Privacy Policy
Last updated: 6 October 2026
We believe privacy policies should tell you what actually happens to your information, in language you can understand. This one explains what Walrus Creative Works collects through walruscreativeworks.com, why we collect it, who we work with to run the website, how long we keep it, and what you can ask us to do with it.
1. Who we are
The data controller responsible for this website is:
Walrus Creative Works Reklam Ajansı A.Ş. (“Walrus”, “we”, “us” or “our”)
Cevizli Mah. Mustafa Kemal Cad. No: 34 İç Kapı No: 15
Kartal, İstanbul, Türkiye
Tax Office: Kartal
Tax Number: 7981497101
Trade Registry Number: 499341-5
MERSİS Number: 0798149710100001
Email: hello@walruscreativeworks.com
For questions or requests about your personal data, email us at the address above and write Privacy Request in the subject line.
2. What this policy covers
This policy applies when you:
- visit our website;
- send us a message through the contact form or by email;
- book a meeting through the Google Calendar tool embedded on our website;
- subscribe to our newsletter;
- otherwise communicate with us about our work or services.
If you become a client, supplier, freelancer, employee or job applicant, we may provide an additional privacy notice that covers the information processed in that relationship.
3. The information we collect
Information you give us
Contact enquiries. When you use our contact form, we collect your name, email address, selected enquiry topic, message and any information you choose to include about yourself, your company or your project.
Direct communications. If you email us or contact us another way, we receive the information contained in that communication, together with related correspondence and contact details.
Meeting bookings. If you use the Google Calendar appointment tool, Google and Walrus may receive information such as your name, email address, selected date and time, time zone, meeting details and anything else you add to the booking.
Newsletter subscriptions. When you subscribe, we collect your email address, subscription status and preferences. Our newsletter provider may also record delivery, open and click information, together with related technical data, so we can operate the mailing list and understand whether our emails are working.
Please do not send us special-category or highly sensitive personal data—such as health information, biometric data, political opinions, religious beliefs, government identification numbers or financial account information—through the website unless we specifically ask for it and explain why it is needed.
Information collected automatically
When you visit the website, our hosting and security providers may automatically process limited technical information, including:
- IP address;
- browser and device type;
- operating system;
- requested page or file;
- referring page;
- date and time of the request;
- basic diagnostic, security and anti-spam information.
We do not use advertising pixels or behavioural advertising tools on this website. If you agree to it, we also use Google Analytics to understand how the website is used; see section 6.
4. Why we use your information and our legal bases
We process personal data only where we have a lawful reason to do so. Depending on where you are, the legal basis may arise under Türkiye’s Law No. 6698 on the Protection of Personal Data (“KVKK”), the EU or UK General Data Protection Regulation (“GDPR”), or another applicable privacy law.
| What we do | Why we do it | Main legal basis |
|---|---|---|
| Answer enquiries and prepare proposals | To respond to you, understand what you need and take steps towards a possible working relationship | Steps requested before entering into a contract; our legitimate interest in responding to business enquiries |
| Manage booked meetings | To arrange and hold the meeting you requested | Steps requested before entering into a contract; our legitimate interest in managing communications |
| Send the newsletter | To send the emails you asked to receive and manage your preferences | Your consent; where permitted by law, our legitimate interest in communicating with existing business contacts |
| Measure how the website is used | To see which pages are useful, how visitors find us and what to improve | Your consent, given through the cookie banner |
| Operate, secure and troubleshoot the website | To deliver the site, prevent abuse, detect technical problems and protect our systems | Our legitimate interests in security and reliable operation; compliance with legal obligations |
| Maintain business and legal records | To meet tax, accounting, commercial and regulatory requirements and establish, exercise or defend legal claims | Compliance with legal obligations; establishment, exercise or defence of legal rights |
| Handle privacy requests | To verify and respond to requests concerning personal data | Compliance with legal obligations |
Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing that was lawful before the withdrawal.
