not claim that standard contracts have already been filed with the Board; the owner should confirm that with counsel.

8. Retention

The codebase does not define an automatic deletion schedule. Contact, booking, training and partner records are kept for a reasonable time to fulfil the request and handle related claims, then deleted or anonymised. Cookie and consent periods are in the Cookie Policy. Rate-limit records are short-lived technical logs.

9. Your rights (KVKK Art. 11)

You may ask whether your data is processed; request information; learn the purpose and whether it is used in line with that purpose; know the third parties to whom it is transferred; request correction; request deletion or destruction under Art. 7; ask that correction or deletion be notified to recipients; object to a result against you from automated analysis; and claim compensation if you suffer damage from unlawful processing.

10. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, send your request in Turkish, with information that identifies you, by email to info@metoraz.com or in writing to the controller in Adalet Mah. Manas Bulv. No:39 İç Kapı 3408 Folkart Towers B Kule, Bayraklı / İzmir. Include your name, a contact address for reply, the request and information needed to verify your identity.

We answer within the Communiqué periods, as a rule within 30 days and free of charge. Extra cost may apply only as that Communiqué allows. You may complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu).

11. Cookies

Non-essential measurement and embeds load only after you accept them on the cookie banner. See the Cookie Policy.