Privacy Policy

Who we are

What we collect

When you contact us through the form or by email:

• Your name
• Email address
• Phone number (optional)
• Content of your message or inquiry
• Technical data automatically collected by Squarespace — browser type, device, IP address
• If you interact with the map on our Contact page, Google Maps may process technical data

We do not collect sensitive personal data and we do not create user accounts.

How we use your data

• Responding to your inquiry
• Communicating about a possible business relationship
• Taking steps prior to entering into a contract, where applicable
• Fulfilling legal or administrative obligations
• Maintaining security and proper functioning of the website

We do not use your data for advertising, profiling, or automated decision-making.

Legal bases for processing

GDPR

• Art. 6(1)(a)Your consent when submitting the contact form
• Art. 6(1)(b)Steps necessary prior to entering into a contract
• Art. 6(1)(c)Compliance with a legal obligation
• Art. 6(1)(f)Legitimate interests in website security and business communications

KVKK — Law No. 6698

• Art. 5(1)Explicit consent
• Art. 5(2)(c)Establishment or performance of a contract
• Art. 5(2)(ç)Compliance with a legal obligation
• Art. 5(2)(f)Legitimate interests, without violating fundamental rights

Cookies

This website uses strictly necessary cookies set by Squarespace to serve the site and enable core functionality. We do not use advertising or analytics cookies. You can manage cookies through your browser settings.

Who we share data with

We do not sell or share your data for marketing purposes. Data may be processed by:

• Squarespace — our hosting provider, under a Data Processing Agreement
• Google — only in connection with the map on our Contact page
• Competent authorities — where required by law or for legal claims

International transfers

Our website is hosted by Squarespace in the United States. Transfers are covered by Standard Contractual Clauses where the GDPR applies. Details at squarespace.com/dpa. Where Turkish law applies, transfers comply with Law No. 6698.

Retention & security

We keep contact data for up to 12 months from our last interaction, unless a longer period is required by law. We apply reasonable technical and organizational measures to protect your data, though no internet transmission can be guaranteed completely secure.

Children

This website is not intended for children under 18. If you believe a child has submitted data to us, please contact us and we will delete it.

Your rights

Under GDPR

• Request access to your personal data
• Request correction of inaccurate or incomplete data
• Request erasure of your personal data
• Request restriction of processing
• Object to certain processing activities
• Request data portability, where applicable
• Withdraw consent at any time
• Lodge a complaint with your supervisory authority

Under KVKK (Art. 11)

• Learn whether your personal data is being processed
• Request information about how it is processed
• Learn the purpose of processing and whether used accordingly
• Know the third parties data is transferred to, domestically or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction where legal conditions are met
• Object to results arising from automated processing
• Claim compensation for damages from unlawful processing

To exercise your rights, contact us at privacy@citysarai.com or via our Contact page. We respond within 30 days (GDPR) or as required under KVKK.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects any changes. We encourage you to review it periodically.