Privacy Policy & Data Protection Notice
At Lupiapps (referred to below as "Lupiapps", "we" or "the agency") we take the privacy of your personal data seriously. This notice explains, in our capacity as data controller, how we process the data we collect through our website — including under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR").
1. Data controller
Entity: Lupiapps Software & Consulting
Address: Istanbul, Turkey
Contact: via the form on our contact page
2. Personal data we process
We process personal data in the following categories:
- Identity data: first name, last name.
- Contact data: email address, phone number, company name.
- Message content: project details and budget information you share through the chat or the contact form.
- Technical data: IP address, browser information, pages visited (via cookies).
3. Purposes of processing
- Preparing a quote for your enquiry and communicating with you,
- Carrying out the contracting process and delivering our services,
- Meeting our legal obligations,
- Measuring and improving website performance,
- Sending news, blog and event updates where you have given marketing consent.
4. Legal bases
We process data on the basis that it is necessary for entering into or performing a contract, on the basis of our legitimate interests, and on the basis of your explicit consent, as set out in Article 5/2 of the KVKK and Article 6 of the GDPR.
5. Third parties we share data with
Your data may be shared, in a limited way, with (i) our cloud infrastructure providers (for example AWS, Vercel, Cloudflare), (ii) our email delivery service (Resend), and (iii) public authorities where we are legally required to do so. Where data is transferred abroad, the safeguards required by Article 9 of the KVKK and Chapter V of the GDPR are put in place.
6. Retention period
Your personal data is retained for as long as the purpose of processing requires and for the periods prescribed by applicable law. Contracted client data is kept for 10 years; contact form data is kept for a maximum of 24 months.
7. Cookie policy
Our website uses strictly necessary cookies (session management), performance cookies (page views) and preference cookies (language/theme selection). Marketing cookies are enabled only with your explicit consent.
You can manage or delete cookies from your browser settings. If you disable cookies, some features of the site may not work.
8. Your rights
As a data subject you have the right to:
- Find out whether your personal data is being processed,
- Request information about that processing,
- Learn the purpose of processing and whether the data is used accordingly,
- Know the third parties, domestic or abroad, that the data has been shared with,
- Request correction of incomplete or inaccurate data,
- Request erasure or destruction of the data under the applicable conditions,
- Object to the consequences of the processing,
- Claim compensation for damage arising from unlawful processing.
You can submit your requests in writing through our contact page. We will respond within 30 days at the latest.
9. Security measures
We apply industry-standard measures to protect your data: TLS encryption, access controls, logging, periodic security testing and the principle of data minimisation.
10. Changes
This policy may be updated in line with changes to legislation and to our services. Significant changes are announced on the website. The current version is always published on this page.
11. Contact
For any questions about our privacy policy you can reach us through our contact page.