On this page
Introduction
At Glocsy we take the protection of your personal data seriously. This notice explains how your personal data is processed when you visit our website, use our contact form, email us or use our services.
As our company is based in Germany, your personal data is processed primarily under the EU General Data Protection Regulation ("GDPR") and the German Federal Data Protection Act ("BDSG"). For individuals in Türkiye, the Turkish Personal Data Protection Law No. 6698 ("KVKK") is also taken into account.
1. Data Controller
Company: Glocsy
Address: Alt-Moabit 77, 10555 Berlin, Germany
Email: support@glocsy.com
Web: https://glocsy.com
2. Personal Data We Process
Depending on the channel you use, the following categories of data may be processed:
- Identity data: first and last name
- Contact data: email address
- Request data: the service you are interested in and the content of your message
- Customer transaction data: quotes, contracts, project and invoice details (only if a business relationship is established)
- Technical data: IP address, browser and device information, access time and server logs
- Preference data: language preference, theme preference and cookie consent status
- Usage data: anonymised website usage statistics, only if you give your consent
3. Purposes and Legal Bases
- Responding to your enquiries and preparing quotes — pre-contractual measures (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c))
- Providing SEO, GEO, technical SEO and content services, managing projects and invoicing — performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c))
- Complying with commercial and tax record-keeping obligations — legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç))
- Keeping the website secure and available and preventing abuse (spam, attacks) — legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f))
- Analysing website usage to improve the experience — only with your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1))
4. How We Collect Data
We collect personal data through the contact form, email correspondence, contract processes and the technical infrastructure of the website, partly by automated means.
If you do not fill in the required fields of the contact form, we may not be able to respond to your request. Otherwise, you are under no obligation to provide personal data.
5. Recipients
We do not sell or rent your personal data. It is only shared with the following recipients to the extent necessary for the purposes above:
- Hosting, database and email service providers — under data processing agreements pursuant to GDPR Art. 28
- Analytics provider (Google Analytics) — only with your consent
- Accountants and tax advisers — to meet legal obligations
- Competent public authorities — where required by law
6. International Transfers
Your data is primarily processed within the European Union / European Economic Area. If one of our service providers processes data outside the EU, the transfer is based on appropriate safeguards such as a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or Standard Contractual Clauses.
For individuals in Türkiye, transfers abroad comply with the requirements of Article 9 of the KVKK.
7. Retention Periods
We keep personal data only for as long as the purpose of processing requires. Once the period ends, the data is deleted, destroyed or anonymised.
- Contact form and email enquiries: up to 2 years after the request has been handled; for the term of the contract if a business relationship follows
- Contracts, quotes and invoices: for the statutory retention periods (6 to 10 years under the German Commercial Code — HGB and Fiscal Code — AO)
- Server logs: short-term for security purposes, up to 30 days
- Analytics data: until you withdraw consent, up to 14 months
8. Your Rights
Under GDPR Articles 15–21 and KVKK Article 11 you have the right to:
- Find out whether we process your data and access it
- Have inaccurate or incomplete data corrected
- Have your data erased
- Restrict processing
- Receive your data in a structured, commonly used format (data portability)
- Object to processing based on legitimate interests
- Withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal
- Know the third parties your data was transferred to and have corrections or erasures notified to them
- Object to an adverse outcome resulting exclusively from automated analysis
- Claim compensation for damage caused by unlawful processing
9. Automated Decision-Making
We do not use your personal data for decisions based solely on automated processing (including profiling) that produce legal effects concerning you.
10. Requests and Complaints
To exercise your rights, send your request to support@glocsy.com. Requests are free of charge and answered within one month at the latest (within 30 days for requests under the KVKK).
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). Individuals in Türkiye may also apply to the Turkish Personal Data Protection Board.
11. Updates
We may update this notice to reflect changes to our services or the law. The current version is always published on this page.