Personal Data Protection

Clear and understandable information about your personal data.

At Blueprint, we believe it is important that you understand the purposes for which your personal data is used and can easily exercise your rights over your data.

This Privacy Notice has been prepared to inform you about the processing of your personal data when you visit blueprint.com.tr, contact us, or request information or a quotation for our services.

This notice covers website visitors and individuals who share their information when contacting us or requesting a quotation. Separate privacy notices are provided for job applicants, employees, and other specific processes. Reading this notice or visiting our website does not constitute explicit consent.

The organisation responsible for processing your personal data.

Your personal data is processed by Blueprint Teknoloji (“Blueprint”), acting as the data controller under Personal Data Protection Law No. 6698 (“KVKK”).

Email: hi@blueprint.com.tr

The information we process depends on your interactions with us.

Identity and contact information

Your first name, surname, email address, and telephone number.

Professional information

Your organisation, job title, and information you share in the context of your business relationship with us.

Request and communication information

Messages you submit through forms and correspondence, requests for services and quotations, project descriptions, and our responses to these communications.

Transaction security information

Your IP address, access date and time, browser and device information, and technical logs maintained to ensure website security.

Preference and consent information

Your cookie preferences, communication permissions, and consent records, where the relevant features are used.

How we collect your data

Your data is collected through website forms, email, telephone, corporate communication channels, business and project meetings, technical logs, and cookies. Processing is carried out wholly or partly by automated means, or by non-automated means provided that it forms part of a data filing system.

Cookies

The purposes, legal bases, providers, and retention periods of the cookies used are explained in the Cookie Policy. Where cookies requiring explicit consent are used, they are activated in accordance with your preferences and managed through the Cookie Policy page.

Please do not share personal data that is unnecessary for your request, particularly health information, biometric data, or similar special categories of personal data.

A specific purpose and legal basis for each processing activity.

Responding to information requests

Identity, contact and professional information, together with message content, is processed to manage requests and conduct business communications. The legal basis is our legitimate interests, provided that your fundamental rights and freedoms are not harmed (Article 5/2-f of the KVKK).

Quotation and contract processes

Your identity, contact and request information is processed where it is directly related to, and necessary for, the establishment or performance of a contract to which you will be a party (Article 5/2-c of the KVKK).

Corporate business relationships

When you participate in discussions as an employee or representative of an organisation, your identity, corporate contact details, job title and correspondence information are processed on the basis of our legitimate interests in conducting business relationships, provided that your fundamental rights and freedoms are not harmed (Article 5/2-f of the KVKK).

Website security

Transaction security logs are used to detect unauthorised access and technical problems. The legal basis is our legitimate interests in ensuring information and system security, provided that your fundamental rights and freedoms are not harmed (Article 5/2-f of the KVKK).

Legal obligations and requests

Identity, contact and transaction records necessary to assess personal data requests and comply with binding official requests are processed to fulfil our legal obligations (Article 5/2-ç of the KVKK).

Protection of rights

Communication, request and transaction records relating to disputes are processed where necessary for the establishment, exercise or protection of a right (Article 5/2-e of the KVKK).

Your name, contact information and preference records are processed for newsletter and promotional communications on the basis of your explicit consent. Any permissions required for commercial electronic messages are obtained separately. Consent and opt-out records are retained to fulfil legal obligations.

You may withdraw your explicit consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the date of withdrawal.

Your data is shared only to the extent necessary for the relevant purpose.

Your personal data may be shared with the following categories of recipients, where necessary and in accordance with the transfer provisions of the KVKK:

Technology service providers

For the provision of website hosting, email communication, technical maintenance, and information security services.

Legal advisers and authorised representatives

For the assessment of legal claims, management of disputes, and protection of our rights.

Authorised public authorities and judicial bodies

To fulfil statutory obligations and comply with legally binding requests.

We retain your data only for as long as necessary.

We retain your personal data for the periods prescribed by applicable legislation. Where no such period is specified, we retain it only for as long as required for the purpose of processing.

When determining retention periods, we take into account the resolution of your request, the nature of the business relationship, our legal obligations, and the periods necessary for the exercise or protection of a right.

When all conditions requiring the processing of your data cease to exist, we delete, destroy or anonymise your personal data in accordance with applicable legislation.

You can exercise your rights over your personal data.

Under Article 11 of the KVKK, you may apply to Blueprint to:

• Find out whether your personal data has been processed and, if so, request information about the processing.
• Learn the purposes of processing and whether your data is being used in accordance with those purposes.
• Obtain information about third parties to whom your data has been transferred in Türkiye or abroad.
• Request the correction of incomplete or inaccurate information.
• Request the deletion or destruction of your data subject to the conditions set out in Article 7 of the KVKK.
• Request that third parties to whom your data has been transferred be notified of any correction, deletion or destruction.
• Object to a result that is detrimental to you arising from the analysis of your data exclusively through automated systems.
• Seek compensation for damage suffered as a result of the unlawful processing of your data.

How can you submit your requests to us?

You may submit requests concerning your rights through the following channels, in accordance with the Communiqué on the Principles and Procedures for Requests to the Data Controller:

Email: hi@blueprint.com.tr

You may submit an email request using an email address that you have previously provided to Blueprint and that is registered in our system. For requests submitted using a secure electronic signature or mobile signature, the methods prescribed by applicable legislation apply.

Your request must include your first name and surname; your signature if submitting a written request; your Turkish identity number if you are a Turkish citizen, or your nationality and passport number or identity number, if any, if you are a foreign national; your residential or business address for service of notices; your email address for notifications, if available; your telephone and fax numbers; and the details of your request. You may also attach relevant information and documents.

We conclude requests free of charge as soon as possible, depending on the nature of the request, and no later than 30 days. If the process incurs an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

Updates to this notice

We may update this notice when our data processing activities or applicable legislation change. The current version is available on this page. If the purposes of processing change, the necessary information will be provided before the new activity begins.