Privacy & KVKK notice

Who is responsible

Avcı Ventures is the personal investment vehicle of Fatih Avcı. There is no incorporated company behind it — not in Türkiye, not in the Netherlands, not anywhere else. The data controller, in the sense of Turkish Law No. 6698 (KVKK) and of the GDPR, is therefore Fatih Avcı, acting as a natural person. There is no data protection officer, and none is required.

Contact for anything on this page: hello@avci.com.

What is collected, and how

The application form. Your name, your company, your email address, the vertical you select or type in yourself, an optional link, and your message. Attached automatically: the date and time, and the two-letter country code of your connection — for example TR or NL — which Cloudflare derives from your IP address. Your full IP address is not stored.

How it is collected. Entirely by automated means, through the form on this website, in electronic form. There is no other route by which this site collects anything about you personally.

Anonymous usage measurement. Which pages are opened, which language is chosen, which buttons are pressed, and whether a form was submitted. It runs without cookies and without any stored identifier, so one visit is not linked to the next and you are not followed onto other websites. The analytics account is set to discard client IP addresses, so no IP is kept — but a coarse location is derived from it before it is dropped, and that derived location stays on the record. The contents of the form are never sent to the analytics service.

One thing stored in your browser. If you switch the site between Turkish and English, that single choice is saved in your browser's local storage under the name avci_lang, so the site opens in the language you picked. It holds no identifier, it is never sent to us, and clearing your browser data removes it. Before you have picked anything, the site chooses the opening language from the two-letter country code Cloudflare derives from your connection — Turkish for Turkey, English everywhere else. That code is read as the page is served; it is not stored, and a language you have not chosen yourself is not written to your browser.

The form also carries one hidden field that real visitors never see. If it is filled in, the submission is treated as spam and discarded. That is the complete list — this site sets no cookies at all.

Why, and on what legal ground

Three purposes, each with its own ground. Your data is used for nothing else, and no decision about you is reached by automated means.

• Reading and answering your application. Ground: GDPR Article 6(1)(b) — steps taken at your own request before a possible contract; KVKK Article 5(2)(c) — processing necessary in direct connection with the conclusion or performance of a contract.
• Keeping a record of the applications already read. So a founder who comes back in two years does not start from nothing, and so we can show what was decided and why. Ground: GDPR Article 6(1)(f) and KVKK Article 5(2)(f) — legitimate interest. Ask us and we will send you the balancing test behind it.
• Seeing whether the site works. Which pages get read, in which language. Ground: GDPR Article 6(1)(f) and KVKK Article 5(2)(f) — the legitimate interest of running a website that functions. The language stored in your browser is not covered by this: it exists only because you asked for it.

Who else processes it, and where

Three processors, each acting on our instructions under a data processing agreement, none of them permitted to use your data for their own purposes:

• Cloudflare, Inc. — serves the website and holds the database your application is written to. That database was created under Cloudflare's EU jurisdiction setting, which confines storage and execution to data centres inside the European Union; it is currently served from Prague. Cloudflare is headquartered in the United States, is certified under the EU–US Data Privacy Framework, and its standard data processing addendum incorporates the European Commission's standard contractual clauses.
• Sendinblue SAS, trading as Brevo (France) — sends the single notification email that tells us an application has arrived. That email contains what you wrote. Brevo's servers are in the European Union, and Brevo's own privacy policy states that personal data may additionally be transferred to the United States and to India.
• PostHog, Inc. — receives the anonymous usage measurement described above, on its EU Cloud, hosted in Frankfurt, Germany. PostHog is a US company, is certified under the EU–US Data Privacy Framework, and its data processing agreement incorporates the European Commission's standard contractual clauses.

Nobody beyond these three sees your application. It is read by Fatih Avcı and no one else. It is not shared with the operating companies he is a partner in, and what you tell us is not used inside their businesses. Nothing is sold, and nothing is shared for anyone's marketing.

Data leaving Türkiye

Stated plainly, because it matters. All three processors above are established outside Türkiye, so using this form means your data is processed abroad. The Turkish Personal Data Protection Board has not issued an adequacy decision for any country to date. The safeguards relied on are the data processing agreements described in section 04 — each incorporating the European Commission's standard contractual clauses — together with the EU–US Data Privacy Framework certifications held by Cloudflare and PostHog. Ask us and we will send you a copy of any of them.

If you would rather nothing left the country, do not use the form. Write to hello@avci.com from your own mail account and say so.

How long it is kept

• An application we do not take forward: deleted twenty-four months after we answer you, together with the notification email held at Brevo.
• An application that leads to an investment: kept for as long as that investment lasts, and for ten years after it ends, because commercial and tax record-keeping rules require it.
• Usage measurement: kept for twelve months and then deleted by the analytics service. It contains nothing that identifies you.

Ask us to delete yours sooner and we will, unless one of the record-keeping rules above still applies — and we will confirm when it is done.

Your rights

Under Article 11 of Law No. 6698 you may:

• learn whether your personal data is being processed;
• request information about it if it has been processed;
• learn the purpose of the processing and whether the data is used in line with that purpose;
• know the third parties, in Türkiye or abroad, to whom the data has been transferred;
• have incomplete or incorrect data corrected;
• have the data erased or destroyed within the conditions of Article 7;
• ask that any correction, erasure or destruction be notified to everyone the data was transferred to;
• object to a result reached against you purely by automated analysis — we reach none;
• claim compensation if you suffer loss because the data was processed unlawfully.

Write to hello@avci.com. We answer within thirty days and free of charge, as Article 13 requires. Where an answer runs past ten pages the Board's tariff permits one Turkish lira per further page; in practice we do not charge. If you are not satisfied, you may complain to the Kişisel Verileri Koruma Kurumu.

If you are in the EEA or the United Kingdom, the GDPR gives you access (Article 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21), and the right to complain to your national supervisory authority (77).

Your right to object

Is giving us your data obligatory?

No. Nothing here is a statutory or contractual requirement, and you are under no obligation to send anything. The only consequence of leaving the form empty is that there is no application for us to read or answer — and you can always write to hello@avci.com instead.

Security, children, changes

The site is served over HTTPS only. The database is not reachable from the public internet; it is queried solely by this site's own application endpoint. No third-party script runs on the form.

This site is not directed at anyone under 18, and we do not knowingly collect data about children.

If this notice changes, the date at the top changes with it.