This policy explains how [LEGAL NAME], trading as Limeboom ("we"), [ADDRESS], collects and uses personal data. We act as data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies, the EU General Data Protection Regulation ("GDPR"). This text also serves as our information notice (aydınlatma metni) under Article 10 of KVKK.
What we collect
- Contact and enquiry data: name, email, company, phone or WhatsApp number and your message, when you contact us by form, email, WhatsApp or phone.
- Project data: your brief, product photos, brand materials and feedback, and the names and contact details of the people we work with.
- Billing data: company name, billing address, tax details and invoice history. Card and bank details are processed by our payment provider; we do not receive full card numbers.
- Website usage data: we use privacy-friendly, cookieless analytics ([Plausible]) that measure page views and events without identifying you. Our hosting provider processes technical data such as IP addresses in server logs for security.
Why we use it and on what legal basis
| Purpose | Legal basis (KVKK Art. 5 / GDPR Art. 6) |
|---|---|
| Answering enquiries and sending proposals | Steps before entering into a contract; legitimate interest |
| Delivering the services you ordered | Performance of a contract |
| Invoicing, accounting and tax records | Legal obligation |
| Website security and aggregated statistics | Legitimate interest |
| Showing work in our portfolio (no personal data unless agreed) | Legitimate interest / your consent where required |
We do not sell personal data and do not use it for third-party advertising.
Who we share it with
Only with service providers that help us run Limeboom, under appropriate agreements:
- Payment: Payoneer [and/or your bank]
- Website hosting: [Cloudflare / Vercel]
- Forms: [Formspree]
- Analytics: [Plausible]
- Email: [EMAIL PROVIDER, e.g. Google Workspace]
- Messaging: WhatsApp (Meta), when you choose to contact us there
- File sharing and review: [TOOL]
- AI production tools: [LIST TOOLS] — only the materials needed to produce your work (see AI Usage policy)
- Our accountant, and public authorities where required by law
International transfers
Some of these providers store data outside Türkiye (for example in the EU or the United States). Where KVKK or GDPR requires it, we rely on the transfer mechanisms they allow, such as standard contractual clauses, and on your explicit consent where KVKK requires it. [CONFIRM WITH LAWYER: KVKK Art. 9 transfer mechanism and any notification to the KVKK Authority.]
How long we keep it
- Enquiries that don't become projects: up to 12 months.
- Project files and briefs: for the duration of the project and up to 12 months after the last delivery, so we can support revisions and re-orders, unless you ask us to delete them sooner.
- Invoices and accounting records: as long as required by Turkish tax and commercial law.
- Deliverables used in our portfolio: until you ask us to remove them.
Your rights
Under KVKK Article 11 and, where it applies, GDPR, you can ask us to: tell you whether we process your data and give you a copy; correct it; delete it; restrict or object to processing; and transfer it to another provider. You can also learn who we have shared it with and claim compensation for unlawful processing. Write to [EMAIL]. We reply within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK Kurumu) or, if you are in the EU, your local data protection authority.
Security
We use reputable providers, two-factor authentication on our accounts and access limited to the people working on your project.
Children
Our services are for businesses. We do not knowingly collect data from children.
Changes
We may update this policy. The latest version is always on this page with its date.
Contact: [LEGAL NAME], [ADDRESS], [EMAIL]