Privacy Policy

1. Controller

ErtuKara Webdesign
Owner: Ertugrul Karazor
Schonnefeldstraße 114
45326 Essen, Germany

Email: ertugrul@ertukara.com
Phone: +49 172 9306813

ErtuKara Webdesign operates this website and designs, builds, hosts and maintains websites for organisations, businesses and private individuals. This Privacy Policy explains how we handle personal data in accordance with the General Data Protection Regulation (GDPR) and the German Telecommunications-Digital-Services Data Protection Act (TDDDG).

2. Data Protection Officer

We are not legally required to appoint a Data Protection Officer, as the conditions of § 38 BDSG, in particular the permanent employment of at least 20 people in the automated processing of personal data, are not met. For all data protection matters, you can reach us using the contact details in section 1.

3. Categories of Data Processed

We only process personal data necessary for professional communication and service delivery. This may include:

• Identification and contact data: name, company, position, business email address, and phone number.
• Contract and billing data: company address, VAT number, payment details, and invoice records.
• Communication data: information exchanged by email, phone, or contact form.
• Technical data: IP address, date and time of access, browser type, and system logs generated by our hosting provider for operational and security purposes (see section 5).

No data is collected beyond what is required to deliver or support our professional services.

4. Purposes and Legal Basis

We process personal data for the following purposes:

We do not engage in profiling, automated decision-making, or marketing tracking.

5. Hosting and Server Log Files

This website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. Netlify’s privacy notice is available at www.netlify.com/privacy.

When you access the website, the hosting provider automatically records information in so-called server log files transmitted by your browser. These include in particular:

• IP address,
• date and time of access,
• the page/file accessed,
• browser type and version,
• operating system.

This data serves solely the secure and stable operation of the website. The legal basis is our legitimate interest in technically error-free and secure provision (Art. 6(1)(f) GDPR). A data-processing agreement under Art. 28 GDPR is in place with the hosting provider. As the provider is based in the USA, please note the information on international data transfers in section 9.

Our demo sites, which this website links to (addresses under vercel.app), are hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you open a demo site, Vercel processes the same technical access data as described above, on the same legal basis. The demo sites show fictional organisations and set no cookies; their forms are for display only and transmit nothing you enter. Section 9 applies to the transfer to the USA.

5a. Error and Security Monitoring (Sentry)

To ensure the technical stability and security of our website, we use the service Sentry to collect technical error reports. The provider is Functional Software, Inc. (dba Sentry), USA; processing takes place via Sentry’s EU data region (data centre in Frankfurt am Main, Germany).

On a normal visit no Sentry code is loaded and no data is sent to Sentry. Only when a technical error actually occurs in the browser does the page load the error monitoring code, and your browser then transmits an error report to Sentry. This contains only technical information such as the error message, the affected program component, browser type and version, and the page accessed. We have configured Sentry so that no IP addresses, no personal content, and no session recordings (Session Replay) are collected or stored.

The legal basis is our legitimate interest in the technically error-free and secure provision of the website (Art. 6(1)(f) GDPR). A data-processing agreement under Art. 28 GDPR is in place with Sentry. Error data is stored in the EU data region; for information on international data transfers, see section 9.

5b. Content Delivery Network and Security (Cloudflare)

To deliver the website and to protect it against attacks, we use the content delivery network operated by Cloudflare. For users in the European Economic Area the provider is Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany; the technical operation is carried out by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

When you access the website, your request is routed through Cloudflare’s servers. In doing so, Cloudflare processes technical access data, in particular your IP address, the address accessed, the date and time, and details of your browser and operating system, in order to speed up delivery and to fend off malicious traffic. For this purpose Cloudflare may set technically necessary cookies (e.g. “__cf_bm”). Cloudflare also uses its email address obfuscation feature to protect email addresses from automated harvesting.

The legal basis is our legitimate interest in the secure, stable, and fast provision of the website (Art. 6(1)(f) GDPR). A data-processing agreement under Art. 28 GDPR is in place with Cloudflare. Insofar as this involves a transfer to the USA, the information in section 9 applies.

6. Contacting Us

If you contact us via the contact form, by email, or by phone, we process the data you provide (e.g. name, company, email address, phone number, and the content of your enquiry) in order to handle your request.

