Privacy Policy

Section 1A one-page summary

Privacy policies are usually texts nobody reads. So we have put everything you need to know at the very top, in case you do not have time for the whole document. Each point below is explained in detail in the sections that follow.

• We only receive the information you write to us. If you complete the contact form, your name, email address and message reach us. If you do not complete the form, we hold none of this information.
• Simply opening the site sends no data to any third party. We serve the fonts from our own server; the map and analytics are not loaded at all until you give permission.
• No tracking without your consent. If you decline in the cookie banner, Google Analytics does not run at all — not "partially", not "anonymously": it is never loaded.
• We do not sell your data. We do not share it with advertising networks, do not build marketing lists and do not send newsletters without your consent.
• Server logs are kept — but within Türkiye. Like every web server, ours records incoming requests (IP address, date, page). This is necessary for security and debugging and is not something that can be declined; however it is used only for those purposes and is deleted after one year. Because the servers hosting the site are in Türkiye, these records are not transferred abroad.
• You can change your mind at any time. You can change your cookie preference from the Cookie Settings link at the bottom of the page, and request the deletion of your data by writing to us.

Section 2What does this policy cover?

This policy covers the website under the domain h2o-organizasyon.com and the contact you make with us through that site. The data controller is H2O Organizasyon ve İnsan Kaynakları Limited Şirketi; our corporate details appear in Section 2 of the Privacy Notice.

Areas this policy does not cover:

• Third-party sites and applications linked from our site (WhatsApp, Google Maps, social media accounts). When you click those links, the relevant company's own privacy policy applies.
• Relationships you establish with us outside the site — contractual processes, data on staff working in field operations, supplier relationships. Separate privacy notices apply to these.

This policy should be read together with the KVKK Privacy Notice. The privacy notice satisfies, point by point, the formal framework required by the Law; this policy addresses the same subjects in plainer language. If you see any conflict between the two, the privacy notice prevails.

Section 3Information we collect

3.1 — Information you give us yourself

The information you share when you complete the contact form, send an email, telephone us or message us on WhatsApp. The fields on the form are: full name and email address (required); company, telephone, service type, event date (optional); message (required).

We use this information only to respond to you and to assess your request. Submitting the form does not add you to a list; you will not receive promotional email unless you ask for it.

3.2 — Technical information generated automatically

When you visit the site, our server records connection information: your IP address, the time of the visit, the address of the page you opened, the result of the request, browser and operating system information, and the link you arrived from.

These are the standard records every web server produces; although they can technically be switched off, they need to be kept for security reasons. We have no other way of noticing an attempted attack, understanding why a page returned an error, or detecting misuse.

3.3 — Information collected if you consent

If you allow analytics cookies in the cookie banner, Google Analytics collects statistical information about your visit: which pages you browsed, how long you stayed, where you came to the site from, your device type and your approximate location at city level.

In looking at this data, our purpose is not to answer the question of who did what individually; it is to understand which service page attracts interest, on which page people leave quickly, and what we need to fix.

Section 4Information we do not collect

This part of a privacy policy matters at least as much as the part describing what is collected. This site does not collect:

• Special categories of personal data. We do not request data listed in Article 6 of the KVKK, such as health information, religion, ethnic origin, political opinion, trade union membership, biometric data or criminal convictions. Unless you write it into the free-text field of your own accord, no such data reaches us — and we kindly ask that you do not.
• Payment and financial information. No payments are taken on the site. Credit card details, bank account numbers and similar data are never requested and never stored.
• Precise location data. We do not request location permission from your browser. In our server configuration, location access is disabled at browser level.
• Identity document information. Turkish ID numbers, passport or driving licence details are not requested through the site. (If you make a KVKK application, we may need to verify your identity; that is a separate process, dependent on your request.)
• Advertising and tracking cookies. The site contains no advertising network, pixel, retargeting tag or social media tracking code. There is no Facebook Pixel, no Google Ads conversion tag, no TikTok pixel or anything similar.
• Fingerprinting techniques. We do not use browser fingerprinting methods that try to recognise you even when you have declined cookies.

Section 5External services we use

The table below shows every third-party service this site comes into contact with and when each one is activated. Once you have read the whole table, you can be confident that there is no other external connection on the site.

A service we removed: Google Fonts

This site used to load its fonts via Google Fonts. That is a common practice, but it has a drawback: the moment the page opens — before you click anything or give any consent — your IP address goes to Google's servers. In 2022 a court in Germany found this practice to be contrary to data protection legislation.

We moved the fonts to our own server. Opening the page now sends no request to any third party. As a side benefit, the page also became somewhat faster, because the browser no longer has to open a separate connection to Google.

