Data controller and contact
Website operator: CSA Medya. You may submit requests concerning your personal data using the contact details below.
Contact address: Varyap Meridian A Blok, Barbaros Mah. Al Zambak Sk., 34746 Ataşehir/İstanbul
E-mail: hello@csamedya.com.tr
Telephone: 0850 885 1836
Information processed
Contact: We store your name, e-mail, company, service of interest and message, along with your language, consent timestamp and an HMAC-SHA-256 digest of your IP address generated with the application key. Authorized administrators can view messages. When notifications are enabled, the message is e-mailed to the configured recipient. Admin replies and send records are stored in the outbound e-mail system. If incoming-mail sync is enabled, sender, subject and text body from matching replies are added to the related contact record.
Newsletter: Your e-mail address is collected through an explicit consent checkbox and stored with language, consent time and text version, an IP digest, subscription status, confirmation/unsubscribe times and a confirmation token. Only active subscribers with recorded consent and confirmation are eligible for campaigns; each address is checked again at send time. Every campaign e-mail includes an unsubscribe link. Each e-mail goes to one recipient; opens and clicks are not tracked.
Outbound e-mail records: Contact notifications, subscription confirmations, replies and campaign e-mails are stored in outbound mail records. These records are deleted when the linked contact or subscriber record is deleted. The default sending limit is 200 e-mails in a rolling 24-hour period and no more than one per minute; this can change if settings change. If optional incoming-mail sync is enabled, the system connects to the mailbox using read-only TLS/IMAP. It imports only messages whose In-Reply-To/References match a sent reply Message-ID and whose sender matches the original recipient; sender, subject and text body are linked to the contact record. Attachments and remote images are not fetched, unmatched mail is not imported, and mailbox read flags are not changed. Incoming replies appear in the admin panel with the related message.
Security and analytics: Necessary technical data supports sessions and form security. Cloudflare Turnstile is enabled; verification tokens and the request IP address are sent to Cloudflare. Google Analytics 4 loads only after you opt in. Before consent, analytics code does not run and analytics cookies are not set. With consent, Google may process usage data and identifiers. The application sends an IP-anonymization parameter; this does not make all data anonymous. Your versioned choice is stored in browser local storage. Automatic injection of the Cloudflare Web Analytics browser beacon is disabled. Cloudflare network and security traffic processing is separate.
AI content workflows: When automation is enabled, the system may generate topic/title suggestions from editorial topics and keywords, draft blog articles and translate articles into English and German. Editorial topics, keywords and article text are sent to the provider selected in settings for these tasks; contact, subscriber and e-mail-recipient records are not part of this workflow. Provider and data location depend on configuration.
Purposes, collection method and legal basis
Security and analytics: Necessary technical data supports sessions and form security. Cloudflare Turnstile is enabled; verification tokens and the request IP address are sent to Cloudflare. Google Analytics 4 loads only after you opt in. Before consent, analytics code does not run and analytics cookies are not set. With consent, Google may process usage data and identifiers. The application sends an IP-anonymization parameter; this does not make all data anonymous. Your versioned choice is stored in browser local storage. Automatic injection of the Cloudflare Web Analytics browser beacon is disabled. Cloudflare network and security traffic processing is separate.
E-mail recipients and service providers
Contact notifications, confirmations, replies and campaigns are delivered through the e-mail service configured in the application. Hosting/database, Cloudflare Turnstile and, after opt-in, Google Analytics may also process data; the selected AI provider may receive data if that feature is enabled. Provider identity, data location, international transfer terms and provider retention periods cannot be verified from application records and depend on the services and agreements in use.
Your rights under KVKK Article 11
You may ask whether your personal data is processed and request information about it; ask about processing purposes and use; learn which domestic or foreign third parties receive it; request correction of incomplete or inaccurate data, deletion or destruction, and notification of those actions to recipients; object to a result against you based solely on automated analysis; and seek compensation for damage caused by unlawful processing.
Retention and requests
Contact and subscriber records remain until an administrator deletes them; no automatic deletion period is configured. Outbound e-mail records are deleted when their linked contact or subscriber record is deleted. De-identified timestamps used for send-limit counting are deleted after 30 days. Send a request about your rights to hello@csamedya.com.tr. The official data-controller identity and application procedure must be completed before publication.
Web application security
For suspicious requests, the IP address is stored encrypted with the request method, path without query parameters, security rule, a limited browser/bot identifier and timestamp. Request bodies, passwords, cookies and query parameters are not recorded in the security log. At most one sample per IP and rule is stored each minute. Events are deleted after 7 days by default; administrators may set retention to 1–30 days. IP allow/block rules expire and are removed by daily cleanup. Published crawler and Cloudflare IP ranges are used to assess request origins.