Who we are
Ionia Studio is a Shopify development studio operated by [Company legal name], [Registered address] (tax office and number: [Tax office and number]).
We are the data controller for personal data collected through ionia.studio. This means we decide why and how it is used. We act under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for visitors in the EU and EEA, the General Data Protection Regulation (GDPR).
Contact for anything in this policy: [email protected]. [EU representative under GDPR Art. 27, if appointed: name and address].
What we collect
We only collect what you give us when you get in touch, plus the minimum technical data needed to show you the site.
- Project form: name, email, company (optional), store URL (optional), platform, timing, the services you select and your note.
- Emails to [email protected]: your email address, the content of your message and any attachments.
- Call bookings through Cal.com: your name, email, the time you choose and anything you add in the booking form.
- Technical data: when your browser loads our fonts from Google Fonts, Google receives your IP address and basic browser information. [If analytics is enabled: usage data as described in our Cookie policy.]
- Browser storage: your theme choice and whether you have seen the intro animation. This stays on your device and is never sent to us.
How the project form works
Today the form does not send anything to us by itself. It opens your own email app with a prepared message. Nothing reaches us until you press send, and from then on it is handled as a normal email.
[When a form service is added: submissions are sent to [Form provider], which stores them on our behalf and forwards them to us.]
Please do not include sensitive information, such as health data, in your note. We do not need it.
Why we use it and on what legal basis
We use your data only for the purposes below. We do not sell it, send marketing emails, run ad tracking or make decisions about you by automated means.
- To reply to your enquiry, prepare a proposal and agree a project. Basis: steps taken at your request before a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
- To schedule and hold calls you book. Basis: same as above.
- To answer general messages that are not about a project. Basis: our legitimate interest in responding to people who contact us (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- To deliver the website, load its fonts and keep it secure. Basis: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- To understand how the site is used [only if analytics is enabled]. Basis: your consent (GDPR Art. 6(1)(a); explicit consent under KVKK Art. 5(1)). You can withdraw it at any time.
- To keep records that Turkish tax and commercial law require if you become a client. Basis: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
- To establish, exercise or defend legal claims. Basis: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(e)).
How long we keep it
We keep data only as long as needed, then delete, destroy or anonymise it.
- Enquiries that do not lead to a project: [12 months] after our last contact, then deleted.
- Client correspondence and records: as long as Turkish law requires, generally [10 years] under the Turkish Commercial Code and [5 years] under the Tax Procedure Law.
- Call booking records in Cal.com: [retention period].
- Analytics data [if used]: [retention period set with the Analytics provider].
- Browser storage: until you clear it in your browser.
Who receives it
We share data only with service providers that help us run the studio, and only as far as they need it. They process it on our instructions under data processing terms.
- Cal.com, Inc. (call scheduling), United States.
- [Email hosting provider] (our email inbox), [Country].
- [Form provider] (form submissions, once enabled), [Country].
- [Analytics provider] (site analytics, only if enabled), [Country].
- Google (Google Fonts, font delivery), United States and other locations.
- [Website hosting provider, if it keeps server logs], [Country].
- Our accountant or legal advisers, where needed for client work, and public authorities when the law requires it.
International transfers
We are based in Turkey. If you contact us from the EU, your data comes directly to us in Turkey, and we protect it to the GDPR standard.
Some providers above store data outside Turkey and the EU, mainly in the United States. For GDPR purposes we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses. For KVKK purposes we rely on the safeguards in Article 9 of Law No. 6698, such as standard contracts notified to the Personal Data Protection Authority. [Confirm the mechanism used for each provider.]
Your rights under the GDPR
If the GDPR applies to you, you can ask us to:
- give you a copy of your data (access);
- correct it (rectification);
- delete it (erasure);
- limit how we use it (restriction);
- send it to you or another provider in a portable format (portability);
- stop using it where we rely on legitimate interest (objection);
- and you can withdraw consent at any time, without affecting earlier use.
Your rights under KVKK
Under KVKK Article 11, you can:
- learn whether we process your data and request information about it;
- learn the purpose of processing and whether it is used for that purpose;
- know the third parties in Turkey or abroad to whom it is transferred;
- ask for incomplete or incorrect data to be corrected;
- ask for deletion or destruction under the conditions in KVKK Article 7;
- ask that corrections or deletions be notified to those third parties;
- object to a result against you that comes solely from automated analysis;
- claim compensation for damage caused by unlawful processing.
How to use your rights
Email [email protected] from the address we already have for you, or write to [Registered address]. If you are in Turkey, you can also apply by registered electronic mail (KEP) to [KEP address], or with a secure electronic or mobile signature, as set out in the Communiqué on the Procedures and Principles of Application to the Data Controller.
We may ask you to confirm your identity. We reply within one month under the GDPR and within 30 days under KVKK. Requests are free, unless KVKK allows a fee because answering involves an extra cost.
Complaints
We would like the chance to fix any concern first, but you can always complain to a regulator.
EU and EEA: the data protection authority in the country where you live, work or where the issue happened.
Turkey: the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). Under KVKK Article 14, you must apply to us first. You can then complain within 30 days of our reply, and in any case within 60 days of your application.
Changes
We will update this policy when our tools or practices change, for example when we choose a form or analytics provider. The effective date at the top always shows the latest version.
Contact
[Company legal name], [Registered address]. Email: [email protected].