This policy covers this website, bumenga.com. It explains what we collect when you use the contact form, why, and who else sees it. Our apps are covered by their own privacy pages, linked from each app’s page.
The short version: the only personal data we hold is what you send us through the contact form, plus the technical details that arrive with it. We run no analytics and no advertising.
Data controller
Bumenga Yazılım Medya Danışmanlık Limited Şirketi · MERSİS 0190156432700001 · Fatih Sultan Mehmet Mah. Balkan Cad. Meydan İstanbul AVM No: 62A, Ümraniye / İstanbul, Türkiye · Registered with the Istanbul Trade Registry, no. 1001528 · Tax office Alemdağ, tax no. 1901564327
Personal data we process
You give us, through the contact form:
- Name
- Email address
- The message you write, and anything you choose to put in it
- Your confirmation that you have read this policy
- The language you were browsing in
Collected automatically when you send the form:
- Your IP address
- Your browser and operating system identifier (user agent)
- The time you sent it
- A bot-risk score from reCAPTCHA
Not collected: we place no analytics, advertising or tracking on any page, we do not build profiles, and we do not buy or receive personal data from anyone else.
Purposes
Name, email and message: to read your enquiry and reply to it.
IP address, user agent and bot score: to keep the form usable. They let us tell a person from an automated script and block abuse. We do not use them to identify or track you.
Language and timestamp: to reply in the right language and to know when you wrote.
We do not use any of it for marketing and we do not send newsletters.
Legal basis
Your name, email address and message are processed because it is necessary for our legitimate interest in receiving and answering an enquiry you chose to send us, and doing so does not override your rights and freedoms (KVKK art. 5/2-f; GDPR art. 6(1)(f)). Where your enquiry concerns an app you already use, we also rely on the necessity of processing for that relationship (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
We deliberately do not ask for your consent here. Turkish law does not allow a controller to seek consent where another lawful ground already covers the processing, because that would suggest you have a choice we cannot honour — if you withdrew it mid-conversation we could not finish answering you. The checkbox on the form records that you have seen this policy; it is not consent, and ticking it gives away nothing.
You can object to this processing at any time and ask us to delete your message — see Your rights below.
If we must keep a message because of a legal claim or a legal obligation, we rely on KVKK art. 5/2-ç and 5/2-e, and on GDPR art. 6(1)(c) and 6(1)(f).
Your IP address, browser identifier and bot score are processed on the basis of our legitimate interest in keeping the contact form usable and free of automated abuse, weighed against your rights and freedoms (KVKK art. 5/2-f; GDPR art. 6(1)(f)). Without these checks the form would be unusable within days.
We process no special categories of personal data (health, biometrics, beliefs, and the like) and we ask you not to send any.
Sharing with third parties
Cloudflare — hosts the site and stores form messages in a database located in the Eastern Europe region. Also provides the Turnstile bot check.
Google — in two separate roles. It provides reCAPTCHA v3 on the contact page, which receives your IP address and on-page behaviour. It also hosts our company mailbox through Google Workspace, so the notification email described below — containing your name, email address, message, IP address and user agent — is stored on Google’s servers once it reaches us. This is the larger of the two: reCAPTCHA sees technical signals, Workspace sees what you actually wrote.
Resend — delivers the notification email that tells us a message arrived. That email contains your name, email address, message, IP address and user agent.
All three are established outside Türkiye, so using the form involves a transfer of your data abroad. We share your data with no one else, and we never sell it.
Retention
Messages and the technical details attached to them are kept for as long as needed to handle your enquiry and to keep a record of the correspondence, then deleted.
Concretely: we keep a message and the technical details attached to it for two years from the date you sent it, then delete it. Two years is our own choice — long enough that we can look back at a conversation, short enough that we are not holding messages nobody needs.
Your message exists in two places: our database, and the notification email in our mailbox. We delete both on the same schedule. If you ask us to delete a message sooner, we remove both copies.
Messages our filters flag as automated are kept the same way, so that a wrongly flagged message can be recovered, and are deleted on the same schedule.
If a message becomes part of a legal claim or a legal obligation requires us to keep it longer, we keep that message until the matter ends.
Account and data deletion
This website has no accounts and no login. To have a message you sent us deleted, email kvkk@bumenga.com and tell us which message — or use the contact form. We will delete it and confirm that we have.
Apps that let you create an account carry their own deletion page, linked from that app.
Your rights
Under article 11 of the Turkish Personal Data Protection Law (KVKK), and under the GDPR if you are in the EU, you may ask us:
- whether we hold personal data about you, and if so to see it
- what we used it for, and whether it was used consistently with that purpose
- who we passed it to, at home or abroad
- to correct it if it is incomplete or wrong
- to delete it, or to withdraw a consent you gave us
- to have any correction or deletion passed on to those we shared it with
- to object to a decision produced solely by automated analysis that has an adverse effect on you
- to be compensated for damage caused by unlawful processing
If you are in the EU you may also ask for a copy of your data in a portable format, and ask us to restrict processing while a dispute is resolved.
Wherever you live, we offer all of the above to everyone. The rights above are the ones Turkish and EU law give us a duty to honour, but we do not check which country you are in before answering. If you want your message deleted, we delete it.
How to ask: email kvkk@bumenga.com. You can also use the contact form, or send a formal request to our registered electronic notification address (e-Tebligat / UETS) 25848-90827-65398. Tell us what you want and enough detail to find your message. We reply within 30 days at the latest, and normally much sooner. We do not charge for this.
If you are not satisfied with our answer you may complain to the Turkish Personal Data Protection Authority (KVKK), or, if you are in the EU, to your local supervisory authority.
Cookies
Only the contact page sets a cookie, and only the one reCAPTCHA places. Every other page sets none. Details and how to block it are in the Cookie Policy.
Changes
When this text changes we update the date shown at the top of the page. If a change materially affects how your data is handled, we will say so on this page rather than change it silently.
Email us at kvkk@bumenga.com for anything about your personal data — access, correction, deletion, objection. For other matters use the contact form. Our postal address is Fatih Sultan Mehmet Mah. Balkan Cad. Meydan İstanbul AVM No: 62A, Ümraniye / İstanbul, Türkiye. For formal legal notices you may also use our registered electronic notification address (e-Tebligat / UETS) 25848-90827-65398.
reCAPTCHA
The contact page loads two bot-protection services: Cloudflare Turnstile and Google reCAPTCHA v3. Both receive your IP address and browser information as soon as the page opens — before you type anything or press send. reCAPTCHA sets a cookie at that moment and also reports on-site behaviour to Google. See Google’s and Cloudflare’s own privacy policies for what they do with it.
No other page on this site loads third-party code or sets any cookie. If you never open the contact page, no third party learns that you visited us.