Privacy Policy
Last updated: April 14, 2026
1. Data Controller
TheCodeVolt (Istanbul, Turkey) is the data controller under GDPR Article 4(7) and KVKK Article 3. Founder and point of contact: Halil Berkay Sahin. Reach us at info@thecodevolt.com for any privacy, access, correction, or deletion request.
2. Information We Collect
Contact form: name, email, company (optional), project type, and message. Request metadata: IP address and timestamp, retained only for rate-limiting and fraud prevention (legitimate interest, 7-day rolling window). Analytics (only after cookie consent): anonymized page views, clicks, scroll depth, session duration via Google Analytics 4, Microsoft Clarity (heatmaps and session replay with input masking), Vercel Analytics, and Vercel Speed Insights.
3. Legal Bases (GDPR Art. 6 / KVKK Art. 5)
Contact form processing: performance of a contract or pre-contractual steps (GDPR 6(1)(b), KVKK 5(2)(c)). Analytics cookies: consent (GDPR 6(1)(a), KVKK 5(1)). Rate-limiting logs: legitimate interest in service security (GDPR 6(1)(f), KVKK 5(2)(f)).
4. Cookies and Consent Mode
Essential cookies (site functionality, consent state) are always active. Analytics and marketing cookies fire only after you click Accept on the cookie banner. We use Google Consent Mode v2 with default denied - no tracking cookie loads before your choice. You can withdraw consent any time by clearing browser cookies or using the cookie preferences link in the footer.
5. Sub-Processors
We rely on the following GDPR-compliant processors, each under a Data Processing Agreement: Vercel Inc. (hosting, analytics, speed insights, US with EU SCCs); Resend (transactional email for contact form, US with EU SCCs); Google LLC (Tag Manager, Analytics 4, US with EU SCCs); Microsoft Corporation (Clarity analytics, US with EU SCCs). A current, dated list is available on request.
6. International Transfers
Some sub-processors store data outside Turkey and the EU, primarily in the United States. Transfers are governed by Standard Contractual Clauses and, where applicable, EU-US Data Privacy Framework certifications of the processor.
7. Retention
Contact form content: up to 12 months in the email inbox, then archived or deleted on request. IP and user-agent logs for rate limiting: 7 days. GA4: 14 months (default). Clarity: 1 year. Vercel Analytics: 1 year. Accounting records tied to contracted projects follow Turkish Tax Procedure Law retention (up to 10 years).
8. Your Rights (GDPR Art. 15-22 / KVKK Art. 11)
You may request access, rectification, erasure, restriction, objection, and portability. Under KVKK you may also request information about whether your data is processed, the purposes, recipients, and correction of incorrect data. Submit requests to info@thecodevolt.com. We respond within 30 days under GDPR and 30 days under KVKK.
9. Security
HTTPS with HSTS preload, strict Content Security Policy, X-Frame-Options DENY, Permissions-Policy hardening, server-side input validation, rate limiting on the contact endpoint, and HTML-escaping on all user inputs echoed to email. Vercel infrastructure is SOC 2 Type II and ISO 27001 certified.
10. Children
Our services target business professionals. We do not knowingly collect data from anyone under 18.
11. Changes
Material changes are announced on this page with an updated revision date. Continued use of the site after an update means you accept the revised policy.
12. Supervisory Authorities
If you believe your rights have been violated you may lodge a complaint with the Turkish Personal Data Protection Authority (KVKK, www.kvkk.gov.tr) or any EU Data Protection Authority.
13. Contact
info@thecodevolt.com - TheCodeVolt, Istanbul, Turkey.