Privacy policy

1. Who is responsible (data controller)

Mehmet Semih Babacan, the owner of the sole proprietorship (şahıs işletmesi) trading as Lumio Studio.

Address: Yeşilce Mahallesi Emirşah Sokak No: 21, Kağıthane / İstanbul 34418, Türkiye.

Contact: contact@lumiostudio.co

2. What we collect, why, and on what legal basis

KVKK article 5 and GDPR article 6 are the legal bases named below.

• Contact form (your email and a short description of your project). Purpose: answering your message and preparing a quote. Basis: taking steps at your request before a contract (KVKK art. 5/2-c, GDPR art. 6(1)(b)). Our contact form also adds your email to our MailerLite list so we can follow up on your enquiry; you can unsubscribe in any message or write to us.
• Free resources form (email, optional project note, and for the project planner your answers to its questions). Purpose: sending you the file you asked for and, when you mention a project or use the planner, notifying us so we can reply. Basis: performing what you asked for (KVKK art. 5/2-c, GDPR art. 6(1)(b)) and our legitimate interest in answering a project enquiry (KVKK art. 5/2-f, GDPR art. 6(1)(f)).
• Mailing list (MailerLite). Only if you tick the opt-in box on the free resources form, or by the contact form as described above. Purpose: occasional emails about our work and resources. Basis: your explicit consent for the free resources form (KVKK art. 5/1, GDPR art. 6(1)(a)).
• Transactional email (Resend). Delivery of the file, the automatic reply and our internal notification are sent through Resend. Basis: same as the form that triggered them.
• Cookieless page counts (Umami). Anonymous visit counts that store nothing on your device and run without consent. Basis: our legitimate interest in knowing which pages are read (KVKK art. 5/2-f, GDPR art. 6(1)(f)).
• Anonymous analytics (PostHog), always: page views, clicks and form events counted without cookies or browser storage; a visitor is only a daily anonymous hash computed on PostHog's servers, so we cannot recognise you across days. Basis: our legitimate interest in understanding how the site is used (KVKK art. 5/2-f, GDPR art. 6(1)(f)). Full analytics (PostHog), only after you accept. Page views, clicks and taps (autocapture), heatmaps, page performance (web vitals) and session recordings. Every form field is masked in recordings, so what you type is not recorded. Basis: your consent (KVKK art. 5/1, GDPR art. 6(1)(a)).
• Analytics (DataFast), only after you accept. A visitor cookie used to count visits and attribute a contact or free resource request to a traffic source. Basis: your consent.
• Hosting (Cloudflare). Our site is delivered through Cloudflare, which processes your IP address and request data to serve the page and protect it from abuse. Basis: our legitimate interest in running a secure website.

3. Retention

• Contact and free resource leads: kept until you unsubscribe or ask us to delete them, or for 24 months after our last contact with you, whichever comes first.
• Mailing list: until you unsubscribe.
• Analytics (PostHog, DataFast): kept according to each provider's default retention settings, and no longer than we need for the purpose above. Withdrawing consent stops new collection and clears the identifiers stored in your browser.
• Umami: anonymous counts only, with no personal data to delete.
• Where the law requires us to keep a record (for example for accounting if you become a client), we keep it for the legally required period.

4. Who receives your data and transfers abroad

We do not sell personal data. Service providers that process data on our behalf: Cloudflare (hosting), Resend (transactional email), MailerLite (mailing list), PostHog (analytics, US cloud, reached through our own /ingest address), DataFast and Umami (analytics).

These providers are located or process data outside Türkiye, mostly in the United States. For the analytics tools, the transfer takes place only after you accept in the cookie banner, and that choice is your explicit consent to the transfer under KVKK article 9. For forms, the transfer is needed to deliver the service you asked for and is protected by the safeguards that our providers offer, such as standard contractual clauses.

5. Your rights

Under KVKK article 11 and the GDPR you can ask us to:

• confirm whether we process your data and give you information about it;
• tell you the purpose and whether it is used accordingly, and who receives it at home or abroad;
• correct data that is incomplete or wrong;
• delete or destroy your data;
• tell the recipients about corrections and deletions;
• object to a result against you produced only by automated analysis;
• claim compensation if you suffered loss from unlawful processing;
• receive your data in a portable form and restrict or object to processing (GDPR).

6. How to use your rights and complain

Write to contact@lumiostudio.co from the email address you used with us, and tell us what you want. We answer within 30 days.

You may also complain to the Turkish Personal Data Protection Authority (KVKK, kvkk.gov.tr) or, if you are in the EU or UK, to your local data protection authority.

7. Withdrawing consent and cookie choices

Analytics cookies, heatmaps and session recordings run only after you accept. You can change your mind at any time, and withdrawing is as easy as accepting. Withdrawing stops PostHog's full tracking and DataFast and removes the identifiers they stored in your browser; only the anonymous, cookieless counts described above continue. Withdrawing does not affect what happened before.

To unsubscribe from the mailing list, use the link at the bottom of any email.

Cookie settings

8. Changes

If what we collect changes, we update this page and the date at the top. If the categories of analytics data change, the cookie banner asks for your choice again.