This notice explains what personal data we collect when you use projebaz.co, why we process it, how long we keep it, who we share it with and how you can exercise your rights. It is provided under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and, for visitors in Türkiye, under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK).
Who is responsible for your data
The controller is Projebaz. "We" in this notice means that company.
Address: Cumhuriyet Mah. Necip Ali Cad. No:62/A, Pamukkale, 20160 Denizli, Türkiye
Phone: +90 506 037 35 20
Email: info@projebaz.co
Data protection requests: info@projebaz.co
We are established in Türkiye. Because we offer goods to visitors in the European Union and the European Economic Area, the GDPR applies to this processing under its Article 3(2).
What personal data we process
The site has no user accounts. We process your data only when you submit a form, contact us, or as a technical by-product of browsing.
Identity and contact data: the name, email address and phone number you enter in the quote form, quick quote, catalogue request, exit form or product quiz.
Enquiry data: the product or category you select, the content of your message, your quiz answers, the page you submitted the form from and the source that brought you to the site (referrer).
Technical data: IP address, browser and device information, language preference, approximate location derived from your IP (country, region, city), the pages you view and the links you click.
Correspondence: the content of your messages if you contact us by WhatsApp, phone or email.
Our forms never ask for special category data (health, beliefs, biometrics and the like). Please do not include such information in the message field either.
Why we process it and on what legal basis
To answer your quote, catalogue and information requests, to contact you and to handle orders and delivery — Article 6(1)(b) GDPR: performance of a contract or steps taken at your request before entering into one.
To keep a record of your enquiry and to meet our commercial, accounting and tax obligations — Article 6(1)(c) GDPR: compliance with a legal obligation.
To keep the site and its forms secure, block bot and spam submissions and limit excessive requests from one source — Article 6(1)(f) GDPR: our legitimate interest. For this purpose your IP address is used as a salted, irreversible hash rather than in the clear.
To measure how the site is used, understand which pages and products draw interest and improve both — Article 6(1)(a) GDPR (your consent) for the third-party measurement tools listed below, and Article 6(1)(f) for the aggregated visit counts kept on our own server.
To send you catalogue, product and campaign emails when you ask for them — Article 6(1)(a) GDPR: your consent. Every email carries a one-click unsubscribe link; withdrawing consent does not affect processing carried out before the withdrawal.
Cookies, local storage and measurement tools
Alongside the browser storage needed to run the site, we use measurement and analytics tools. These start when you open the site; if you do not want them, you can block them as described below.
Functional storage: your language choice, your view and sort preference on the product list, the products you viewed recently, and a marker so a pop-up is shown only once per session. These stay in your browser (localStorage / sessionStorage) and are never sent to our server.
Google Analytics 4 (Google): visit measurement, with IP anonymisation enabled.
Microsoft Clarity (Microsoft): heatmaps and session replay. Under the tool's default masking settings, text you type into form fields is not recorded.
Leadsy tag: IP-based matching used to identify business visitors.
Our own measurement: page views and clicks on WhatsApp, phone, email and outbound links are recorded on our own server. To tell visitors apart we use an irreversible daily hash derived from IP address and browser information.
How to opt out: delete or block cookies in your browser settings, use a tracking blocker, or install the Google Analytics opt-out add-on at tools.google.com/dlpage/gaoptout. The site itself keeps working normally when these tools are disabled.
Who we share your data with
We do not sell your personal data and do not pass it to third parties for their own advertising. The following providers process data only to the extent they provide services to us and on our instructions:
Vercel Inc.: hosting of the site and of the form endpoints.
Supabase and a PostgreSQL server we administer ourselves: form submissions, email delivery logs and visit statistics.
Lovable: delivery of confirmation and notification emails.
Google: Google Analytics 4 and Google Fonts. Because the fonts load from Google's servers, your IP address is transmitted to Google in the process.
Microsoft: Microsoft Clarity.
Leadsy: visitor identification tag.
Meta Platforms: only if you message us on WhatsApp, in which case that conversation is subject to WhatsApp's own terms.
Public authorities: where disclosure is required by law, limited to the scope of the request.
International transfers
We are based in Türkiye and some of the providers above host data outside the European Economic Area. Türkiye is not covered by a European Commission adequacy decision.
Transfers therefore take place either because they are necessary for the performance of a contract concluded at your request (Article 49(1)(b) GDPR) or on the basis of appropriate safeguards such as the Commission's standard contractual clauses (Article 46(2)(c) GDPR). You can request information about the safeguards that apply by writing to info@projebaz.co.
How long we keep it
Enquiries and correspondence: 3 years from our last contact with you. Where a sale takes place, the related records are kept for 10 years to meet commercial and tax law obligations.
Visit and click records: 24 months, after which only aggregated figures that cannot be linked to a person remain.
Email delivery logs and unsubscribe records: for as long as needed to make sure the same address is not contacted again.
Google Analytics and Microsoft Clarity: each provider's own retention period applies (in Google Analytics 4, up to 14 months for event data).
Once a period expires the data is deleted, destroyed or irreversibly anonymised.
Your rights
Under Articles 15 to 22 GDPR you have the right to:
Access the personal data we hold about you and receive a copy of it.
Have inaccurate data corrected and incomplete data completed.
Have your data erased where the conditions for erasure are met.
Ask us to restrict processing while a dispute about accuracy or lawfulness is resolved.
Receive the data you provided in a portable, machine-readable format, where processing is based on consent or a contract.
Object to processing based on our legitimate interests, and to object to direct marketing at any time.
Withdraw your consent at any time, without affecting processing that took place before the withdrawal (Article 7(3)).
Not be subject to a decision based solely on automated processing. We do not take such decisions and do not carry out profiling.
How to exercise your rights, and how to complain
Write to info@projebaz.co or to Cumhuriyet Mah. Necip Ali Cad. No:62/A, Pamukkale, 20160 Denizli, Türkiye. Please state your request clearly and include enough detail for us to identify you. We answer free of charge, without undue delay and within one month at the latest; for complex or numerous requests we may extend that period by two further months and will tell you if we do (Article 12(3) GDPR).
If you are not satisfied with our response you may lodge a complaint with the data protection authority of the EU or EEA country where you live, work or where the alleged infringement took place (Article 77 GDPR). In the United Kingdom this is the Information Commissioner's Office (ICO). Visitors in Türkiye may apply to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under Article 14 KVKK. You also have the right to a judicial remedy.
Data security
The site and its form endpoints are served over TLS and database connections are encrypted. Forms apply bot filtering and rate limiting, IP addresses are used as salted hashes, and access to records is limited to people who need it for their work. That said, no transmission over the internet can be guaranteed to be completely secure.
Changes to this notice
We may update this notice when the law or our processing activities change. The effective date is shown at the top of the page; we recommend checking it after any significant change.