KVKK Clarification Text

1. Identity of the Data Controller

In accordance with Law No. 6698 on the Protection of Personal Data ("KVKK") of the Republic of Turkey, your personal data may be processed by Narcraft Studio ("Narcraft" or the "Studio") acting as the Data Controller within the scope detailed below.

2. Personal Data Categories Processed

The following personal data categories are processed through our website and studio operations:

• Identity Information: First and last name.
• Contact Information: Email address, telephone number, represented company/organization.
• Request & Inquiries Information: Project descriptions, brief details, message contents, and collaboration notes transmitted via the contact form.
• Transaction & Security Data: IP address, website entry/exit timestamps, network connection logs, and browser/device metadata.

3. Purposes of Data Processing

In accordance with Articles 4, 5, and 6 of the KVKK, your personal data is processed for the following purposes:

• Evaluating, processing, and responding to inquiries, comments, suggestions, and project requests sent via our contact channels;
• Preparing custom creative engineering, experience design, and digital branding proposals, and conducting pre-contractual negotiations;
• Planning, managing, and executing studio workflows, client communications, and business operations;
• Ensuring website data security, detecting and preventing cyber threats or malicious submissions, and maintaining system integrity;
• Fulfilling legal disclosure and retention duties mandated by Turkish laws and competent public bodies.

4. Methods of Collection & Legal Grounds

Your personal data is collected via electronic channels—specifically through the interactive contact forms on https://narcraft.com, direct email correspondence, and automated server logging systems—by automated or partially automated means.

The legal grounds under Article 5 of the KVKK are:

• KVKK Article 5/2-c: Processing is directly necessary for the establishment or execution of a contract to which the data subject is party (responding to project requests and preparing service proposals);
• KVKK Article 5/2-f: Processing is mandatory for the legitimate interests of the Data Controller, provided that it does not infringe upon the fundamental rights and freedoms of the data subject (maintaining site security, optimizing performance, and client satisfaction);
• KVKK Article 5/2-ç: Processing is mandatory for the Data Controller to fulfill its statutory legal obligations (maintaining network logs and responding to lawful requests);
• KVKK Article 5/1: Explicit consent where legally required (optional analytics and marketing cookies).

5. Transfer of Personal Data

In line with the processing purposes outlined above and pursuant to Articles 8 and 9 of the KVKK, your personal data may be shared with:

• Vetted technical service providers, cloud hosting infrastructures, and email delivery platforms (both within Turkey and abroad) supporting our digital operations;
• Judicial, regulatory, or administrative authorities if required by binding statutory mandates or legal disputes.

6. Data Subject Rights (Article 11 of KVKK)

Pursuant to Article 11 of the KVKK, you possess the following rights:

• To learn whether your personal data has been processed;
• To request information if your personal data has been processed;
• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose;
• To know the third parties to whom personal data is transferred domestically or abroad;
• To request rectification if your personal data has been processed incompletely or inaccurately;
• To request deletion or destruction of your personal data under conditions specified in Article 7 of the KVKK;
• To request that rectification, deletion, or destruction be notified to third parties to whom data has been transferred;
• To object to a result against you arising solely from analysis through automated systems;
• To demand compensation for damages in case of unlawful processing of your personal data.

7. Application Procedures

In accordance with the Communiqué on Principles and Procedures for Application to the Data Controller, you may submit your requests to Narcraft by sending an email with documentation verifying your identity to:

Your application will be concluded free of charge as quickly as possible and within 30 (thirty) days at the latest. If the procedure incurs an additional cost, the fee prescribed in the tariff published by the Personal Data Protection Board may be requested.