Privacy Policy

1. Data Controller & Overview

This Privacy Policy applies to the website operated by RKX Dizayn Bilişim ve Teknoloji Hizmetleri Ltd. Şti. (doing business as RKX Design, “RKX Design”, “we”, or “us”).

Established in October 2015 as an independent software engineering studio, we respect the privacy of our visitors and clients. This policy explains in clear, plain language what information is processed when you visit our website or get in touch regarding our software engineering services, why it is processed, and what rights you have.

2. Information We Process

We only process information that is necessary to deliver the website, respond to your project inquiries, protect the infrastructure from abuse, and measure website traffic when you grant consent:

• Contact Form Inquiries: When you submit our project enquiry form, you voluntarily provide your name, email address, optional company name, requested service, estimated budget, timeline, and project description.
• Technical & Security Data: When viewing pages or submitting the form, standard network metadata is processed by our web server and security layers (IP address, request method, requested URL, HTTP status codes, and browser user-agent).
• Consent Preferences: Your choice regarding optional analytics is stored locally in your browser (localStorage under the key rkx_consent). It does not contain personal identity data.
• Analytics Data (Only With Consent): If you grant explicit permission via Cookie Preferences, Google Analytics 4 processes aggregated visit metrics, including pages visited, referring source, and general device parameters.

We do not operate newsletter subscriptions, automated marketing profiling, or visitor accounts on this website.

3. Purposes of Processing

We process personal information strictly for genuine, verified operational purposes:

• To evaluate, respond to, and communicate regarding project inquiries you submit,
• To operate, maintain, and ensure the technical stability of our website,
• To protect our contact form and web infrastructure against automated spam and malicious traffic,
• To understand website usage trends through aggregated analytics, strictly conditioned on your explicit consent.

4. Contact Inquiries & Delivery

When you submit a project enquiry through our contact form, your submission follows this technical workflow:

• The form fields are validated in your browser (name max 120, email max 254, company max 120, description max 4,000 characters).
• The payload is submitted directly to our own same-origin API endpoint at /api/contact via an encrypted HTTPS POST request. We do not use third-party form-scraping services.
• Our server enforces an in-memory rate limit based on client IP address (up to 5 submissions within a 10-minute window) to mitigate automated spam floods.
• The Turnstile anti-bot verification token included with the form is validated against Cloudflare’s verification service.
• Upon successful validation and verification, the enquiry is converted into a structured email and dispatched via TLS-encrypted SMTP directly to our studio inbox.

We do not store contact inquiries in a public-facing website database. Inquiries are received as standard business emails in our team mailbox. While industry-standard TLS encryption is enforced in transit, we do not claim end-to-end encryption.

5. Abuse Prevention (Cloudflare Turnstile)

To protect our contact form from automated spam bots without presenting disruptive visual puzzles, we use Cloudflare Turnstile, provided by Cloudflare, Inc.

When you open our contact page, the Turnstile widget initializes from challenges.cloudflare.com and evaluates connection characteristics (including IP address, user agent, and TLS telemetry) to verify genuine human interaction.

When the form is submitted, our backend verifies the generated token with Cloudflare. We do not transmit your name, email, or message body to Cloudflare during this verification. Cloudflare processes technical device telemetry in accordance with its Turnstile Privacy Policy. Turnstile is deployed strictly to safeguard our communications channels from automated abuse.

6. Website Analytics (Google Analytics 4)

We use Google Analytics 4 (Measurement ID: G-V4PYXWRZP1), provided by Google LLC, to measure website traffic and improve content delivery.

Analytics measurement is strictly optional and disabled by default. We follow Google’s Basic Consent Mode v2 architecture:

• Before you grant consent, or if you reject optional analytics, no Google script (gtag.js), tag, connection, or cookieless ping is initiated.
• All advertising signals (ad_storage, ad_user_data, ad_personalization) and Google Signals are permanently disabled. We do not engage in remarketing or cross-site tracking.
• The Google tag loads only after you choose “Accept All” or enable “Analytics” in your Cookie Preferences.
• When enabled, measurement uses clean canonical URLs, stripping query parameters and URL fragments.
• You can withdraw your consent at any time using the “Cookie Preferences” button in the footer. On withdrawal, the tracking script is disabled, first-party Google cookies (_ga, _ga_V4PYXWRZP1) are deleted, and the document is reloaded cleanly.

7. Service Providers & Data Recipients

The verified technical service providers involved in operating this website include:

• Cloudflare, Inc.: Anti-bot verification for the contact form.
• Google LLC: Optional website usage measurement (only upon explicit consent).
• SMTP Email Provider: Dispatching contact form inquiries to our studio mailbox.
• Web Hosting Infrastructure: Nginx web server environment serving static pages and proxying contact requests.

We do not sell, rent, or trade your personal information with third-party advertising brokers.

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purpose for which it was processed:

• Consent Preferences: Stored locally in your browser’s localStorage for a provisional period of 30 days (or until cleared by you or updated upon a policy revision). This 30-day value is an interim technical setting approved by studio management.
• Abuse Prevention Records: In-memory rate limiting records expire after 10 minutes and are purged from server memory.
• Contact Inquiries: Inquiries sent to our studio inbox are retained for the duration of the business engagement and in accordance with standard commercial and statutory record-keeping practices.
• Analytics Records: When enabled, event retention is governed by Google Analytics property configuration.

9. Your Rights Under GDPR & KVKK

Depending on your location, you may have rights regarding your personal information under applicable data protection laws (such as the EU General Data Protection Regulation - GDPR, and the Turkish Personal Data Protection Law - KVKK Law No. 6698):

• The right to know whether your personal data is processed and request details of processing,
• The right to access, rectify, or update incomplete or inaccurate personal data,
• The right to request the deletion or erasure of personal data where legally applicable,
• The right to object to or restrict processing,
• The right to withdraw consent at any time (via the “Cookie Preferences” button in the footer),
• The right to lodge a complaint with a competent supervisory authority (such as the Personal Data Protection Authority / KVKK in Türkiye or competent EU supervisory bodies).

To exercise any of these rights or ask questions about our data practices, contact us directly at [email protected].

10. International Data Transfers

Our technical providers (Cloudflare and Google) operate globally distributed infrastructure with servers located in the United States, the European Union, and other jurisdictions. Technical data transfers rely on standard commercial security frameworks; specific contractual transfer arrangements remain subject to ongoing administrative and legal review.

11. Changes to This Policy

We may revise this Privacy Policy periodically to reflect technical or legal changes. Updates will be posted on this page with an updated “Last updated” date. If material changes are made to consent categories or processing purposes, the consent manager will prompt you to review your preferences on your next visit.