In short
- We only collect what you type into the booking form or the email sign-up on our ad landing page, plus anonymous visit statistics.
- We use no cookies, no social-media trackers and no third-party analytics. The only advertising code is a cookieless Google Ads conversion tag on our ad landing page (section 2.7).
- Detailed analytics only run if you accept them. You can change your mind at any time via “Cookie settings” at the bottom of every page.
- We do not sell or share personal information, and we do not use it for targeted advertising.
- You can ask us at any time to see, correct or delete your data: hello@zegautomation.com.
1. Who is responsible
The controller (Turkish: veri sorumlusu) for this website (https://zegautomation.com) is:
[to be completed: LEGAL_COMPANY_NAME]
[to be completed: LEGAL_ADDRESS]
Türkiye
Email: hello@zegautomation.com
Turkish visitors: the information required by Art. 10 of Law No. 6698 (KVKK) is also available as a separate KVKK information notice.
2. What we collect, why, and on what legal basis
2.1 When you book a call
Data: name, company, work email, phone number (optional), team size, your message, the chosen time slot, your language and browser time zone.
Purpose: to schedule and hold the call, send you the confirmation and calendar invitation with a Google Meet link, prepare for the call and send you a quote you asked for.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK). Giving this data is voluntary, but without it we cannot book the call.
2.2 Anonymous visit statistics (always on, unless you opt out)
When a page loads, our own server counts a page view with: the page path (without query parameters), the website you came from (domain only), campaign tags (utm_source, utm_medium, utm_campaign), your country (as reported by our network provider), device type, browser and operating-system family, and site language. We do not store IP addresses, the full user-agent string or any identifier, and we set nothing on your device for this. The data cannot be linked to you.
Legal basis: our legitimate interest in understanding which pages work and keeping the site running (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK). If you click “Reject”, or your browser sends Global Privacy Control or Do Not Track, even this counting stops.
2.3 Detailed analytics (only with your consent)
If you accept analytics, your browser also keeps a random id for the current tab (in session storage, deleted when you close the tab). It lets us tell visits apart and see how far a visit gets, for example whether it ends with a booking. This id is never linked to your name or email.
Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive; explicit consent under Art. 5(1) KVKK). You can withdraw it at any time with the same ease via “Cookie settings”; withdrawal does not affect processing done before.
2.4 Server and security logs
To deliver the website and protect it from abuse, your IP address is processed briefly. It is kept only in memory for up to one hour for rate limiting (for example, limiting booking attempts) and in technical error logs at our hosting provider for a short period.
Legal basis: legitimate interest in security (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK); for Turkish logs also Law No. 5651 where it applies.
2.5 Emailing us
If you write to us, we use your address and message to answer you. Legal basis: pre-contractual steps or our legitimate interest in replying (Art. 6(1)(b) or (f) GDPR; Art. 5(2)(c) or (f) KVKK).
2.6 When you leave your email on our ad landing page
Data: your email address, the page language, and how you found us: the campaign tags in the ad's link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the Google Ads click id (gclid, gbraid or wbraid), the website you came from (domain only) and your browser's user-agent string.
Purpose: to reply to you personally about automating your business, as you asked, and to learn which of our ads bring interested people. We send our team an email notification for each new sign-up. We do not add you to a newsletter.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK); for the ad attribution, our legitimate interest in knowing which ads work (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK).
2.7 Google Ads conversion measurement (ad landing page only)
On the ad landing page, and only there, we load Google's advertising tag (gtag.js) from Google. It runs in Google's “consent mode” with every storage and personalisation option switched off: it sets no cookies, and your data is not used for ad personalisation. When you sign up, it tells Google Ads that a click on one of our ads led to a sign-up, together with a random sign-up id. Your email address is never sent to Google. Google receives your IP address and browser details as part of the request. The tag is not loaded if you clicked “Reject” or your browser sends Global Privacy Control or Do Not Track.
Legal basis: our legitimate interest in measuring whether our advertising works (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK). You can object at any time by clicking “Reject” in “Cookie settings”.
