Last Updated: October 26, 2026
This Privacy Policy and Privacy Notice is issued by SnA Danışmanlık Ltd. Şti. (“SnA Consulting”, “we”, “us”) as data controller under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It covers people who visit www.sna-consult.com and people who contact us.
In short: The website has no user accounts, no newsletter and no online sales. What you write in the contact form is used only to answer your request. Google Analytics runs only if you accept it in the cookie banner. The Google map loads only if you press “Show map”. We do not sell, rent or use your data for marketing.
Where the EU General Data Protection Regulation (“GDPR”) applies to visitors from the European Union or the European Economic Area, this notice also contains the information required by Article 13 GDPR. If the English and Turkish versions differ, the Turkish version prevails.
1. Data Controller
Company: SnA Danışmanlık Ltd. Şti.
Address: Levent Loft, Büyükdere Caddesi No: 201, Şişli, Istanbul, Türkiye
Email: info@sna-consult.com
Phone: +90 212 268 15 50
2. What We Process, Why, and on What Legal Basis
Each processing activity on the website is listed below with the data, purpose, legal basis and collection method. Retention periods are in Section 5.
2.1. Visiting the Website (Server Logs)
- Data: IP address, date and time of access, requested page, browser and operating system, referring address.
- Purpose: Delivering the website, finding errors and keeping it secure.
- Legal basis: Our legitimate interest (KVKK Art. 5/2(f); GDPR Art. 6(1)(f)).
- Collection method: Automatically by the hosting server when you open the website.
2.2. Contact Form
- Data: Identity (first and last name), contact details (email address, optional phone number), company name and message. For form security also the IP address, a session cookie and the browser and device characteristics collected by Cloudflare Turnstile.
- Purpose: Reading and answering your request, contacting you, handling offers and contracts if your request becomes a business discussion, and protecting the form against automated or abusive submissions.
- Legal basis: Where your request relates to entering into a contract: necessity for concluding or performing a contract (KVKK Art. 5/2(c); GDPR Art. 6(1)(b)). For general questions and form security: our legitimate interest (KVKK Art. 5/2(f); GDPR Art. 6(1)(f)), namely answering business enquiries and protecting the form from spam and abuse.
- Collection method: Electronically, from you, when you fill in the form.
The form cannot be sent without the fields marked with an asterisk; without them we cannot receive your request through the form. The phone number is optional.
Your message is sent from the hosting server through the company email service to the mailboxes of SnA Consulting staff authorised for this task. The website does not keep a separate form database.
The security check (Cloudflare Turnstile) and the session cookie load when you start interacting with the form. Your IP address is used transiently for rate limiting and bot verification.
Please do not include special categories of personal data (such as health, religion or ethnic origin) in your message. The contact form is not a channel for job applications or data protection requests.
2.3. Contacting Us Directly by Email or Phone
- Data: Name, email address or phone number, and the content of the correspondence or call.
- Purpose and legal basis: The same as for the contact form in 2.2 (KVKK Art. 5/2(c) and 5/2(f)).
- Collection method: From you, when you email or call us.
2.4. Storing Your Cookie Choice
- Data: Whether you accepted or rejected analytics cookies, and when that choice expires.
- Purpose: Remembering your choice and being able to demonstrate consent.
- Legal basis: Compliance with a legal obligation (KVKK Art. 5/2(ç); GDPR Art. 6(1)(c)) and our legitimate interest (KVKK Art. 5/2(f)).
- Collection method: When you choose in the cookie banner or in “Cookie Settings”, stored only in your browser’s local storage. It is not sent to us or to third parties.
2.5. Google Analytics (Only With Your Consent)
- Data: Cookie identifier (_ga, _ga_*), pages visited, time on page and interactions, referring source, browser, operating system and device type, approximate location (country/city) derived from the IP address. Google Analytics 4 uses the IP address to estimate location and does not store it.
- Purpose: Understanding how the website is used, which content is of interest and where technical problems occur; improving content and user experience.
- Legal basis: Your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)). Without consent Google Analytics does not load and no analytics request is sent to Google.
- Collection method: Automatically, through cookies and the Google Analytics tag, after you consent.
Google signals and ad personalisation are turned off; analytics data is not used for advertising. You can withdraw consent at any time with the “Cookie Settings” button at the bottom of the page; withdrawal does not affect the lawfulness of processing before it. See the Cookie Policy for details.
2.6. Google Maps (Only If You Open the Map)
- Data: IP address, browser and device information, the page on which you view the map, and Google’s own cookies.
- Purpose: Showing our office location on a map.
- Legal basis: The explicit consent you give by pressing “Show map” (KVKK Art. 5/1; GDPR Art. 6(1)(a)).
- Collection method: Automatically, when your browser connects directly to Google’s servers after you press the button. If you do not press it, no connection to Google is made.
2.7. Job Applications and External Links
Job applications are not collected on this website. The links on the Careers page take you to the TalentBench platform (sna-tb.com); the privacy notice provided on that platform applies to the data you share in your application. The LinkedIn, X, Instagram and YouTube links are plain links; no plug-in or tracking code from those platforms runs on this website. When you follow a link, that platform’s own privacy policy applies.
What we do not do: We do not use form, email or analytics data for direct marketing, advertising or profiling. We do not send a newsletter. No decision producing an adverse effect on you is taken solely by automated means on this website.
