Data controller
This policy explains how personal data is collected, for what purposes it is processed, with whom it is shared, and how long it is retained on the website operated by Doon Studio at doon.studio and on its subdomains (including our booking system, cal.doon.studio). Doon Studio is the data controller within the meaning of the Turkish Personal Data Protection Law No. 6698 (KVKK).
- Address: Tuna Mah. 1690. Sk. No:48 K:1 D:102, 35600 Karşıyaka / İzmir
- Email: [email protected]
- Website: doon.studio
This policy on the processing of your personal data applies together with our Terms of Use page.
What data we collect, and where from
Automatically, when you visit the site
- IP address, browser and operating system information, device type
- Pages you visit, time spent on each page, the referring address (referrer)
- Server access logs and security event logs
When you fill out the quote form
The quote form has four steps, and your contact details are saved at the third step. The data collected:
- Full name, email address, phone number
- Company or organization name
- Project type, scope preferences, and the project details you enter as free text
- Technical information showing which channel brought you to the form (such as search, direct visit, or a referring site)
When you book a call
If you book a discovery call, we process your full name, email address, the date and time you select, your time zone, and your meeting note, if any. The booking record is transferred to Google Calendar so that the meeting appears on our calendar and a video call link is created.
When you contact us directly
The content of the messages you send us by email, phone, or WhatsApp, together with your contact details, is processed so that we can respond to your request.
Purposes of processing and legal grounds
| Purpose | Data processed | Legal ground (KVKK Art. 5) |
|---|---|---|
| Responding to quote requests and preparing quotes | Contact and project information | Direct relation to the establishment or performance of a contract |
| Scheduling discovery calls and sending reminders | Name, email, booking details | Your request aimed at establishing a contract |
| Contract process, invoicing, and accounting | Identity, contact, and billing information | Fulfillment of a legal obligation |
| Site security, bot and spam protection | IP address, log records, security verification | Legitimate interest |
| Measuring website traffic | Anonymized site usage statistics. Data from the Google Calendar API is not used for this purpose. | Explicit consent (analytics cookies) |
Cookies
The site uses three types of cookies:
- Strictly necessary cookies: Required for session management, form security, and bot protection. They cannot be disabled; without them, form submission does not work.
- Analytics cookies: Set by Google Analytics so that we can understand which pages attract how much interest.
- Preference cookies: Remember your display preferences.
You can delete or block cookies in your browser settings. If you block strictly necessary cookies, the forms and the booking screen may not work properly.
Data sharing and transfers outside Türkiye
We do not sell your personal data to third parties for marketing purposes. Data is shared only to the extent necessary to provide the service, for the purposes set out separately below:
- Server hosting: Our site, booking system, customer record system, and email infrastructure run on servers that we rent ourselves (in Germany).
- Security and content delivery: A content delivery network is used for attack protection, bot verification, and acceleration; this layer sees only site traffic.
- Visitor statistics: Only website usage data is processed. No data obtained from the booking system or the Google Calendar API is sent to analytics tools.
- Calendar service: Only the booking itself (name, email, date and time, note) is written as a calendar event.
Our servers are located in Germany; because of the security, statistics, and calendar services we use, some data may be processed outside Türkiye. These transfers are carried out under Article 9 of KVKK, within the framework of the relevant providers’ standard contractual clauses and undertakings. Analytics transfers are based on your cookie consent, and the booking transfer is based on our fulfilling your booking request; if you do not wish to book a call, you can write to us directly.
Use of Google user data
Our booking system — a Cal.com installation that we host on our own server at cal.doon.studio — uses the Google Calendar API. We grant this permission only for the Doon Studio team’s own calendar accounts; visitors who book a call are not asked for access to a Google account.
Requested permissions and their sole purposes
| Permission | What it is requested for |
|---|---|
calendar.readonly | To read the busy times on the team’s own calendars and show only free slots on the booking screen. |
calendar.events | To create, update, or cancel a confirmed booking as a calendar event and to add a Google Meet link to the event. |
userinfo.profile | To show in the interface which calendar account is connected and to prevent the wrong account from being connected. |
Data we access through the Google Calendar API is used only to run the functions above and stays on Doon Studio’s own servers. This data:
- is not used for advertising, marketing, profiling, or targeting;
- is not sent to visitor statistics or analytics tools;
- is not sold, rented, or transferred to data brokers;
- is not transferred to any artificial intelligence or machine learning service; and is not used to create, train, or improve foundational or generalized artificial intelligence/machine learning models;
- is not read by humans — the only exceptions are with the user’s explicit permission, for security purposes, where required by law, or where the data has been aggregated and anonymized.
Our booking system has no artificial intelligence or machine learning integration of any kind; it does not connect to any third-party AI provider, model hub, aggregator, or API gateway. The AI and automation services presented on doon.studio are consulting services we provide to our clients under separate projects; they have no technical connection to the booking system and do not access Google user data.
Doon Studio’s use of information received from Google APIs, and its transfer of that information to other parties, adhere to the requirements — including the Limited Use requirements — of the Google API Services User Data Policy.
Google user data — summary
Doon Studio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Our booking system (cal.doon.studio, a self-hosted Cal.com instance) requests three scopes: calendar.readonly to read our own team’s busy times so the booking page shows only free slots; calendar.events to create, update or cancel the booking event and attach a Google Meet link to it; and userinfo.profile to display which calendar account is connected. Only Doon Studio staff connect their own calendars — visitors booking a meeting are never asked for Google account access.
Data obtained through these scopes is used solely to provide the booking feature and remains on Doon Studio’s own servers in Germany. It is never used for advertising, marketing, profiling or targeting; never sold or transferred to data brokers; never sent to analytics tools; and never transferred to any third-party AI/ML service. It is not used to develop, train or improve foundational or generalized artificial intelligence or machine learning models. The application has no AI/ML integration of any kind and connects to no AI provider, model hub, aggregator or gateway. Google user data is not read by humans except with the user’s explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized.
Retention periods
- Quote requests not concluded: 3 years from the last contact. Within this period, they are deleted upon your request.
- Records that turned into a contract: For the duration of the business relationship and, after it ends, for the applicable statute of limitations period.
- Invoices and accounting documents: For the statutory periods required by the Tax Procedure Law and the Turkish Commercial Code (5 and 10 years).
- Server and security logs: A maximum of 12 months.
- Analytics data: For the retention period we have set in Google Analytics, up to a maximum of 14 months.
- Google Calendar data: Not stored. Availability is read in real time only while the booking screen is open; the booking event remains in your calendar and is deleted when canceled.
Security measures
- All traffic is encrypted with TLS; the site is served only over HTTPS
- Access to administration panels is restricted on an authorization basis
- Server and application updates are applied regularly
- Forms are protected by bot verification
- Database backups are taken regularly and stored encrypted
Your rights
Under Article 11 of KVKK, you have the right to:
- Learn whether your personal data is processed and, if it has been processed, request information about it
- Learn the purpose of processing and whether the data is used in line with that purpose
- Know the third parties to whom your data is transferred in Türkiye or abroad
- Request the correction of data that is incomplete or inaccurately processed
- Request the deletion or destruction of your data
- Request that the correction, deletion, and destruction operations be notified to the third parties to whom your data has been transferred
- Object to a result to your detriment arising from analysis exclusively by automated systems
- Request compensation for damage if you suffer damage due to unlawful processing
You can send your requests to [email protected] or to the postal address above. Your application will be concluded free of charge within 30 days at the latest.
Changes
We update this policy as the technologies we use or the legislation change. The current version is always published on this page, and the date below is updated.
Last updated: August 31, 2026