Privacy Policy
This page explains what personal data we collect through csg.com.tr, why we collect it, who we share it with, and what rights you have over it. We have tried to use plain language instead of legal boilerplate.
Last updated:
1. Who is responsible for your data
The csg.com.tr website is operated jointly by two companies. When we say "we" in this text, we mean both of them.
- CSG Etkinlik Yönetim ve Teknik Prodüksiyon Hizmetleri A.Ş., Tomtom Mah. İstiklal Cad. No:189 Kat:2 Daire:3, Beyoğlu, Istanbul, Türkiye
- IEM101 International Kft., Föld utca 53, 1032 Budapest, Hungary
Requests from Türkiye are handled by the Istanbul company under Turkish Personal Data Protection Law No. 6698 (KVKK). Requests from the European Union are handled by the Budapest company under the General Data Protection Regulation (GDPR). In practice it does not matter which one you write to, your request will be routed to the right place.
2. What data we collect
There is no sign-up, membership or account on this site. Personal data is collected only when you write to us.
Through the contact and quote form:
- Full name (required)
- Email address (required)
- Your message (required)
- Company name, phone number, event type and budget range (optional)
Anything else you send us while filling in the form, for example the event details you type into the message field, becomes part of the same record. We do not ask for special category data (such as health, belief or biometric data) and we ask you not to include it.
Automatically:
- Your language preference, stored in your browser's local storage
- Cookies set by Google for advertising measurement (see sections 4 and 8)
- On your first visit, a country lookup so the site opens in the right language (see section 5)
No Google Analytics or comparable visitor analytics tool is installed on this site.
3. Why we process this data
For a single purpose: to respond to your enquiry and manage the resulting business relationship. When you submit the form, your record reaches our team, we prepare your quote and we write back to you.
Legal basis:
- KVKK Article 5/2-c: directly related to the conclusion or performance of a contract. A quote request is a pre-contractual step.
- GDPR Article 6(1)(b): steps taken prior to entering into a contract, and performance of that contract.
- For advertising measurement, GDPR Article 6(1)(f): our legitimate interest in knowing whether our advertising spend produces results. You can object to this processing, see section 9.
We do not use your data to send you marketing emails, newsletters or campaign announcements. Writing to us does not add you to any list.
4. Google advertising measurement
We are treating this as its own section because it is the only place where your personal data leaves this site.
We advertise through Google Ads. If you arrive here by clicking one of our ads and then submit the form, a conversion signal is sent to Google. That signal is what lets Google tell us which ad actually worked.
Alongside that signal, under Google's "enhanced conversions" feature, the email address, phone number and name you entered in the form are also sent. Specifically:
- These values are hashed with SHA-256 in your browser, one way, before they leave your device
- Only the hash is sent to Google. Your email address and phone number are never transmitted in readable form
- Google attempts to match the hash against hashes in its own records, and discards the data where there is no match
- The purpose is measurement only. It is not used to retarget advertising at you through Google
Our advertising account is registered under "Can ÖZEN International Event Management and Technical Production Services". There is no exception to this transfer: if you submit the form, the signal is sent. If you would rather it were not, contact us directly by email or phone instead of using the form, and nothing is sent to Google.
For how Google processes this data: policies.google.com/privacy
5. Who we share your data with
We do not sell your data, rent it, or pass it to third parties for marketing. We use only the service providers that keep the site and our workflow running:
- Google (Firebase, Google Cloud): website hosting and the database where form submissions are stored. Data sits on Google Cloud infrastructure.
- Google Ads: only the hashed conversion signal described in section 4.
- Resend: the service that emails us a notification when you submit the form. The content of your submission appears in the body of that email.
- ipapi.co: on your first visit only, your IP address is used to look up your country so the site opens in the right language. The result is saved in your browser and the lookup is never repeated. It is not linked to the form or to your identity.
- Google Fonts: page typefaces load from Google servers, which makes your IP address visible to Google during that request.
Separately, if you use the WhatsApp button, that conversation is governed by Meta's own terms and is not covered by this policy.
Beyond the above, we share your data only where we are legally obliged to, on a properly issued request from a competent authority.
6. Where your data is stored
Some of the providers listed above operate servers outside Türkiye and the European Union, principally in the United States. Your form submission is therefore transferred abroad.
That transfer rests on the data processing agreements we have in place with Google and Resend and on the European Commission's Standard Contractual Clauses. Under KVKK, the transfer is necessary in order to act on your quote request.
If you would prefer your data not to leave the country, do not use the form. Call us instead.
7. How long we keep it
- Quote requests: for as long as the business relationship lasts. Where no relationship follows, 3 years from the last message. That window covers the chance of you coming back about the same event and lets us show the history if a dispute arises.
- Work that turns into a contract: 10 years, as required by commercial and tax record-keeping rules.
- Conversion records sent to Google: Google's own retention periods apply. We have no deletion control over that data.
- Language preference: stays in your browser until you remove it. Clearing your browser data is enough.
If you want your data deleted before those periods expire, we will delete it on request. See section 9.
9. Your rights
Under KVKK Article 11 and the GDPR you may ask us to:
- Confirm whether we process data about you, and give you a copy if we do
- Correct anything inaccurate or incomplete
- Delete your data
- Stop processing you object to, in particular the advertising measurement described in section 4
- Provide your data in a structured format so you can move it to another provider
- Withdraw a consent you previously gave
Writing to one of the addresses below is enough. There is no form to fill in. We may ask for further information to verify your identity, purely to stop someone else making a request in your name.
If you are not satisfied with our answer, you may complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr), to the supervisory authority of your country in the European Union, or for Hungary to the Nemzeti Adatvédelmi és Információszabadság Hatóság (naih.hu).
10. Security
The site is served entirely over HTTPS. Form submissions can only be read by authenticated administrators; the database rules block public reads. Access to the admin panel is protected by two-step verification and automatic logout after inactivity.
The form uses a simple arithmetic question and a hidden field as spam protection. Nothing collected in those fields is stored.
No system is perfect. If a security breach affects your data, we will notify both the competent authority and you within the period the applicable law requires.
11. Changes to this policy
We update this text whenever the tools we use or the data flows behind them change. The date at the top of the page always reflects the version in force.
If a change affects you directly, for example if we start sending data to a new third party, we will not rely on quietly editing this page. Where we have an active business relationship, we will tell you separately.
Contact us
For any request about your data, write to us at the addresses below. We respond within 30 days at the latest.
Reach us through the contact form.