Who is responsible for your data
The data controller is Hi Brand Studio, Istanbul, Türkiye (hello@hibrand.studio, WhatsApp +90 534 209 00 97).
What we collect
- Identity and contact: name, email address, WhatsApp or phone number, business name.
- Billing (Türkiye invoices): TC kimlik number or tax number, invoice address.
- Your project: booking details, brief answers, files and messages you send us.
- Payments: amounts, dates and payment status. Card details go directly to our payment provider; we never see or store them.
- Website use: IP address, device and browser details, pages visited, and cookie data. Analytics and advertising cookies are used only if you allow them.
Why we use it, and on what legal basis
- To answer your request, book your project, deliver the work and talk to you about it: performing a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
- To issue invoices and keep accounting records: legal obligation (KVKK art. 5/2-ç; GDPR art. 6(1)(c)).
- To keep the website secure and fix problems: legitimate interest (KVKK art. 5/2-f; GDPR art. 6(1)(f)).
- To measure the website and show you our ads on other platforms: your explicit consent through the cookie banner (KVKK art. 5/1; GDPR art. 6(1)(a)). You can withdraw it at any time.
- To send you news and offers: your explicit consent, given separately. Every message has an unsubscribe link.
Who we share it with
Only what each one needs, and only for the purposes above:
- Payment providers (iyzico or PayTR) for card payments and instalments.
- Our accountant and e-invoice provider, for invoicing.
- Hosting, email and file storage providers, some of which keep data outside Türkiye (for example in the EU or the US).
- Advertising and analytics platforms (Meta, Google), only when you have accepted those cookies.
- Public authorities, when the law requires it.
When data is transferred abroad, we rely on the safeguards in KVKK article 9, such as standard contracts notified to the Personal Data Protection Authority, or other legal grounds.
How long we keep it
We keep project data for as long as the project and any care plan last, and for up to 3 years after, so we can answer questions about the work. Invoices and accounting records are kept for 10 years, as Turkish law requires. Website analytics data is kept for up to 14 months.
After that, we delete or anonymise it.
Your rights
Under KVKK article 11 you can ask us to:
- tell you whether we process your data, and how;
- tell you why we process it and whether it is used for that purpose;
- tell you who we share it with, in Türkiye and abroad;
- correct data that is incomplete or wrong;
- delete or destroy your data under the conditions in article 7, and tell the people we shared it with;
- object to a decision made only by automated systems that affects you;
- compensate you if you suffer damage because of unlawful processing.
If you are in the EU or the UK, you also have the GDPR rights to data portability and to complain to your local data protection authority.
How to ask
Email hello@hibrand.studio from the address you used with us, or send a signed letter to our postal address, which we share on request. Tell us your name, how to reach you and what you would like us to do.
We answer within 30 days, free of charge. If an answer costs us extra, we may charge the fee set by the Personal Data Protection Board.
Questions about this page? Write to us and a person answers.