3. Who Receives Personal Data and Why
We do not sell, rent or commercially transfer your personal data. Data is shared only with the recipients below and only as far as needed for the stated service (KVKK Art. 8 and 9):
| Recipient | Service and purpose | Server location |
|---|---|---|
| Hosting provider | Hosting the website and the contact form; server logs and form data | Outside Türkiye |
| Corporate email provider | Company email; form messages and email correspondence | Outside Türkiye |
| Cloudflare, Inc. | Bot verification on the contact form (Turnstile); IP address, browser and device characteristics | USA and Cloudflare’s global network |
| Google LLC (Google Analytics) | Only if you consent: website usage measurement | USA and Google data centres |
| Google LLC (Google Maps) | Only if you open the map: displaying the map | USA and Google data centres |
| Competent public authorities | Only where expressly required by law and upon an official request (KVKK Art. 5/2(a) and (ç)) | Türkiye |
4. International Data Transfers
The servers of the providers above are located outside Türkiye, so your personal data is transferred abroad. These transfers are made under KVKK Art. 9 as follows:
- Regular transfers (hosting, email, bot verification and, if you consent, Google Analytics): made in accordance with KVKK Art. 9.
- Occasional transfers made at your request (for example opening the map): based on your explicit consent (KVKK Art. 9/6(a)). Before you open the map you are told that your data will go to Google servers in the USA.
Where GDPR applies, transfers to the USA rely on the provider’s certification under the EU-U.S. Data Privacy Framework or on the European Commission’s standard contractual clauses (Art. 45 and 46 GDPR).
5. Retention Periods
Personal data is kept only as long as its purpose requires. When the period ends, it is deleted, destroyed or anonymised.
| Data | Retention period |
|---|---|
| Contact form messages and email correspondence | 2 years after the request is closed. If the request leads to a contract, 10 years after the contractual relationship ends (Turkish Code of Obligations Art. 146 and Turkish Commercial Code Art. 82). |
| Form security records | Rate-limit record: deleted about 2 hours after the last attempt. Duplicate-submission record: about 5 minutes. Technical error logs (no IP or form content): 30 days. Session cookie (sna_contact): ends when the browser session ends. |
| Server access logs | Kept for the period set in the hosting provider’s systems; SnA Consulting does not archive them separately. |
| Cookie choice | 12 months in your browser; you are asked again when it expires. |
| Google Analytics | Cookies (_ga, _ga_*): at most 12 months after your last visit. User- and event-level data on Google’s servers: 2 months. When you withdraw consent, the cookies are deleted from your browser. |
| Google Maps and Cloudflare Turnstile | Data these providers keep on their own domains is subject to the periods in their own privacy policies. |
6. Your Rights Under KVKK Article 11
By applying to the data controller, you have the right to:
- (a) learn whether your personal data is processed,
- (b) request information if it has been processed,
- (c) learn the purpose of processing and whether the data is used for that purpose,
- (ç) know the third parties in Türkiye or abroad to whom the data is transferred,
- (d) request correction of incomplete or inaccurate data,
- (e) request deletion or destruction of the data under the conditions in KVKK Art. 7,
- (f) request that actions under (d) and (e) be notified to third parties to whom the data was transferred,
- (g) object to a result against you that arises from analysis of the data exclusively by automated systems,
- (ğ) claim compensation if you suffer damage because of unlawful processing.
You can withdraw consent for consent-based processing (Google Analytics, Google Maps) at any time; for Google Analytics use the “Cookie Settings” button at the bottom of the page. Withdrawal does not affect the lawfulness of processing before it.
Where GDPR applies you also have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on legitimate interests (Art. 21) and to lodge a complaint with the data protection authority in your country (Art. 77).
7. How to Exercise Your Rights
In line with the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can send your request:
- In writing: SnA Danışmanlık Ltd. Şti., Levent Loft, Büyükdere Caddesi No: 201, Şişli, Istanbul, Türkiye
- By email: to info@sna-consult.com from an email address you have previously notified to us and that is registered in our systems
- With a secure electronic signature, mobile signature or registered electronic mail (KEP)
Your request should include your name, surname, signature if in writing, Turkish ID number (or nationality and passport number for foreigners), postal address for notification, notification email address if any, phone number and the subject of your request. We may ask for additional information to verify your identity. The general contact form is not a channel for these requests, because it does not collect identity and notification details.
Requests are answered free of charge as soon as possible and within 30 days at the latest. If the action requires an additional cost, a fee in the tariff set by the Personal Data Protection Board may be charged (KVKK Art. 13). Where GDPR applies, the response period is one month and may be extended by two further months for complex requests; we will tell you about any extension.
If your request is rejected, you find the answer insufficient, or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of your application (KVKK Art. 14).
8. Data Security
We apply technical and organisational measures proportionate to the nature of the data and the risk (KVKK Art. 12; GDPR Art. 32). If we become aware of a personal data breach, we notify the persons concerned and the Board.
9. Children’s Privacy
The website is aimed at business customers and not at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent personal data through the website, write to info@sna-consult.com and we will delete it.
10. Changes to This Notice
We update this notice when our processing activities or the law change. The current version is published on this page with its “Last Updated” date. For important changes, such as a new service provider or a new purpose, we also post a notice on the website.
Summary
- ✓ The data controller is SnA Danışmanlık Ltd. Şti.
- ✓ Contact form data is used only to answer your request and is kept for 2 years (10 years if it leads to a contract).
- ✓ Google Analytics and Google Maps run only with your consent; you can withdraw it in “Cookie Settings”.
- ✓ Our service providers are outside Türkiye; transfers follow KVKK Art. 9.
- ✓ Your data is not sold, rented or used for marketing or advertising.
- ✓ To exercise your KVKK Art. 11 rights, write to us or email info@sna-consult.com from your registered address.