Data entered in the contact form is processed via a serverless function at our hosting provider Netlify (see section 5) and then delivered to us by email through our email provider Zoho (see section 8). Email delivery runs on Zoho’s European servers; for the processing by Netlify and the associated transfer to the USA, see section 5 and section 9.

The same applies to the two forms with which you can cancel a contract ("Cancel a contract") or, as a consumer, withdraw from one ("Withdraw from a contract"). There we process the details your declaration needs (name, description of the contract, email address, and for a cancellation the further details you give), plus the date and time of receipt. You immediately receive an acknowledgement by email. The legal basis is compliance with legal obligations (Art. 6(1)(c) GDPR in conjunction with § 312k and § 356a BGB) and the performance of the contract (Art. 6(1)(b) GDPR). We keep these declarations as contract records (see section 10).

The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at concluding or performing a contract, and otherwise our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR). The data is deleted once your enquiry has been conclusively handled and no statutory retention obligations apply (see section 10).

You are under no statutory or contractual obligation to provide data to us. Without the details marked as required, however, we cannot handle your enquiry or declaration.

6a. Business contact initiated by us (Art. 14 GDPR)

We approach organisations and businesses for which our offer may be relevant. For this we process contact details that we did not collect from you directly.

• Source: publicly accessible sources, in particular your organisation's website and public directories.
• Data: name of the organisation, address, phone number, general email address, name and role of contact persons where published, and the history of our correspondence.
• Purpose: contacting you about our offer, where applicable with a non-binding demo.
• Legal basis: our legitimate interest in winning customers (Art. 6(1)(f) GDPR). We do not contact recipients in Germany by email without their consent, but by letter or, where permitted, by phone.
• Recipients: email sending through Google (Google Ireland Ltd.) and Instantly (USA); storage in a database we operate on servers of Hetzner Online GmbH in Germany; help with drafting text from the AI service of Anthropic (USA). Section 9 applies to transfers to the USA.
• Retention: up to 12 months after the last contact. After an objection we delete the data and keep only a suppression note so that we do not contact you again.
• Objection: you can object to this processing at any time without giving reasons (Art. 21(2) GDPR). A short message to ertugrul@ertukara.com is enough.

6b. Communication via WhatsApp

On the English version of this website we offer a link to WhatsApp. It is used only when you contact us via WhatsApp yourself; merely opening the page transfers no data to WhatsApp. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

When you write to us via WhatsApp, WhatsApp processes your phone number, your profile name and usage metadata, such as when and with whom you write, under its own terms of service and privacy notices; the messages themselves are end-to-end encrypted. We process your phone number, your name and the content of your messages to answer your enquiry.

The legal basis is Art. 6(1)(b) GDPR insofar as the communication serves the initiation or performance of a contract, and otherwise our legitimate interest in being easy to reach (Art. 6(1)(f) GDPR). This may involve a transfer to the USA; section 9 applies.

You do not have to use WhatsApp. You can always reach us by email at ertugrul@ertukara.com instead.

7. Cookies and Local Storage (§ 25 TDDDG)

This website uses only technically necessary cookies or storage mechanisms required for the operation and security of the website. No consent is required for these under § 25 (2) TDDDG. No analytics, tracking, or marketing cookies are used; a consent banner is therefore not required.

The technically necessary cookies include, in particular, the “__cf_bm” cookie set by our content delivery network Cloudflare, which serves to fend off automated access (see section 5b).

In addition, we store your language preference in your browser’s local storage, but only once you use the language switch on the page yourself, so the site keeps your choice. Merely opening the page stores nothing there. This is necessary for the function you have expressly requested (§ 25 (2) no. 2 TDDDG) and is not used for analytics or tracking. The website’s fonts are served locally from our own server; no transfer to third parties takes place in this respect.

