Privacy Policy
Last updated: 11 October 2026
Who we are
SAMAY TEKNOLOJİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ is the data controller for the personal information processed through the SAMAY Group website.
Address: AKŞEMSETTİN MAH. FEVZİPAŞA CAD., Fatih, İstanbul, Türkiye. Email: samay@samay-group.com Telephone: +90 552 499 1969 WhatsApp: +971 50 873 2090
Information we use and why
Enquiries. We use the contact details and message you provide to answer questions, discuss projects and provide support. The homepage and Contact page use the same enquiry form, which asks for your email address, an optional telephone number and your project details or message. Please do not include patient records or other sensitive information in an ordinary website enquiry.
We process enquiries on the basis of our legitimate interests in responding to prospective and existing customers, subject to your fundamental rights and freedoms. Where information is directly necessary to establish or perform a contract with you, we rely on that contractual ground. Applicable legal obligations and the establishment, exercise or protection of rights may require separate records.
Newsletters. We use your email address and subscription, consent and confirmation records to send newsletters, product updates and marketing communications when you expressly agree. Our subscription process uses email confirmation. You can unsubscribe through the link in our marketing emails or contact us. An enquiry does not subscribe you to marketing.
Email delivery and measurement. Our email service processes delivery information, such as successful delivery, bounces and failures. It also supports open-and-click reporting. We have configured anonymous reporting and made individual tracking conditional on a separately recorded affirmative tracking choice, with unknown choices excluded from individual tracking. Anonymous or aggregate measurement may still occur. Newsletter consent and website cookie consent do not themselves constitute consent to individual email tracking.
Website operation and security. Hosting and connected services process technical information, such as IP addresses and browser information, to deliver pages, protect forms and maintain the service. We rely on legitimate interests in secure and reliable operation where applicable, subject to your rights. Optional technologies follow the choices described in our Cookie Policy.
Who processes information
| Service | Purpose and information involved |
|---|---|
| GoDaddy.com, LLC (United States) — website hosting | Hosts website files and the website database, including stored website enquiries; processes connection information for hosting and security. |
| Microsoft 365 supplied through GoDaddy | Handles our business email and correspondence. |
| Proofpoint, through GoDaddy Advanced Email Security | Filters incoming business email for spam and security threats, and processes quarantined messages and email-security logs. |
| Brevo (Sendinblue SAS, France) | Handles newsletter subscriptions, consent and confirmation records, marketing email and website transactional email delivery and related logs. |
| Google reCAPTCHA | Protects the newsletter form against automated abuse when the associated external-service category is enabled. |
| Vimeo | Delivers the embedded homepage video when the associated external-service category is enabled. |
The homepage and Contact page use Contact Form 7, configured to send enquiries to samay@samay-group.com and keep a copy in our website database using Flamingo. Website email is configured to use Brevo through FluentSMTP. These local WordPress plugins are software used to operate the site; their installation alone does not mean that their developers receive your messages.
Only personnel who need information for the relevant task should have access. We may disclose information to competent authorities where required by law.
Our website hosting invoice identifies GoDaddy.com, LLC, with the address 100 S Mill Ave, Suite 1600, Tempe, Arizona 85281, United States. This is the company address.
Processing outside Türkiye. Our hosting, email, subscription and embedded-content services may involve processing outside Türkiye. GoDaddy support confirms that our website files and hosting backups are stored on the same server in North America. The specific country and any additional infrastructure-level backup locations have not been confirmed. Brevo states that its database hosting is in the European Union, including France, Germany and Belgium. The precise processing locations and account-specific transfer documents have been requested but not yet confirmed. Please contact us for further information about an applicable transfer.
Cookies and external services
You can accept optional technologies, reject them or manage categories in Cookie Settings. The newsletter's protected form uses Brevo and Google reCAPTCHA under External Content & Marketing. That browser choice is separate from agreeing to receive marketing email. Vimeo uses the same external-content category. See our Cookie Policy for purposes, storage and changing your choices.
Following a WhatsApp or social-media link takes you to an external service. Its own privacy notice applies to your use of that service.
Retention and deletion
Our retention schedule distinguishes the original enquiry, business correspondence and delivery logs:
- General website enquiries: we aim to delete or anonymise the original website and mailbox copies within six weeks when there is no active project, ongoing correspondence, legal obligation or dispute. Continuing business correspondence is reviewed separately and kept only while needed for its purpose.
- Contracts, transactions and records needed for legal obligations or claims: for the applicable purpose and required period.
- Active newsletter records: while the subscription remains active, with periodic review of whether continued retention is necessary.
- Limited consent and unsubscribe records: only as needed to demonstrate the relevant choice, honour withdrawal and meet applicable obligations. An unsubscribe request stops marketing; it does not necessarily require removal of the minimal suppression record that prevents further sends.
- Website email-delivery logs in FluentSMTP: configured for deletion after 14 days. This setting does not delete the recipient's mailbox copy or the original Flamingo enquiry.
- Brevo transactional email logs: configured for one month for all senders. Brevo states that deletion can take up to 24 hours after the retention period expires. Never store previews is selected for new transactional emails; this setting does not itself delete previously stored previews. The one-month setting does not apply to contact, consent, suppression or backup records. Brevo does not specify an automatic expiry for ordinary unsubscribed or blocklisted contacts; our retention schedule calls for keeping only the information needed to honour those choices and reviewing unnecessary contact details separately.
Brevo states that its account backups are encrypted and distributed across three geographically distinct servers. Its response has not confirmed a fixed expiry period for backup copies while our account remains active. The one-month transactional-log setting does not establish the retention period for those backups.
GoDaddy support confirms that our current hosting backup service maintains one daily restore copy from the previous day, replaced by the next daily backup. This describes the available restore window, not a confirmed maximum retention period for all infrastructure copies. Automatic Installatron backups are disabled; any manually created Installatron copies remain in the hosting account until removed or the hosting subscription ends. GoDaddy confirms that no separate email-backup add-on is active on our account; mailbox recovery features are distinct from a separate backup service.
Deletion in one system does not automatically remove copies in other systems. Mailbox, subscription, delivery-log and backup copies are handled separately.
Your rights
Subject to Turkish Personal Data Protection Law No. 6698, you may ask whether your personal data is processed, obtain information about processing and its purposes, and learn the recipients in Türkiye or abroad. You may request correction and, where the legal conditions apply, deletion or destruction and notification of those actions to recipients. You may object to an adverse result based solely on automated analysis and seek compensation for harm from unlawful processing.
Contact samay@samay-group.com for privacy questions or requests. We may request proportionate information to verify your identity. Formal applications and complaints are subject to the procedures and time limits under applicable law.
You may withdraw marketing consent at any time. Withdrawal does not affect processing already lawfully performed on that consent or separate processing supported by another valid ground.
Changes
We will update this notice when relevant practices change and show the revision date on the published page.