Identity of the data controller
This privacy notice has been prepared by Doon Studio, in its capacity as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
- Data controller: Doon Studio
- Address: Tuna Mah. 1690. Sk. No:48 K:1 D:102, 35600 Karşıyaka / İzmir
- Email: [email protected]
For the technical details of our data processing activities, see our Privacy Policy page; for our terms of service, see our Terms of Use page.
Categories of personal data processed
| Category | Data included |
|---|---|
| Identity | First name, last name |
| Contact | Email address, phone number, company or organization name |
| Customer transaction | The service you request, project scope, content of correspondence, booking records |
| Transaction security | IP address, server access logs, bot verification records |
| Marketing | Site usage statistics (subject to cookie consent) |
| Finance | Billing and payment information, if a contract is concluded |
We do not collect special categories of personal data (health, biometric data, membership information, etc.); we ask that you not enter such information into our forms.
Method of collecting personal data
Your personal data is collected electronically, by fully or partially automated means, through the following channels:
- The quote form and other contact forms on the site
- Our booking system (cal.doon.studio)
- Email, phone, and WhatsApp correspondence
- Server logs and cookies generated during site visits
Purposes of processing and legal grounds
| Purpose | Legal ground |
|---|---|
| Evaluating your request, preparing a quote, scheduling a discovery call | Direct relation to the establishment or performance of a contract (Art. 5(2)(c)) |
| Managing contract processes, keeping invoicing and accounting records | Fulfillment of a legal obligation (Art. 5(2)(ç)) |
| Ensuring site and system security, preventing misuse | Legitimate interest (Art. 5(2)(f)) |
| Exercising the right of defense in legal disputes | Establishment, exercise, or protection of a right (Art. 5(2)(e)) |
| Measuring site usage, evaluating content and advertising performance | Explicit consent (Art. 5(1)) |
Transfer of personal data
In accordance with the conditions set out in Articles 8 and 9 of KVKK, your personal data may be transferred to:
- The hosting, security, statistics, and calendar service providers we work with to provide the service;
- The persons from whom we receive financial advisory and accounting services;
- Authorized public institutions and organizations, upon request and to the extent required by legislation.
Because our servers are located in Germany and some of our service providers are established abroad, your data may be processed outside Türkiye. These transfers are made under KVKK Art. 9, within the framework of the providers’ standard contractual clauses and undertakings. We do not sell your data to third parties for marketing purposes.
Retention period
Your personal data is retained for as long as necessary for the purpose for which it is processed and for the statute of limitations periods set out in the relevant legislation. Quote requests not concluded are kept for 3 years from the last contact, and financial records for the periods required by the Tax Procedure Law and the Turkish Commercial Code. When the period expires, the data is deleted, destroyed, or anonymized.
Your rights as a data subject
Under Article 11 of KVKK, you have the right to:
- Learn whether your personal data is processed and, if it has been processed, request information about it
- Learn the purpose of processing and whether the data is used in line with that purpose
- Know the third parties to whom your data is transferred in Türkiye or abroad
- Request the correction of data that is incomplete or inaccurately processed
- Request the deletion or destruction of your data under the conditions set out in Article 7 of the Law
- Request that the correction, deletion, and destruction operations be notified to the third parties to whom your data has been transferred
- Object to a result to your detriment arising from the analysis of your data exclusively by automated systems
- Request compensation for damage if you suffer damage due to unlawful processing
Application procedure
You can submit requests concerning your rights through the following channels, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- By email: to [email protected], from the email address registered in our system
- In writing: by a petition bearing your wet-ink signature, sent to Tuna Mah. 1690. Sk. No:48 K:1 D:102, 35600 Karşıyaka / İzmir
Your application must clearly state your full name, your contact details, and the subject of your request. Depending on its nature, your request will be concluded free of charge within 30 days at the latest; if the process requires an additional cost, the fee in the schedule set by the Personal Data Protection Board may be charged.
If your application is rejected, you find our response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of the date you learn of the response and, in any case, within 60 days of the application date.
Changes
This privacy notice is updated as our data processing activities or the legislation change. The current version is always published on this page.
Last updated: August 29, 2026