8. Recipients and Processing

Personal data is processed by us and, where necessary, by carefully selected service providers who support us, in particular:

• Hosting: Netlify, Inc. (USA), see section 5.
• Hosting of the demo sites: Vercel Inc. (USA), see section 5.
• Content delivery network and security: Cloudflare Germany GmbH / Cloudflare, Inc. (USA), see section 5b.
• Contact form: processed via a serverless function at our hosting provider Netlify, Inc. (USA), see section 5; delivered to us by email through Zoho (EU), see section 6 and section 9.
• Email communication: Zoho Mail, operated by Zoho Corporation B.V. (Netherlands) and affiliated companies of the Zoho group.
• Communication via WhatsApp: WhatsApp Ireland Limited (Ireland), only when you contact us via WhatsApp, see section 6b.
• Error monitoring: Functional Software, Inc. (dba Sentry, USA), EU data region, see section 5a.
• Payment processing: see section 8a.
• Business contact and AI services: see section 6a.

Where these providers act on our behalf, they are contractually bound by data-processing agreements under Art. 28 GDPR. We do not sell, rent, or otherwise disclose personal data to third parties unless required by law.

8a. Payment Processing

To process payments, we process the data required for this purpose (e.g. billing address, bank or payment details). The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and compliance with tax and commercial-law obligations (Art. 6(1)(c) GDPR).

Depending on the agreed payment method, we use:

• Bank transfer/invoice: payment is made directly to our business account; no further service providers are involved.
• PayPal: provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. When paying by PayPal, payment data is transmitted to PayPal.
• Stripe: provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When paying by Stripe, payment data is transmitted to Stripe; this may involve a transfer to the parent company Stripe, Inc. in the USA (see section 9).

The payment providers used process your payment data partly under their own data protection responsibility. For details, please see the privacy notices of the respective provider.

9. International Data Transfers

Where we use service providers based in the USA (our hosting provider Netlify, Vercel for the demo sites, our content delivery network Cloudflare, Inc., and, when paying by Stripe, Stripe, Inc.), personal data is transferred to the USA.

If you write to us via WhatsApp (section 6b), WhatsApp Ireland Limited may transfer data to WhatsApp LLC and Meta Platforms, Inc. in the USA.

For the USA there is an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework, Art. 45 GDPR), insofar as the respective provider is certified under the Data Privacy Framework. Where a provider is not certified, we base the transfer on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), supplemented where appropriate by additional safeguards.

Our email service Zoho Mail is operated via Zoho’s EU data centre (Zoho Corporation B.V., Netherlands). Data processed by email is therefore stored within the European Union; no transfer to a third country takes place in this respect.

Our error-monitoring service Sentry is operated in the EU data region (Frankfurt am Main); error data is stored within the European Union. Insofar as the US-based provider gains access in an individual case, we base the transfer on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).

Business communication with recipients outside the EU/EEA. In the course of our business, we also communicate by email with people and companies outside the EU/EEA (e.g. in the USA). Where communication is with the data subject themselves, this is necessary to carry out pre-contractual measures or to perform the contract (Art. 6(1)(b) GDPR); insofar as this involves a transfer to a third country, it is based on Art. 49(1)(b) and (c) GDPR. Where, by way of exception, personal data of third parties is transferred, this only happens to the extent necessary for the respective purpose and where appropriate safeguards (Art. 46 GDPR) exist or an exception under Art. 49 GDPR applies.

10. Data Retention

Personal data is retained only as long as necessary for the purposes for which it was collected or as required by statutory retention periods:

• Business correspondence and enquiries: up to 12 months after last contact.
• Contract, tax, and billing documents: up to 10 years (in accordance with German tax and commercial law).
• Project-related files: for the duration of the contractual relationship. We delete the content of a customer’s website (text, images, documents, stored form entries) 30 days after the contract ends, and other project records no later than 24 months after that.

After expiry of the relevant periods, data is securely deleted.

11. Data Subject Rights

Under the GDPR, you have the right to:

• access your personal data (Art. 15 GDPR),
• rectify incorrect or incomplete data (Art. 16 GDPR),
• request deletion (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object (Art. 21 GDPR), see the notice below.

To exercise your other rights, please also contact ertugrul@ertukara.com.

You also have the right to lodge a complaint with a data protection authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

12. Data Security

We use appropriate technical and organisational measures, including encrypted data transmission (HTTPS) and restricted administrative access, to protect personal data against loss, misuse, or unauthorised access.

13. Updates to this Policy

We may update this Privacy Policy to reflect changes in law or our operations. The most current version will always be available on this page.

Contact for Privacy Matters

Ertugrul Karazor
Email: ertugrul@ertukara.com