Where we rely on legitimate interests, we consider the likely impact on you and do not use that basis where your rights and freedoms outweigh our interests.
5. Newsletter and marketing choices
We send the Walrus newsletter only when you have subscribed or when another lawful basis allows us to contact you. You can unsubscribe at any time by using the link at the bottom of any newsletter or by emailing us.
Unsubscribing stops future marketing emails. We may keep a minimal suppression record—usually your email address and opt-out status—so that we do not accidentally add you back to the list.
Service messages that are necessary for an existing project or business relationship are not marketing and may still be sent where needed.
6. Cookies, local storage and embedded content
Cookies are small files or similar technologies stored on or accessed from your device. The Walrus website does not use advertising cookies. With your consent, it uses Google Analytics cookies to measure how the website is used.
The website does, however, use third-party services:
Google Calendar. The booking section contains an embedded Google Calendar appointment scheduler. When that section loads or you interact with it, your browser may connect directly to Google. Google may receive technical data such as your IP address, browser information and referring page, and may use cookies or similar technologies according to your Google settings and its own policies. If you are signed into Google, Google may associate the interaction with your account.
Google Analytics. Google Analytics loads only after you click Accept in the cookie banner; if you click Decline or ignore the banner, it is not loaded at all. Once accepted, it records information such as the pages you view, how long you stay, how you arrived (for example from a search engine or a link), your device and browser type, and an approximate location derived from your IP address. Google Analytics does not store your full IP address. It sets first-party cookies named _ga and _ga_<ID>, which last up to 2 years. We use it only to understand and improve the website: Google signals and advertising features are switched off, and the data is not used to show you ads. We keep Google Analytics data for 14 months, after which Google deletes it automatically. You can change your choice at any time with the Cookie settings link at the bottom of every page.
Mailchimp. If you submit the newsletter form, your information is sent to Mailchimp, a service provided by Intuit. Mailchimp may use cookies or similar technologies on its subscription and confirmation pages and may include tracking technologies in emails, such as those used to measure opens and clicks.
Netlify. The website is hosted on Netlify. Netlify processes network and security information required to deliver the website and handles submissions sent through the contact form.
Where applicable law requires consent before an optional cookie or similar technology is used, it should not be activated until that consent has been obtained. You can also block or delete cookies through your browser settings, although this may affect the Google booking tool or Mailchimp subscription flow.
For more information about these providers, see:
- Google Privacy Policy
- How Google uses information from sites that use its services
- Mailchimp / Intuit Global Privacy Statement
- Mailchimp Cookie Statement
- Netlify Privacy Statement
7. Who receives your information
We do not sell or rent personal data.
We may share information only where necessary with:
- authorised members of the Walrus team and trusted freelancers who need it for the relevant enquiry or project and are subject to confidentiality obligations;
- hosting, form-processing and security providers, including Netlify;
- newsletter and email service providers, including Mailchimp / Intuit;
- scheduling, email, productivity and website analytics providers, including Google;
- professional advisers such as lawyers, accountants and auditors;
- public authorities, courts or regulators where disclosure is required by law or necessary to protect legal rights;
- a buyer, investor or successor if Walrus is involved in a merger, financing, reorganisation or sale, subject to appropriate confidentiality and data-protection safeguards.
Service providers may use other approved subprocessors to deliver their services. They process personal data under their own contractual and legal obligations.
8. International transfers
Walrus is established in Türkiye, while some of the providers used for this website—including Netlify, Google and Mailchimp / Intuit—operate internationally and may process information in the United States or other countries outside Türkiye, the European Economic Area or the United Kingdom.
Where personal data is transferred internationally, we use an available lawful transfer mechanism as required by the applicable law. Depending on the transfer, this may include an adequacy decision, standard contractual clauses, binding corporate rules, an approved standard contract or another safeguard recognised under Article 9 KVKK and Chapter V GDPR. Where the law requires explicit consent for a particular transfer and no other mechanism is available, we ask for it separately.
