Privacy notice · SackEaze

In short

We only ask for what we need to answer you and prepare a quote.
We only keep site statistics with your permission. We don't advertise and we don't sell your data.
Your data is stored in the European Union (Germany and the Netherlands) on Google's servers.
To see, correct or delete your data, just write to info@sackeaze.com.

Who is responsible

SackEaze is run by Tahsin and Etkin together. SackEaze is not a registered company yet; once the company exists, we will update this notice with its legal name, address and registration number. Until then the two of us are responsible for the processing described here: joint controllers within the meaning of Article 26 GDPR, and data controller within the meaning of the KVKK. Whichever of us you contact to use your rights, we deal with your request together.

E-mail: info@sackeaze.com
Phone (Netherlands): +31 6 2191 2106
Phone (Turkey): +90 532 645 50 93

We are not required to appoint a data protection officer; every privacy question goes to the e-mail address above.

What data we process

The "Tell us about your business" form: your first and last name, your business name, your role, your e-mail address, your phone number, how you would like us to reach you, your country and city, your answers about your business and the site you want, and any file links you share. We also record when the form was sent, its version and the version of this privacy notice you confirmed you had read. In open questions you decide what to write; please don't write special categories of data such as health information, or passwords or card details. If you name other people involved in the decision and their roles, please pass this notice on to them.
The contact form: your name, e-mail address, message and, if you like, your phone number.
Call-back requests: your name, phone number and, if you like, a time that suits you.
E-mail, phone and WhatsApp: whatever you share when you write to us or call us directly. WhatsApp links take you to WhatsApp (Meta); WhatsApp's privacy policy also applies to conversations there.
A record of the e-mails we send: which template each e-mail used, in which language, when it was sent and whether it was delivered. In this record your e-mail address is kept only as an irreversible digest (hash); the content of the e-mail is not recorded.
Site use, only with your permission: with Google Analytics, which pages you open, which links and buttons you click, how far you scroll, which step of the form you reach, your device and browser type, screen size, the site you came from and your approximate location (country or city). What you type into the forms, your name, e-mail address and phone number are never sent to Google Analytics.
Error reports: if the site runs into an error in your browser, it sends us a short report: the page path (without the part after a question mark in the address), the language, your browser type and the technical error message. We remove e-mail addresses and long numbers from the report; your IP address is not added to it.
Server logs: the Google servers that run the site keep a standard record of each request: IP address, browser type, the address requested, the time and the result. We only use these for security and to track down faults.
Abuse protection: to protect the forms from spam, we briefly keep a digest (hash) derived from your IP address and the time; your IP address itself is not in this record. We also look at how long a form took to fill in; forms sent very quickly are not stored.
What stays in your browser: your language and theme, your cookie choice and the form draft. The draft stays on your device only, until you send it. Details are in the cookie policy.

We get this data directly from you and the device you use, electronically. We don't collect data about you from other sources.

You are not obliged to give us any data. But to answer you we need at least your name and one way to reach you; required fields are marked in the forms.

Why we process it, and on what legal basis

To answer your request, understand what you need, prepare a quote and plan a meeting (forms, e-mail, phone, WhatsApp). When your submission arrives, we send you a confirmation e-mail and the team a notice. Basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), and being directly related to the conclusion of a contract (Art. 5(2)(c) KVKK). The tick box in the form confirms that you have read this notice and want your answers to be processed for this purpose.
If you become a customer, to perform the contract: the same bases (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK). Keeping invoices and accounting records is a legal obligation (Art. 6(1)(c) GDPR; Art. 5(2)(ç) KVKK).
To measure and improve the site (Google Analytics): your consent (Art. 6(1)(a) GDPR and Article 11.7a of the Dutch Telecommunications Act; Art. 5(1) KVKK). If you don't give it, the site works just the same. You can withdraw it at any time; this does not affect processing that took place before.
To keep the site secure and working (server logs, error reports, abuse protection, e-mail records): our legitimate interest (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK). Our interest is to protect the site against attacks and spam, find and fix errors, and make sure the same e-mail is not sent twice. For this we keep as little data as possible, briefly, and mostly as a digest (hash).
To establish, exercise or defend a legal claim if needed: our legitimate interest (Art. 6(1)(f) GDPR) and being necessary to establish, exercise or protect a right (Art. 5(2)(e) KVKK).

We don't make decisions about you based solely on automated processing, and we don't build profiles. We read your submissions ourselves.

Only the SackEaze team, the two of us, sees your data. We don't sell it, use it for advertising or share it with anyone for that purpose. These service providers process data on our behalf, on our instructions and under data processing agreements (Art. 28 GDPR):

Google Cloud and Firebase: running the site, the database, processing the forms, server logs, error reports and backups. The database and form processing are in Germany (Berlin), the web server in the Netherlands. Google's cache servers in other parts of the world may also be used so pages open quickly.
Google Workspace (Gmail): our e-mail; the e-mails sent to you and the team, and our correspondence with you.
Google Analytics: only if you allow it. Google signals and ad personalisation are off.

