Start growing your business online today!Message us
Get a Quote

Privacy Policy

This Privacy Policy explains how Norcored Creative Agency collects, uses, stores and protects personal data through norcored.com and our contact channels.

Get a quote

This Privacy Policy explains how Norcored Creative Agency collects, uses, stores and protects personal data through norcored.com and our contact channels. We serve clients in Türkiye, the European Union, the United Arab Emirates, Canada and the United States, and we apply the standards of both the EU General Data Protection Regulation (GDPR) and Turkish Law No. 6698 (KVKK).

1. Who is responsible

The controller is [Şirket unvanı / Legal name] (Norcored Creative Agency), tax ID [Vergi / NIF numarası], address [Adres]. Offices in Madrid, Almería and İstanbul. Contact: info@norcored.com, +34 611 586 170 (also WhatsApp), +90 530 931 65 21.

2. Data we collect

  • Quote form: name, company, email, phone, website, message and preferred contact channel.
  • Meeting request form: name, email, phone, company, preferred date and time, and topic.
  • Call-back request form: name, phone number, a convenient time and a short note.
  • WhatsApp, email and phone: the messages you send, your phone number and profile name.
  • Server logs: IP address, browser type, device details, pages visited, date and time.
  • Cookie data: only with your consent, usage data and online identifiers collected by analytics and advertising cookies.

3. Purposes and legal bases

  • Answering requests and preparing proposals: pre-contract steps and contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
  • Running client projects and invoicing: contract and legal obligation (GDPR Art. 6(1)(b), (c); KVKK Art. 5/2-c, 5/2-ç).
  • Keeping the site secure and fixing errors: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).
  • Visitor statistics with Google Analytics 4: consent (GDPR Art. 6(1)(a); KVKK Art. 5/1).
  • Ad measurement and remarketing with Google Ads and Meta Pixel: consent.
  • Establishing or defending legal claims: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-e).

4. How long we keep data

When a period ends, the data is deleted, destroyed or anonymised.

  • Requests and correspondence that do not lead to a project: 2 years from last contact.
  • Client and contract records: for the contract term and up to 10 years after it ends, as required by commercial and tax law.
  • Hosting and CDN server logs: up to 90 days.
  • Google Analytics 4 data: 14 months.
  • Advertising cookies: for the cookie lifetime, at most 13 months; see the table in our Cookie Policy.
  • Cookie consent records: 2 years.

5. Service providers (processors)

These providers process data only on our instructions and under data processing agreements. We do not sell your personal data, and we do not share it for cross-context behavioural advertising without your consent.

  • Vercel Inc. (USA): website hosting and CDN.
  • Our headless WordPress hosting provider: content management and form entries.
  • Our email and workspace provider: email and calendar.
  • Google Ireland Ltd. / Google LLC: Google Analytics 4 and Google Ads.
  • Meta Platforms Ireland Ltd. / Meta Platforms Inc.: Meta Pixel.
  • WhatsApp Ireland Ltd. / WhatsApp LLC (Meta): WhatsApp messaging.

6. International transfers

Because our offices and providers are in different countries, data may move between Türkiye, the EU and the USA. Transfers out of the EU rely on European Commission adequacy decisions (including the EU-US Data Privacy Framework for certified companies) or standard contractual clauses. Transfers out of Türkiye rely on an adequacy decision or on the safeguards in KVKK Article 9, such as the Board’s standard contracts.

7. Security

The site is served over HTTPS. Access is limited to team members who need it, accounts use multi-factor authentication, software is kept up to date and our providers apply industry-standard security. No system is risk-free, but if a breach occurs we will notify the competent authorities and, where required, you, within the legal deadlines.

8. Your rights

You can ask to access, correct or delete your data, restrict or object to processing, receive your data in a portable format and withdraw consent at any time. Under KVKK you can also learn who received your data and claim compensation for unlawful processing. Residents of other jurisdictions, such as California, Canada or the UAE, may have similar rights under local law, and we will honour them. Write to info@norcored.com; we reply free of charge within one month (30 days under KVKK).

9. Complaints

If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (www.kvkk.gov.tr), the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority in your country.

10. Children

Our services are for businesses and professionals. We do not knowingly collect data from anyone under 16. If we learn that we have, we will delete it.

11. Changes

We may update this policy when our services or the law change. The current version is always published on this page with the date at the top, and we will flag significant changes on the website.

Last updated: 1 October 2026