No international transfer mechanism removes all differences between legal systems. We assess our providers and take reasonable contractual and organisational steps intended to protect personal data wherever it is processed.
9. How long we keep information
We keep personal data only for as long as it is needed for the purpose for which it was collected, and longer only where the law or a legitimate legal need requires it.
Our usual retention periods are:
| Information | Usual retention period |
|---|---|
| Enquiries that do not become a client relationship | Up to 2 years after our last substantive contact |
| Meeting bookings and related notes | Up to 2 years after the meeting or last follow-up |
| Newsletter subscription data | Until you unsubscribe or the mailing list is closed; a minimal suppression record may be kept afterwards |
| Contact-form copies held in the website platform | Reviewed and deleted regularly, and no later than 2 years after submission unless needed for an active relationship or legal claim |
| Google Analytics data | 14 months, then deleted automatically |
| Security and technical logs | Usually up to 90 days, unless needed to investigate a security incident or comply with law |
| Privacy requests and our response | Up to 3 years after the request is closed |
| Records connected with a contract, invoice, dispute or legal obligation | For the period required by applicable commercial, tax and limitation laws |
Backups and provider systems may retain residual copies for a limited period before they are securely overwritten or deleted.
10. How we protect information
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These include access controls, limited internal access, confidentiality obligations, reputable service providers, secure connections and appropriate account-security practices.
No website or method of transmission is completely secure. If a personal-data breach occurs, we will investigate it and notify affected people and competent authorities where required by law.
11. Your rights
Your rights depend on the law that applies to you and may be subject to legal limits or exceptions.
Rights under KVKK
Under Article 11 KVKK, you may ask Walrus to:
- tell you whether your personal data is being processed;
- provide information about that processing;
- explain the purpose of processing and whether the data is used consistently with that purpose;
- identify third parties in Türkiye or abroad to whom the data has been transferred;
- correct incomplete or inaccurate data;
- delete or destroy data where the legal conditions are met;
- notify relevant third parties of a correction, deletion or destruction;
- object to a result against you produced exclusively through automated analysis;
- compensate damage caused by unlawful processing.
Rights under GDPR
Where GDPR applies, you may have the right to:
- access your personal data;
- correct inaccurate or incomplete data;
- request deletion;
- restrict processing;
- object to processing based on legitimate interests or to direct marketing;
- receive certain data in a portable format;
- withdraw consent at any time;
- lodge a complaint with the data-protection authority where you live, work or believe an infringement occurred;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where legally permitted.
We do not currently use website data to make solely automated decisions with legal or similarly significant effects.
12. How to exercise your rights
Email hello@walruscreativeworks.com with Privacy Request in the subject line, or send a written application to our registered address above. Tell us what you are asking for and provide enough information for us to identify the relevant records. We may request additional information where reasonably necessary to verify your identity and protect your data from unauthorised access.
Applications under KVKK may also be made using the methods permitted by the Communiqué on the Procedures and Principles of Application to the Data Controller. We respond to valid KVKK requests as soon as possible and within 30 days at the latest. Requests are normally free, but a fee may be charged where permitted by the applicable tariff or law.
13. Children
This is a business website and is not directed to children. We do not knowingly collect personal data from anyone under 18 through the website. If you believe a child has provided us with personal data, contact us so we can review and delete it where appropriate.
14. Third-party links
Our website links to third-party websites and social platforms, including LinkedIn and Instagram. Those services decide how they process information collected on their own websites. Their privacy policies apply when you follow those links; this policy does not.
15. Changes to this policy
We may update this policy when the website, our providers or the law changes. The date at the top shows when it was last updated. If a change materially affects how we use personal data, we will provide a more prominent notice where appropriate.
16. Contact us
Questions, concerns and privacy requests can be sent to:
Walrus Creative Works Reklam Ajansı A.Ş.
Cevizli Mah. Mustafa Kemal Cad. No: 34 İç Kapı No: 15
Kartal, İstanbul, Türkiye
hello@walruscreativeworks.com