Privacy Policy
How we collect, use and protect your personal data.
Last updated: 2026-07-06
01. Data Controller
This privacy policy applies to the donedynamics.com website operated by Devrim Tunçer ("Done Dynamics", "we").
Data Controller: Devrim Tunçer (natural person / sole proprietor).
Address: Kestel Mahallesi, Üniversite Caddesi No: 86/3, Alanya / Antalya, Türkiye
Registered e-delivery (KEP): devrim.tuncer@hs01.kep.tr
E-mail: devrim@donedynamics.com
Web: https://donedynamics.com
Tax office / number: Alanya Vergi Dairesi — 8670898531
Data Protection Officer (DPO): not designated; all data protection requests are addressed directly to the controller.
02. Data Minimisation Statement
Done Dynamics' public website is a marketing presence. It performs measurement and — subject to your explicit consent — advertising measurement, disclosed transparently below.
The personal data processed through the website is limited to:
1. Strictly necessary cookies — session, security, language and your consent choice.
2. Analytics (consent-based) — Google Analytics 4; tags are loaded server-side (first-party) via Cloudflare Zaraz. Events (page views, phone/WhatsApp/email/map clicks, form submissions) may be exported at event level to Google BigQuery.
3. Advertising (explicit consent) — with your consent, Google Ads conversion measurement, remarketing and Customer Match are enabled. Ad personalization respects your choice; if you decline, ads are not personalized and advertising cookies do not run.
4. Contact channel content — the content of any e-mail or phone message, processed to answer your request; statutory retention under Turkish tax law (VUK art. 253) applies where invoices are issued.
We do not sell your personal data to third parties for marketing. Analytics and advertising are carried out only with your explicit consent and can be withdrawn at any time.
03. Data Processed
Strictly necessary cookies: session, security and language preference.
Analytics data (consent-based): Google Analytics 4; measurement is loaded server-side (first-party) via Cloudflare Zaraz and events may be exported at event level to Google BigQuery.
Advertising data (explicit consent): with consent, Google Ads conversion measurement, remarketing and Customer Match; if you decline, ads are not personalized.
Contact content: message content that a visitor voluntarily sends by e-mail or phone, plus information legally required where an invoice is issued.
04. Purposes and Legal Bases
Responding to inbound enquiries (KVKK art. 5/2-c contract performance and art. 5/2-f legitimate interest; GDPR art. 6(1)(b) and 6(1)(f)).
Site security and technical operation (legitimate interest — KVKK art. 5/2-f, GDPR art. 6(1)(f)).
Compliance with legal obligations, in particular issuance and retention of invoices (KVKK art. 5/2-ç, GDPR art. 6(1)(c) — Turkish Tax Procedure Law art. 253).
Explicit consent for analytics and advertising cookies; consent may be withdrawn at any time (KVKK art. 5/1, GDPR art. 6(1)(a)).
05. Data Sharing
Processors: Cloudflare (Zaraz measurement, hosting) and Google (Analytics, Ads, BigQuery), who may process data outside Türkiye/EEA, acting as data processors.
Where data is transferred outside Türkiye / the EEA, appropriate safeguards under KVKK art. 9 and GDPR Chapter V (Standard Contractual Clauses / adequacy decisions) apply.
Data is not sold or shared with third parties for marketing purposes.
06. Retention
Contact correspondence: until the request is closed; maximum 1 year.
Invoice and accounting records: 5 years under Turkish Tax Procedure Law art. 253.
Cookies: per the lifespan declared in the Cookie Policy below.
Analytics data: up to 14 months in the GA4 UI; raw BigQuery event data up to 26 months. GCLID and first-party cookies up to 90 days.
07. Your Rights
Under GDPR art. 15-22 and KVKK art. 11 you have rights of information, access, rectification, erasure, restriction, objection and data portability.
To exercise these rights, contact devrim@donedynamics.com or devrim.tuncer@hs01.kep.tr. We respond within 30 days at no cost.
08. Security
We rely on TLS encryption, least-privilege access and regular updates. Personal data breaches are reported to the competent authority within 72 hours pursuant to GDPR art. 33 and KVKK art. 12/5.
09. Contact and Complaints
For inquiries: devrim@donedynamics.com
You have the right to lodge a complaint with the Turkish DPA (kvkk.gov.tr) or your local EU supervisory authority.