Privacy and Personal Data Notice

1. Controller and scope

The controller is Cen Medya Limited Şirketi; Cen Medya is its service brand. Our address is Zafer Mahallesi, Adile Naşit Bulvarı No:1/1, City Center Home Office, Kat: 9 Daire: 111, Esenyurt / İstanbul, our website is https://www.cenmedya.com, and the contact address for privacy matters is [email protected].

This notice covers website visitors, people who submit contact or project-request forms, prospective clients, client and solution-partner representatives, and anyone who contacts Cen Medya through digital channels.

2. Personal data we process

Depending on the channel and information you choose to provide, we may process the categories below. Our forms do not request special-category data.

Categories and examples of personal data
Category	Examples
Identity and contact	Name, email address and telephone number
Professional and corporate	Company or brand, role and organisation represented
Request and project	Services requested, budget range, project summary, messages and subsequent correspondence
Transaction and security	Form language, source page, date and time, user agent and an IP address irreversibly hashed for abuse prevention
Acknowledgement and workflow	Record that the notice was read, request status, notification and response records

3. Sources and legal bases

Data is collected electronically from contact, project and service forms, email, telephone or WhatsApp communications, and technical requests made by your browser.

Under Turkish Law No. 6698, processing is based as applicable on steps directly related to establishing or performing a contract, compliance with legal obligations, establishment or protection of rights, and legitimate interests that do not override fundamental rights. Consent is requested only for a specific activity where the law requires it.

Where the GDPR applies, the legal bases are pre-contractual steps at your request, legal obligations, and our legitimate interests in secure and effective business communications under Articles 6(1)(b), 6(1)(c) and 6(1)(f).

4. Purposes of processing

Submitting a form does not subscribe you to marketing communications. Any future advertising or campaign messages requiring permission will use a separate, optional choice.

Receiving, validating, classifying and answering contact and project requests
Analysing requirements and managing meetings, proposals, scoping, planning and pre-contractual steps
Maintaining client and project communications where services are commissioned
Protecting forms against spam, automated submissions, abuse and attacks
Maintaining service continuity, troubleshooting, system security and access controls
Complying with law and establishing, exercising or defending legal claims

5. Recipients and service providers

Data may be shared on a need-to-know basis with authorised Cen Medya personnel and providers of hosting, databases, security, backups, email delivery and technical support.

Form notifications are sent to an authorised Cen Medya mailbox through an email-delivery provider. Cloudflare CDN/R2 may process IP and request data while serving media and protecting the network. Google Maps may process technical data on the contact page; YouTube in privacy-enhanced mode and Vimeo may do so after you choose a video.

Legal, accounting and audit advisers, public authorities and courts receive data only where required by law or necessary to protect rights. We do not sell personal data or disclose it to unrelated parties for their marketing.

6. International transfers

Because global infrastructure, CDN, email and embedded-media providers are used, limited personal data may be processed outside Türkiye. Transfers are made under the applicable mechanism in Article 9 of Law No. 6698, such as an adequacy decision, appropriate safeguards or a permitted occasional transfer, with proportionate contractual, technical and organisational measures.

Where the GDPR applies, an adequacy decision, standard contractual clauses or another valid GDPR transfer mechanism is used. The provider, processing location and mechanism may vary with the technical service.

7. Retention and deletion

Data is retained only as long as necessary to answer the request, conduct discussions and proposals, establish a potential client relationship, investigate security incidents and protect legal rights. If a client relationship is formed, records are retained for the periods required by contract, tax, commercial and limitation laws.

When the purpose and legal retention grounds expire, data is deleted, destroyed or anonymised through periodic review. Backup copies become inaccessible and are securely overwritten within the backup cycle. The technical session cookie expires when the browser session ends.

8. Security measures

Measures include role-based access, password hashing, HTTPS, CSRF and form-integrity controls, rate limiting, honeypot fields, irreversible IP hashing, logging, updates and backups.

No internet transmission is absolutely secure. Do not enter passwords, payment-card details, health data, identity documents or confidential personal information that is unnecessary for assessing a project.

9. Cookies and external content

The site uses strictly necessary first-party session and CSRF cookies for sessions and form-security checks. Cen Medya does not currently operate first-party analytics or advertising cookies. Third-party maps and video may use their own technologies; details are provided in the Cookie Policy.

10. Your rights

Under Article 11 of Law No. 6698, you may ask whether your data is processed; request information; learn the purposes and recipients; request correction, deletion or destruction where conditions apply and notification of those actions to recipients; object to adverse results produced solely by automated analysis; and seek compensation for unlawful processing.

Where the GDPR applies, you may also request access, rectification, erasure, restriction, portability, object to processing, withdraw consent, and complain to a competent supervisory authority. The website forms are not used for profiling or decisions that produce legal or similarly significant effects.

Use the Data Subject Request page to exercise these rights.

11. Children, sensitive data and updates

Cen Medya services are directed mainly to organisations and professionals; the site is not designed to knowingly collect data from children. Unauthorised child data will be deleted or handled after verification with a legal representative.

Our forms do not request special-category data. Unnecessary special-category data will be restricted or deleted. This notice may be updated when processing or law changes; the current version and effective date will be published on https://www.cenmedya.com. Questions may be sent to [email protected].