Privacy Notice
This notice explains how personal data you submit through the demo and contact forms on tanbuhr.com is processed, under Article 10 of Turkish Personal Data Protection Law 6698. The Turkish text is authoritative for its meaning under Turkish law.
Data controller
The data controller is SPO Eğitim Danışmanlık E-Ticaret Ltd. Şti. Address: Esatpaşa Mah. Güllük Sok. No:25 D:4 Ataşehir/İstanbul, Türkiye. MERSİS: 0781111781200001. Tanbu is a product of this company.
Personal data processed
The categories and the data are these. Identity: your first and last name. Contact: your work e-mail address. Customer transaction: the type of your request and whatever you write in the free-text field; the company name, required for a demo request and optional for a contact request. Transaction security: the time of submission and a hash derived from the IP address of the connection that delivered the request. Separately, the provider hosting the site keeps, in its own access logs, the connection’s raw IP address, the browser information and the country derived from the IP; those are the provider’s records (see Retention and destruction).
When you submit the form, the IP address of the connection that delivered the request is read on our server and stored in a temporary file as a one-way hash, in order to keep a submission counter and prevent abuse; those files are also cleaned up regularly, with no guaranteed maximum. That hash is not considered anonymised and remains personal data.
The forms do not ask for special-category data. Because what you write in the free-text field is up to you, please do not put special-category information such as health, beliefs or memberships there.
How it is collected
Your personal data is collected electronically, by means that are not wholly automated, when you fill in and submit the form on tanbuhr.com. The site sets no cookies and performs no analytics measurement.
Purposes
To assess your demo request and reply to it; to receive your contact enquiry, answer it and carry out only the follow-up directly connected to it; and to prevent misuse of the form.
Data obtained through these forms is not added to a newsletter list, is not used for marketing unrelated to your request, is not used for profiling and is not used to build advertising audiences. If processing for those purposes is ever introduced, a separate notice will be given beforehand; and if commercial electronic messages are involved, separate approval will be obtained under Law 6563.
Legal basis
Personal data you provide through the demo request form is processed under Article 5(2)(c) of the Law, because it is directly related to the establishment of a contract and is necessary in order to act on your request.
Personal data you provide through the general contact form is processed under Article 5(2)(f) of the Law, for our legitimate interest in receiving your enquiry, answering it and carrying out only the directly connected follow-up, provided this does not harm your fundamental rights and freedoms.
Data you do not write yourself but which arises technically on submission — the time of submission and the hash derived from the connection that delivered the request — is processed under the same Article 5(2)(f), for our legitimate interest in preventing misuse of the form.
Transfers
So that we can receive and answer your request, your personal data is processed on our service providers’ infrastructure: Hostinger International Ltd. (Larnaca, Cyprus), which hosts the site and therefore the infrastructure the form runs on; and Google, our corporate e-mail provider (Google Workspace) — which Google legal entity is our counterparty we have not yet established —, so that your message reaches and is stored at info@tanbuhr.com. These providers are established outside Türkiye, and the processing takes place outside Türkiye — including Germany, where the hosting server is located, and France, where its backup is kept.
For these transfers, the decision has been taken to sign the standard contract published by the Turkish Data Protection Board, in its controller-to-processor form. That signature process has not yet been completed; when it is, it will be notified to the Personal Data Protection Board within five business days of signature. Your submission also passes through the hosting provider’s content-delivery layer; which legal entity operates that layer, and where it sits, we have not yet established. Beyond those, your data is not transferred to any other third party for these forms.
Retention and destruction
Your form submissions are not held in a database: they arrive at and are kept in the corporate mailbox at info@tanbuhr.com. Alongside that, to stop the same submission being mailed twice, a check value derived from your submission is held on the server as a temporary file name; its content is not stored. These files are cleaned up regularly, but because the clean-up is triggered by submissions we cannot state a guaranteed maximum. If your request does not lead to a customer relationship, the records are kept for at most 12 months from the last meaningful communication with you. The last meaningful communication is the last message sent by either party in that thread; automatic replies and delivery notifications do not update that date. If the purpose falls away sooner, the record is deleted sooner.
After that period ends, deletion takes place within three months at the latest, unless another lawful reason requires continued retention. If your request does lead to a customer relationship, the necessary record moves into the separate commercial retention regime.
We undertake to delete the error logs our application produces within no more than 30 days; where a security incident, a dispute, a legal obligation or an ongoing investigation requires retention, we keep them only for as long as that requirement lasts. Those logs also sit on the hosting provider’s infrastructure. Separately, the provider keeps its own server access logs, recording for each request the connection’s IP address, the browser information and the country derived from the IP; those are the provider’s records rather than ours, their periods are set by the provider, and we publish no period for them.
Deletion does not take immediate effect for copies held in our service providers’ own backup systems. Those backups are managed by the provider, cannot be deleted by us on request, and disappear within the provider’s own backup cycle.
Your rights
Article 11 of the Law gives you the following rights, which you can exercise through the application route below:
- To learn whether your personal data is being processed.
- To request information about it if it has been processed.
- To learn the purpose of processing and whether it is used in line with that purpose.
- To know the third parties to whom it has been transferred, in Türkiye or abroad.
- To ask for it to be corrected if it is incomplete or wrong.
- To ask for it to be erased or destroyed, within the conditions the Law sets.
- To ask that any correction, erasure or destruction be notified to those third parties.
- To object to a result against you produced solely by automated analysis.
- To claim compensation if you suffer loss because of unlawful processing.
How to apply
You may submit requests under Article 11 of the Law by the routes the Communiqué on the Procedures and Principles of Application to the Data Controller provides. The two we can operate today are these (the Communiqué also names registered electronic mail, secure electronic signature and mobile signature; we have not yet published an address for those). In writing, by signed petition: SPO Eğitim Danışmanlık E-Ticaret Ltd. Şti., Esatpaşa Mah. Güllük Sok. No:25 D:4 Ataşehir/İstanbul, Türkiye. Electronically, using an e-mail address you have previously communicated to us and which is registered in our systems: info@tanbuhr.com.
We conclude your application as soon as possible according to its nature, and in any event within thirty days at the latest.
Status of this notice
Our legal remediation under Turkish data protection law is in progress; execution of the standard contracts mentioned above has not yet been completed. We will update this notice as that progresses.
Effective: 2026-09-01 · Notice version: EN-4