Privacy policy
There are two separate questions, and each is answered on its own: what is collected from you while you browse this site, and what happens to your organisation’s data in the systems we install.
Last updated: 8 Oct 2026
Part A — While you browse this site
A.1 Cookies and browser storage
A.2 Third parties
The site has no analytics, heat maps, advertising pixels, chat tools or embedded video. No request goes to a third-party server.
The fonts (IBM Plex Sans and IBM Plex Mono) are downloaded at build time and served from our own server. Opening a page sends no request to Google or any other font provider — and this has a legal consequence: your IP address never reaches a font provider.
A.3 Server access log
Like every web server, a technical access log is kept:
- IP address
- Browser identification (User-Agent)
- Requested address and HTTP status code
- Request time and duration
- Browser language preference
Logs are kept only for server security and fault investigation. They are not used for visitor profiling, matching individuals or marketing.
Server logs rotate by size, not by time: when a file reaches 50 MB a new one is started, and the latest 7 files are kept. How far back the records go therefore depends on traffic; stating a fixed number of days would be wrong.
A.4 Contact form
When the form is submitted, the message is written to two places: (1) a log file on this server, and (2) the info@cscodebilisim.com mailbox, also on this server. Because this machine is also the domain’s mail server, the message never leaves the server; no third-party form service or mail provider is used.
Form records are kept after your request is concluded for as long as the business relationship requires. If you ask for deletion, we delete the record and confirm it in writing.
Which field is collected and why is set out as a table in the privacy notice.
Part B — Data in the systems we install
For data processed in the systems we install for our customers, the data controller is the customer organisation; CS-Code Bilişim acts as a data processor in those installations, under contract. The rules that apply across all products:
- Depending on your preference, the installation runs on your own servers or on servers we host. On your own servers, the data stays in your infrastructure; installations we host run on servers in Turkey. Data is not sent to storage abroad or to an external file service.
- Permissions are enforced on the server — who sees which record is decided on the server, not by a filter in the browser.
- Records are not deleted; they are deactivated. A wrong record is corrected; the old value, the person who corrected it and the reason remain in the audit trail.
- Physical disposal happens only when the retention period ends, and the disposal itself leaves a trace.
B.1 Every installation is separate
Every organisation gets its own installation, with its own database, permissions and backup scheme. Data from different organisations never sits in the same database. We don’t offer a multi-tenant cloud service — this is a design decision, not a shortcoming.
B.2 Our access
Under maintenance and support we may need to access your installation; this access is limited by contract. Every action we take through the application stays in the audit trail with who did it, just like anyone else’s.
B.3 Deletion and disposal
In the products, records are not deleted; they are deactivated. When a record turns out to be wrong, it is corrected; the old value, the person who corrected it, the time and the reason remain as they are. Physical disposal happens only when the retention period ends, and the disposal itself leaves a trace. This does not remove the data subject’s right to erasure — the request is made to the organisation that is the data controller, and the organisation runs the disposal process.
Requests
For privacy questions about this website: info@cscodebilisim.com. For requests about the data in your installation, please apply first to your own organisation’s data controller.