1. Controller and scope
Bosphorus Uydu ve Uzay Teknolojileri Anonim Şirketi (“BOSPHORUS”) is the controller for processing personal data through bosphorus.space and its Turkish pages. Our registered office is Mustafa Kemal Mah. Dumlupınar Bul. No: 280G İç Kapı No: 1260, Çankaya / Ankara, Türkiye. Our MERSİS number is 0180111020600001 and our Ankara trade registry number is 551474. Contact us at info@bosphorus.space.
This notice covers website visits, enquiries, the propulsion estimator, product-release requests and optional email subscriptions. Additional information is provided where necessary for employment, customer projects or other activities. This notice is not a request for explicit consent or commercial-email approval.
2. Collection methods and categories
We collect information electronically when you submit forms, contact us by email or in writing, access the website, or permit optional Google Analytics. Processing is wholly or partly automated and may also involve correspondence forming part of a filing system.
Contact information comprises your name, company/organisation, email address, optional topic and message. Estimator information comprises your email, spacecraft mass, orbital altitudes, dimensions or effective area, selected manoeuvres, relevant duration and calculated results. Selecting estimator marketing also supplies your full name and records the displayed consent version. A product-release request comprises your email, selected product and affirmative choice; this form does not collect a name or verify inbox ownership.
Technical and security data include IP addresses, request and browser information, random request references, anti-abuse keys, verification tokens and delivery records. Hashing information does not automatically make it anonymous. Cloudflare Web Analytics processes page/performance information without analytics cookies; permitted Google Analytics processes visitor identifiers and page/session information. Rights requests involve their contents and proportionate identity/authority information required by the applicable procedure.
Our general forms do not request sensitive personal data, identity-document images, unnecessary information about other people or technical information requiring an NDA. Please do not submit such information there.
3. Purposes and legal grounds
Each ground applies to its corresponding activity; we do not rely on every ground for every item of data.
| Activity and information | Purpose and legal ground |
|---|---|
| Enquiries and related project discussions; name, business contact information and message | Assessing and responding to your request, requested technical/quotation discussions and follow-up on that opportunity. For organisation representatives, legitimate interests under KVKK Article 5(2)(f), provided your fundamental rights and freedoms are not infringed. Article 5(2)(c) applies where processing is necessary to establish or perform a contract to which you personally are a party. |
| Estimator request; email, mission inputs and results | Producing, displaying and emailing the calculation you request; legitimate interests in providing that requested technical service under Article 5(2)(f). This does not require marketing permission. |
| Website/form security; connection/request information, verification and rate-limit records | Operating the site, preventing automated abuse and unauthorised access, and investigating delivery failures; Article 5(2)(f). Processing necessary for security obligations also relies on Article 5(2)(ç) and Article 12. |
| Selected-product release request; email, product and affirmative choice | Sending the requested product-release email within the selected scope; KVKK Article 5(1) and applicable commercial-message approval under Law No. 6563. The notice itself is not submitted for approval. |
| Estimator marketing; name, email, submitted mission inputs and results | Relevant product news and marketing emails using the information expressly covered by the optional estimator choice; Article 5(1). The selection is not required for an estimate. |
| Cookieless Cloudflare Web Analytics; page/performance information | Understanding aggregate website use and improving performance; Article 5(2)(f), subject to the protection of fundamental rights and freedoms. |
| Optional Google Analytics; analytics identifiers and page information | Evaluating website use through statistics; explicit consent under Article 5(1). |
| Permissions, refusals, statutory records and rights requests | Implementing preferences, meeting recordkeeping duties and handling rights requests; Article 5(2)(ç). Records necessary to establish, exercise or protect a right rely on Article 5(2)(e). |
4. Recipients and purposes of disclosure
Cloudflare provides website delivery, security, server processing, operational logs and cookieless website analytics. Resend handles delivery of requested emails and form notifications. Google Workspace provides company email and correspondence services. Google Analytics operates after your affirmative analytics choice. Relevant service subprocessors may also process information for these purposes.
Contact enquiries and product-release requests are delivered to the company mailbox. An estimate without marketing permission is sent only to the visitor. If the visitor selects the estimator marketing option, a copy of the estimate and the consent record is also sent to info@bosphorus.space. The record includes name, email, mission information, consent statement/version and request reference. In every case, Resend processes the contents of the message it sends.
There is no separate website permission database or automatic İYS integration. Necessary information may be provided to legal or financial advisers and competent authorities for a specific advisory need, legal duty or protection of rights. Website forms do not automatically distribute leads to commercial partners.
5. Services outside Türkiye
The cloud and email services described above can involve infrastructure, storage and support access outside Türkiye, including in the United States. Selecting a sending region or a Turkish reporting timezone does not mean information is processed only in Türkiye.
Services involving ongoing overseas processing require applicable conditions and safeguards under KVKK Article 9. Where appropriate, these include the Board's standard contract and required notification, or another valid Article 9 mechanism. General supplier terms, GDPR clauses or publication of this notice do not themselves constitute a Turkish-law transfer safeguard. Cookie or marketing consent is not used to create a general exception for routine cloud transfers. You may request information about relevant recipients and the transfer safeguards applied by contacting info@bosphorus.space.
6. Retention
Enquiries and related correspondence are kept for responding to the request and any continuing project or legal need. Marketing information is used while the relevant permission remains valid; withdrawal ends future marketing use. A product-release request relates only to the selected product. Records needed to honour a refusal or meet an applicable legal obligation may be retained after active use ends.
Company mailbox records are not automatically deleted by the website on a fixed schedule. Applicable legal retention obligations and specific rights-protection needs must be assessed for the record concerned; not every form message is a commercial archive document. When the reasons for processing end and no other valid ground applies, you may request erasure or destruction under KVKK Article 7.
Google Analytics user/event retention is set to two months, with reset on new activity off; aggregated reports may remain longer. Browser preferences and cookies have separate lifetimes in the Cookie Policy. Provider records and mailbox copies are separate processing locations, as explained in the Privacy Policy.
7. Your rights and requests
Under KVKK Article 11, you may learn whether your information is processed; request information about that processing; learn its purpose and whether it is used accordingly; learn domestic/overseas recipients; request correction of incomplete or inaccurate data; request erasure or destruction under Article 7; request notification of correction/erasure to recipients; object to an adverse result produced solely by automated analysis; and seek compensation for damage caused by unlawful processing.
Submit requests in writing to our registered office or through an electronic method permitted by the Communiqué on Applications to Data Controllers, using info@bosphorus.space. This is an ordinary email address, not a registered electronic mail (KEP) address. An electronic application may be made from an email address previously supplied to us and recorded in our systems, or using another permitted electronic verification method. State the request clearly and provide the identifying and notification details required by the Communiqué; contact us for help with a proportionate verification method. Do not send identity documents through the general contact form. Requests are concluded as soon as appropriate and within 30 days at the latest, with a written or electronic response. They are normally free; only additional costs permitted by the Board's tariff may be charged.
You may withdraw explicit consent for future processing. Refusing commercial email does not require an identity document or the rights-request form: email info@bosphorus.space. Change analytics preferences through “Cookie preferences” in the footer. Withdrawal does not retrospectively invalidate processing lawfully carried out before it.