We do not make automated decisions with legal or similarly significant effects about you, and we do not build profiles.
3. Cookies and browser storage
This website sets no cookies. It uses your browser's local and session storage for 3 items, listed with their purpose and lifetime in our Cookie policy. Fonts and images are served from our own server, so loading a page does not contact Google or any other third party, with the one exception of the cookieless Google Ads tag on our ad landing page (section 2.7).
If you open the Google Meet link for your call, Google's own privacy policy applies on Google's site.
4. Who receives your data
We use these service providers (processors). They act only on our instructions under data-processing agreements:
| Provider | What for | Safeguard for transfers abroad |
|---|---|---|
| [to be completed: LEGAL_HOSTING_PROVIDER] | Hosting the web server | — |
| Cloudflare, Inc. USA, global network | Database (Cloudflare D1) and file storage (Cloudflare R2) for bookings, anonymous statistics and site images; network security. | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Google LLC / Google Ireland Ltd. USA / Ireland | Google Calendar and Google Meet: creating the calendar invitation and video call for a booked call. Google Ads: on our ad landing page only, a cookieless signal that an ad click led to a sign-up (no email address is sent). | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) USA | Sending the booking confirmation email and the notifications to our team (new bookings and new email sign-ups). | Standard Contractual Clauses (data processing agreement) |
Otherwise we only disclose data where the law requires it (for example to courts or authorities).
5. Transfers outside your country
Some providers above process data in the United States. For transfers from the EU/EEA we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). For transfers from Türkiye we rely on the standard contracts published by the Personal Data Protection Board, which are notified to the Board as required by Art. 9 KVKK. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
- Bookings (database and archive copy): deleted automatically 24 months after the call, unless we start working together; then the contract records are kept as commercial and tax law requires (in Türkiye generally 10 years).
- Email sign-ups from the ad landing page: deleted automatically 12 months after your last sign-up, unless we start working together.
- Anonymous statistics: deleted after 13 months.
- Consent records (your choice, a random id, the date, no identity): 36 months, to prove the consent was given.
- Rate-limit data: at most 1 hour, in memory only.
7. Your rights
Everyone
Email hello@zegautomation.com to see what we hold about you, get a copy, have it corrected or deleted. We answer within 30 days and free of charge. To protect you, we may ask you to confirm the request from the email address used for the booking.
EU / EEA (GDPR)
Right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interest (Art. 21), and to withdraw consent at any time (Art. 7(3)). You may also complain to the data protection authority where you live or work.
Türkiye (KVKK)
Your rights under Art. 11 KVKK and how to apply are described in the KVKK information notice. If we reject your application or do not answer in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
United States
Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas or Oregon), you have the right to know what personal information we collect and to receive a copy, to correct it, to delete it, and to opt out of the sale or sharing of personal information, of targeted advertising and of profiling. We do not sell or share personal information, do not use it for targeted advertising and do not profile. We honor Global Privacy Control and Do Not Track signals as an opt-out of all optional analytics. You may use an authorized agent, and we will not discriminate against you for using your rights. If we decline your request, you can appeal by replying to our answer; we decide on appeals within 60 days.
Categories collected in the last 12 months (CCPA): identifiers (name, email, phone), commercial/professional information (company, team size, your message), and internet activity (anonymous page views). Sources: you, and your browser. Purpose: as described in section 2. We collect no sensitive personal information.
8. Children
This website is meant for businesses. It is not directed at children, and we do not knowingly collect data from anyone under 16 (13 in the United States). If you believe a child has sent us data, contact us and we will delete it.
9. Security
All traffic is encrypted (HTTPS). Access to booking data is limited to our team and protected by a secret token. The site only loads code from its own origin (enforced by a Content Security Policy), and data is deleted automatically when it is no longer needed. If a breach ever puts your data at risk, we will notify the competent authority and you as required by law.
10. Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version. If a change affects what you consented to, we ask for your consent again.