Section 6Cookies

Apart from those strictly necessary for the site to work, no cookies are written to your browser without your permission. The only record we keep in the strictly necessary group is your cookie preference itself — if we did not store that, we would have to ask you the same question every time a page loaded.

What each cookie does, how long it is kept and how to manage it from your browser settings are explained in detail on our Cookie Policy page. To change your preference you can use the Cookie Settings link.

Section 7Who do we share information with?

We do not sell your personal data. Sharing occurs only in the following four situations, and only to the extent necessary:

1. With our service providers. The hosting company and (once enabled) the form delivery service come into technical contact with the data. These are "data processors" within the meaning of the KVKK; they cannot use your data other than on our instructions.
2. With the analytics service you have consented to. Only if you give permission in the cookie banner, with Google Analytics.
3. With authorised public authorities. Where there is a court order or a duly made request from an authority empowered by law, to the extent required by the legislation. When such a request arrives, we try to inform you unless we are legally prevented from doing so.
4. With our legal counsel. To the extent necessary to exercise our right of defence in the event of a dispute.

Beyond these, we share visitor data with no third party — including our business partners, suppliers and reference companies.

Section 8Transfer of data abroad

Because Google's servers are located outside Türkiye, consenting to the analytics or map components means your data is transferred abroad. This transfer depends entirely on your consent: if you do not consent, the relevant code is never loaded and no data is sent.

The legal basis for the transfer is your explicit consent under Article 9 of the KVKK. Which service transfers which data is set out in a table in Section 7 of the Privacy Notice.

Your server logs do not leave the country. The servers hosting the site are in Türkiye; the connection records generated when you open the site (IP address, time of visit, page opened) are therefore processed and stored domestically. As regards this data there is no transfer abroad within the meaning of Article 9 of the KVKK.

That leaves only form submissions. Because the contact form is not yet connected to a delivery service, no data is currently transferred by that route either. Once a service is chosen, if its servers are located abroad, this section and Section 7 of the Privacy Notice will be updated with the name of the service and the country of its servers.

Section 9Retention periods

We do not keep any data indefinitely. In summary:

• Quote requests: 2 years from the last correspondence (10 years if it becomes a contract)
• Server logs: 1 year
• Analytics data: a maximum of 14 months
• Your cookie preference: 12 months, after which you are asked again

The reasons for these periods are explained in Section 8 of the Privacy Notice, and the methods of destruction on the Data Retention and Destruction Policy page.

Section 10Security

All traffic on the site is encrypted with HTTPS; what you write into the form does not travel across the network in plain text. Access to the server is limited to authorised persons and is made using an encrypted key. Browser security headers are enabled.

The strongest security feature of this site is in fact structural: because there is no database, user account or payment infrastructure, there is no store of personal data for an attacker to target.

Even so, we know that no system is one hundred per cent secure. In the event of a data breach we will notify the Personal Data Protection Board and the affected individuals as soon as possible.

Section 11Children's privacy

This site is an information site aimed at corporate clients; it is not directed at children and does not knowingly collect personal data from children.

If you become aware that a child's personal data has reached us without the consent of their parent or guardian, please notify info@h2o-organizasyon.com; we will delete the data without delay.

Section 12Links to other sites

Our site contains links to other sites — such as WhatsApp, Google Maps and our Instagram account at the foot of the page. These are links and nothing more; there is no component on our site that tracks you, such as an embedded Instagram feed or a like button, so no data goes to Instagram unless you click. Once you click these links, you are no longer on our site.

We are not responsible for the content, privacy practices or security of the sites we link to. For information you share on those sites, that site's own policy applies; we recommend reading it before visiting.

Section 13Your rights

Under Article 11 of the KVKK you have the right to: learn whether your data is being processed; request information about it; learn whether it is being used for its intended purpose; know the third parties to whom it has been transferred; request its correction, deletion or destruction; request that these operations be notified to third parties; object to a conclusion reached against you as a result of automated analysis; and claim compensation for any damage you suffer.

The full list of your rights and the application procedure are in Sections 10 and 11 of the Privacy Notice, and a ready-made application template is on the Data Subject Application Form page.

For processing based on explicit consent — analytics cookies and the map — there is no need to apply at all: you can withdraw your consent instantly from the Cookie Settings window.

Section 14Changes and contact

We update this policy as the services we use or the legislation change. The current version is always published on this page; the last updated date and version number at the top of the page indicate the change.

If a change materially affects processing based on consent, the cookie banner is shown again and your preference is requested afresh. Your earlier consent is not automatically extended to the new situation.