Privacy Policy

1. Introduction & Data Controller

This Privacy Policy explains how Narcraft Studio ("Narcraft", "we", "us", or "our"), operating the website https://narcraft.com, collects, uses, stores, and safeguards personal data obtained from visitors, prospective clients, and partners.

We act as the Data Controller under Law No. 6698 on the Protection of Personal Data (KVKK) in the Republic of Turkey and comply with the principles established by the General Data Protection Regulation (EU GDPR) for international visitors.

2. Information We Collect

We collect personal information through two main channels: data you voluntarily provide to us and data collected automatically through technical means.

Information You Voluntarily Provide

• Contact & Identification Data: Full name, corporate email address, telephone number, and company or organizational affiliation submitted via our contact forms.
• Inquiry Content: Project briefs, scopes, budget ranges, and any descriptive text or files you choose to include in messages sent to our team.

Information Collected Automatically

• Technical & Connection Logs: IP address, browser type and version, operating system, device screen resolution, access dates and timestamps, and referring URLs.
• Preference Identifiers: Language preferences and cookie consent status recorded locally in your browser storage.

3. Purposes of Processing

We process your personal information strictly for legitimate business objectives, including:

• Responding to your inquiries, preparing creative and technical proposals, and establishing preliminary client communications.
• Delivering, operating, maintaining, and improving the features, design, and performance of our digital studio website.
• Safeguarding our systems against cyber threats, fraudulent submissions, denial-of-service attacks, and unauthorized access.
• Complying with statutory reporting requirements, tax rules, and binding administrative or judicial requests.

4. Legal Bases for Processing

Our processing activities are anchored on lawful grounds recognized under Article 5 of KVKK and Article 6 of the GDPR:

• Contract Negotiation & Performance: Processing is necessary to take steps at your request prior to entering into a contract or for the performance of an existing agreement (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Legitimate Interests: Processing is necessary for our legitimate interests in operating a secure, responsive studio website and communicating with potential clients, provided your fundamental rights do not override these interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Legal Obligation: Processing is necessary for compliance with a statutory legal obligation to which we are subject (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
• Consent: Where required by law, we rely on your explicit consent (e.g., for optional tracking cookies or non-essential communications) (KVKK Art. 5/1; GDPR Art. 6(1)(a)).

5. Retention & Security

We retain personal data only for as long as required to achieve the purposes for which it was gathered, or to satisfy legal, accounting, and dispute-resolution periods. Inquiry records are generally retained for 2 years following initial correspondence, or for the duration of statutory limitation periods (up to 10 years) where commercial relationships develop.

We implement rigorous technical and organizational measures to protect personal data against accidental loss, unauthorized access, destruction, or alteration. These measures include TLS/SSL encryption in transit, strict access control policies, and regular security audits.

6. Third Parties & International Transfers

We do not sell, rent, or trade your personal information. Data may be shared only with vetted third-party service providers acting on our instructions under confidentiality obligations:

• Cloud Hosting & Edge Infrastructure: Content delivery network and edge computing providers (such as Cloudflare) for performance, DDoS protection, and secure form transport.
• Productivity & Email Infrastructure: Professional email platforms utilized by our studio team to manage client correspondence.
• Legal Authorities: Competent judicial or regulatory bodies when required by applicable law or a binding court order.

7. Your Statutory Rights

Under Article 11 of the KVKK and Chapter III of the GDPR, you are entitled to several rights concerning your personal data:

• Access & Confirmation: Request confirmation as to whether your personal data is being processed and obtain a copy of the data.
• Rectification: Request correction of inaccurate, obsolete, or incomplete personal data.
• Erasure: Request the deletion or destruction of your personal data within statutory conditions.
• Restriction & Objection: Object to processing based on legitimate interests or request restriction of processing under certain circumstances.
• Withdrawal of Consent: Withdraw any previously granted consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Complaint: Lodge a complaint with the Personal Data Protection Authority (KVKK) in Turkey or your local European data protection supervisory authority.

8. Amendments

We reserve the right to revise this Privacy Policy periodically to reflect technological changes, studio expansions, or evolving statutory requirements. The most recent version will always be published on this page with the updated revision date.

9. Contact Us

For any inquiries, requests to exercise your data subject rights, or questions regarding this Privacy Policy, please contact our data protection team: