Personal Data Notice (KVKK & GDPR)

This notice explains, in plain language, how Norcored Creative Agency processes your personal data when you visit norcored.com, fill in one of our forms or contact us by WhatsApp, phone or email. It is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for visitors in the European Union, it also provides the information required by Articles 13 and 14 of the General Data Protection Regulation (GDPR). Our Privacy Policy contains further detail.

1. Data controller

The data controller is [Şirket unvanı / Legal name] (“Norcored Creative Agency” or “Norcored”), tax ID [Vergi / NIF numarası], address [Adres].

We work from offices in Madrid and Almería (Spain) and İstanbul (Türkiye). You can reach us at info@norcored.com, on +34 611 586 170 (Spain, also WhatsApp) or on +90 530 931 65 21 (Türkiye).

2. Personal data we process

• Identity data: first name and surname.
• Contact data: email address, phone number and your preferred contact channel (email, phone or WhatsApp).
• Professional data: company name and website address.
• Request data: the message, project details and preferred date and time you send through the quote, meeting request and call-back forms.
• Technical and security data: IP address, browser and device information, and access times recorded in hosting and CDN server logs.
• Usage and marketing data: browsing data and cookie identifiers collected by analytics and advertising cookies, only if you consent.
• Consent records: the choices you make in our cookie banner.

3. Why we use your data

• To receive, assess and answer your quote, meeting and call-back requests.
• To hold pre-contract discussions and prepare proposals.
• To contact you through the channel you prefer.
• To keep the website secure and available and to detect abuse.
• With your consent, to measure traffic and improve the website (Google Analytics 4).
• With your consent, to measure our advertising and show you relevant ads (Google Ads, Meta Pixel).
• To meet legal obligations and to establish, exercise or defend legal claims.

4. Legal bases

Under KVKK Article 5 and GDPR Article 6, we rely on the following legal bases:

• Steps prior to or performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)): handling your quote, meeting and call-back requests.
• Legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)): accounting, tax and record-keeping duties.
• Establishing, exercising or protecting a right (KVKK Art. 5/2-e): keeping records that may be needed in a dispute.
• Legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)): website security, server logs and strictly necessary cookies.
• Consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)): analytics and advertising cookies and, where required, related international transfers. You can withdraw consent at any time without affecting earlier processing.

5. Who we share data with

Within Türkiye, data may be shared with our İstanbul office, our accounting, legal and advisory providers, and public authorities where the law requires it.

International transfers (KVKK Article 9; GDPR Chapter V): the website is hosted on Vercel and uses a headless WordPress content system, and we use email and workspace tools as well as Google and Meta services. Your data may therefore be transferred to our offices in Spain and to the European Union, the United States and other countries where these providers operate.

For transfers out of Türkiye we rely on an adequacy decision of the Personal Data Protection Board where one exists, and otherwise on the appropriate safeguards listed in KVKK Article 9, mainly the Board’s standard contractual clauses, which we notify to the Board within the legal deadline. Occasional transfers without such safeguards are made only under the exceptions in Article 9/6, such as your explicit consent or the need to perform a contract with you. For transfers out of the EU we rely on adequacy decisions (including the EU-US Data Privacy Framework for certified providers) or the European Commission’s standard contractual clauses.

6. How we collect data

We collect data directly from you through our website forms, WhatsApp links, email and phone calls, and automatically through server logs and cookies. Analytics and advertising cookies only run after you accept them in the cookie banner.

7. Your rights

Under KVKK Article 11 you may ask us whether your data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties in Türkiye or abroad who receive it, request correction, request erasure or destruction under KVKK Article 7, ask us to notify recipients of these changes, object to a decision made solely by automated means that harms you, and claim compensation for damage caused by unlawful processing.

Under the GDPR you also have the rights of access, rectification, erasure, restriction, data portability, objection, withdrawal of consent and the right not to be subject to solely automated decisions with legal or similarly significant effects.

8. How to make a request

Send your request, stating your identity and what you are asking for, by email from the address you used with us to info@norcored.com, in writing to [Adres], or via registered electronic mail (KEP), secure electronic signature or mobile signature.

We will answer free of charge within 30 days (KVKK) or one month (GDPR). If a request involves an additional cost, a fee may be charged within the tariff set by the Board. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (KVKK Kurulu) or, in the EU, to the Spanish Data Protection Agency (AEPD) or the authority in your country.

Last updated: 1 October 2026