If you write to us on WhatsApp, WhatsApp (Meta) processes that data under its own responsibility.

Beyond that, we only share your data with authorities when we are legally required to (for example when a court or the tax authority asks). If you become a customer, our accountant may see your invoices.

Transfers outside Europe

Your data is stored in the European Union. Google may, however, process some data (for example for support, security and analytics) in the United States or other countries. Google LLC participates in the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). For other countries, Google uses the European Commission's standard contractual clauses (Art. 46 GDPR).

Etkin works from Turkey and accesses the data from there over an encrypted connection. There is no European Commission adequacy decision for Turkey. This access is necessary to prepare the quote you asked for and to talk with you (Art. 49(1)(b) GDPR). Once the company exists, we will also put standard contractual clauses in place for it.

How long we keep it

Form submissions, contact and call-back requests, and the related correspondence: at most 2 years after our last contact. If you become a customer, for the term of the contract and afterwards as long as the law requires (invoices, for example, 7 years in the Netherlands).
Records of sent e-mails: 1 year.
Digests used for abuse protection: at most 2 hours; then they are deleted automatically.
Server logs and error reports: 30 days; then they are deleted automatically.
Site statistics: 14 months. The analytics cookies' lifetimes are in the cookie policy.
Backups: we keep daily backups of the database for 7 days and weekly ones for 14 weeks. A record we delete is gone from the backups after 14 weeks at the latest. We only use backups to bring data back after a fault.

When a period ends, we delete the data or make it anonymous. You can ask us to delete your data sooner at any time.

Your rights

Under the GDPR (Art. 15–22) you have the right to:

Access: find out which data we process about you and get a copy.
Rectification: have incorrect or incomplete data corrected.
Erasure: have your data deleted, unless we are legally required to keep it.
Restriction: have your data only stored, for example while we look into an objection.
Portability: receive the data you gave us in a common, machine-readable format (for example JSON), or have it passed on to someone else.
Objection: object, on grounds relating to your particular situation, to processing based on our legitimate interest.
Withdraw consent: withdraw your permission for analytics at any time through "Cookie settings" at the bottom of every page.

Write to info@sackeaze.com for any of these. Writing from the e-mail address you used in your submission is usually enough; if we cannot be sure who you are, we may ask for more information. We answer within one month, free of charge. If a request is complex, this can be extended by two months; we will let you know if so.

If you are not happy with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority of the EU country where you live or work. If you write to us first, we will try to solve it together.

Visitors in Turkey (KVKK)

If you live in Turkey or your data is processed in Turkey, the Turkish Personal Data Protection Law No. 6698 (KVKK) also applies. This notice is also our information notice under Article 10 KVKK. The controller, the purposes, the legal bases and who receives the data are described above. We collect your data electronically, directly from you and your device.

Transfers abroad (Art. 9 KVKK): because your data is stored on Google's servers in the EU, it is transferred abroad. For these transfers we rely on the appropriate safeguards of Article 9(4) KVKK, in particular the standard contract set by the Board. Where that is not possible, the transfer is based on its being necessary for pre-contractual measures taken at your request (Art. 9(6)(b)). Abroad, the same level of protection as in Turkey may not always be guaranteed.

Your rights (Art. 11 KVKK): to learn whether your data is processed and, if so, to request information about it; to learn the purpose of the processing and whether the data is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to have it corrected if it is incomplete or incorrect; to have it erased or destroyed under the conditions of Article 7 KVKK; to have corrections and erasures notified to the third parties who received the data; to object to a result against you that arises solely from analysis by automated systems; and to claim compensation if you suffer damage from unlawful processing.

How to apply: you can send your application in writing, or from an e-mail address you gave us before and that is in our records (for example the one you used in the form), to info@sackeaze.com. You can also apply by registered electronic mail (KEP), secure electronic signature or mobile signature. Include your name, surname, contact details and your request. We conclude your request free of charge within 30 days at the latest; if it involves an extra cost, we may charge the fee in the Board's tariff. If your application is rejected, you find our answer insufficient or we don't answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your application.

Security

The site only opens over an encrypted connection (HTTPS). Data is stored encrypted on Google's servers.
The database cannot be reached directly from the browser; every form is checked on the server.
Only the two of us can sign in to the admin area, with our work accounts and two-step verification. Sessions end after 5 days at the latest.
We don't write names, e-mail addresses or answers into system logs; only record numbers.
Your form draft stays on your device only, until you send it.

If there is a data breach, we report it to the competent authority within 72 hours where required and tell you if it poses a high risk to you.

Children

Our services are aimed at businesses. We don't knowingly collect data from children under 16. If we notice we have, we delete it.

Changes

We update this notice when the way we work changes. The date at the top is the date of the latest version. If an important change affects a conversation we are having with you, we will also let you know by e-mail.

Contact

SackEaze (Tahsin and Etkin)

E-mail: info@sackeaze.com
Phone (Netherlands): +31 6 2191 2106
Phone (Turkey): +90 532 645 50 93