Effective 4 October 2026
Contents
Other documents
Staterics Technology · Privacy Policy Effective 4 October 2026
This policy explains how Staterics Teknoloji Ltd. Şti. (“Staterics”, “we”) handles personal data when you visit staterics.com, ask for an Operations X-Ray, or work with us as a prospective or existing client. If you are in Türkiye, our KVKK Aydınlatma Metni gives the same information in Turkish.
Staterics Teknoloji Ltd. Şti. (trading as Staterics Technology), based in Ankara, Türkiye, is the controller of the personal data described in this policy: the “veri sorumlusu” under Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK), and the “controller” under the EU and UK General Data Protection Regulation (GDPR) where it applies to us.
You can reach us about anything in this policy at ege.ozdas@staterics.com or on +90 541 634 9582.
We sell our services to businesses, not to consumers. This policy covers our website and our own business relationships. It does not cover the data our clients’ systems process on their behalf; see Data in client systems.
We don’t need special categories of personal data, such as health data, or your customers’ personal data for an X-Ray. Please don’t include them in forms or messages.
Our hosting provider, Netlify, processes technical data each time it serves a page: IP address, browser and device type, the page requested, the referring page and the time. This is needed to deliver the site and keep it secure.
We use no analytics, advertising or tracking tools, and our site sets no cookies. A few features remember a choice in your browser, only after you use them; the Cookie Policy lists each one.
If a colleague adds you as a guest to an X-Ray booking or introduces you by email, we receive your name and email address from them.
Where we rely on legitimate interests, we have weighed them against your rights and freedoms, and you can object at any time (see Your rights).
We do not rely on your consent for any of the above. If we ever need it, for example to record a call or to send you marketing messages, we will ask for it separately and in advance, and you can withdraw it at any time.
We do not add you to marketing lists, sell your data, or use it for advertising.
We use a small number of service providers. Except where noted, they act only on our instructions, as processors.
We may also share data with our professional advisers (lawyers, accountants, auditors), who are bound by confidentiality, and with courts, public authorities or regulators where the law requires it.
If Staterics is reorganised, merged or sold, data may pass to the successor, which must continue to protect it as this policy describes. We do not sell personal data.
Staterics is based in Türkiye. Netlify, Google and Cal.com store or process data outside Türkiye, mainly in the United States, so using them means transferring personal data abroad.
From Türkiye: Article 9 of the KVKK applies. No adequacy decision covers these countries, so each regular transfer needs an appropriate safeguard. The safeguard we use is the standard contract published by the Personal Data Protection Board (the controller-to-processor version), signed with the provider and notified to the Board within five business days of signature. Occasional, one-off transfers may instead rely on one of the exceptions in Article 9(6).
Status: at the effective date of this policy we are still completing these standard contracts with Netlify, Google and Cal.com. We will update this section as each one is signed and notified.
From the EU or UK: where the GDPR applies, transfers to providers in countries without an adequacy decision rely on the European Commission’s standard contractual clauses (with the UK addendum) in each provider’s data processing terms or, for a US provider certified under it, the EU–U.S. Data Privacy Framework and its UK extension.
Ask us and we will tell you which safeguard applies to a given provider and where it stands, and give you a copy once it is in place (commercial terms may be redacted).
When a period ends, we delete or anonymise the data.
The site is served only over HTTPS, with HSTS and strict security headers, and loads no third-party code until you ask for it. Enquiries are accessible only to the founding team. We use providers that run established security programmes and are bound by confidentiality and data-processing terms.
No system is perfectly secure. If a breach affects your personal data, we will notify the competent authority and, where the law requires, you. Under the KVKK we notify the Board within 72 hours of becoming aware of a breach.
Depending on the law that applies to you, you can:
How to ask: email ege.ozdas@staterics.com, ideally from the address you used with us so we can confirm it is you. If you are in Türkiye, the KVKK Aydınlatma Metni lists the other application methods the KVKK allows.
We reply free of charge: within 30 days under the KVKK, and within one month under the GDPR, which can be extended by two further months for complex requests (we will tell you if so, and why). We may ask for information to confirm your identity.
Complaints: in Türkiye, to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr) after first applying to us (KVKK Art. 14); in the EU, to the data protection authority where you live or work; in the UK, to the Information Commissioner’s Office (ico.org.uk). We would welcome the chance to put things right first.
When we build and run a system for a client, it processes the data of that client’s customers, staff and contacts: calls, messages, bookings and records. For that data the client decides why and how it is processed and is the controller (veri sorumlusu). Staterics processes it only on the client’s instructions, as its processor (veri işleyen).
That processing is governed by the data-processing agreement we sign with each client before any of its customers’ personal data reaches us, not by this policy. The agreement covers, among other things, security measures, the sub-processors we use (such as AI model and telephony providers), safeguards for transfers abroad, breach notification, and the return and deletion of data when the contract ends.
If you are a customer of one of our clients, please read that business’s privacy notice and send your requests to it. If you contact us instead, we will pass your request to the client and help it respond.
Our website and services are for businesses. They are not directed at anyone under 18, and we do not knowingly collect children’s data.
We do not profile visitors or enquirers, and we make no decisions about them based solely on automated processing.
We update this policy when our practices or the law change; the effective date shows the current version. If a change materially affects how we use data we already hold, we will tell the people affected directly where we can.
This version, effective 4 October 2026, replaces the version of 17 April 2026.
Questions about this policy, and requests about your data, can be sent to ege.ozdas@staterics.com.
Staterics Teknoloji Ltd. Şti. (Staterics Technology) · Ankara, Türkiye · ege.ozdas@staterics.com · +90 541 634 9582