Privacy policy

Last updated: 17 September 2026

Applies to: omerbeyogluunlu.com and enquiries sent through it

This policy describes what this website actually does, not what a template says a website usually does. If you find anything here that does not match what you observe, tell us and we will correct it.

1. Who we are

Omerbeyoglu Unlu Ltd is the controller of the personal data described here. We are registered in England and Wales under company number 16504956, at 82A James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom.

For anything to do with personal data, write to privacyinfo@omerbeyogluunlu.com. We have not appointed a data protection officer, because we are not required to. Both partners handle these requests directly.

2. What we collect

The only place this site collects personal data from you is the contact form. There is no account system, no newsletter and no comment section.

Data collected through the contact form
What Required Why
Name Yes To address the reply
Email address Yes To send the reply and the acknowledgement
Message Yes The enquiry itself
Organisation No Context for the reply
Phone number No Only used if you tick the box allowing us to call
Subject area No Routes the enquiry to the right partner first
IP address Collected automatically Spam prevention and rate limiting on the form

Web server access logs exist on our server as they do for any website, and may contain your IP address, the pages you requested and your browser's user agent string. We keep them for security and fault finding only, and we do not analyse them for marketing.

Please do not send special category data (health, biometrics, political or religious views, and the other categories listed in Article 9 of the UK GDPR) through this form. If your enquiry involves it, say so in one line and we will arrange a secure channel first.

3. Why we process it, and on what basis

  • To answer your enquiry. Lawful basis: legitimate interests (Article 6(1)(f)), namely responding to somebody who has asked us a question, or where your message concerns engaging us, taking steps at your request before entering a contract (Article 6(1)(b)).
  • To call you about your enquiry. Lawful basis: consent (Article 6(1)(a)), given by ticking the box on the form. Leave it unticked and we will not call you. You can withdraw that consent at any time by telling us.
  • To keep the form from being abused. Lawful basis: legitimate interests, in keeping our systems available and our costs under control.
  • To meet legal and accounting obligations where an enquiry becomes an engagement. Lawful basis: legal obligation (Article 6(1)(c)) and contract (Article 6(1)(b)).

We do not use your data for marketing, we do not build profiles, and we do not make automated decisions about you.

4. Who else processes it

We use a small number of service providers. Each one acts on our instructions under a written contract.

Processors and third-party services
Service What it does Where
Twilio SendGrid Delivers the enquiry to us and the acknowledgement to you United States and EU
Google reCAPTCHA Distinguishes people from bots on the contact page. Google receives your IP address and interaction signals from that page. United States
Infobip Places the automated voice confirmation, only where you have ticked the consent box and only if we have that feature switched on Europe
Our own server Serves the site, runs the contact form handler and holds the server logs. Operated by us, not by a third party Turkey

Every file these pages load, the stylesheet, the scripts, the typeface and the icons, is served from our own server. Loading a page on this site makes no request to any third party at all. The one exception is the contact page, which loads Google reCAPTCHA to protect the form. We have no analytics, no advertising tags and no social media tracking pixels.

5. Where the site is hosted, and transfers outside the UK

This website runs on a server we operate ourselves, located in Turkey. When you load a page or send the contact form, the request is handled on that server. That means your IP address, the server logs described above and the contents of a form submission are processed in Turkey before the enquiry is delivered to our business email.

Turkey is not covered by UK adequacy regulations. The server is under our own control rather than a third party's, and it is subject to the safeguards in section 8, so the data does not leave our hands by being processed there. Access to it is limited to the two partners, and the contact form log is held outside the public web directory. Turkey has its own data protection law, the Personal Data Protection Law No. 6698, known as KVKK, which applies alongside UK GDPR to the processing on that server.

Where a separate processor is outside the United Kingdom, we rely on UK adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with the supplementary checks those mechanisms require. You can ask us for details of the mechanism used for a particular provider.

6. Cookies and similar technologies

This site sets no cookies of its own. If you choose a light or dark appearance in the footer, that one word is kept in your browser's local storage so the choice survives between visits. It is not sent to us and identifies nothing. There is no cookie banner, because there is nothing to consent to.

One exception is worth naming. On the contact page only, Google reCAPTCHA may set its own cookies in order to work. It is there to stop the form being abused, which is the purpose the form could not function without. If you would rather not load it, email us at contact@omerbeyogluunlu.com instead of using the form.

7. How long we keep it

  • Enquiries that do not lead anywhere: two years from the last message, then deleted.
  • Enquiries that become an engagement: kept with the client file, normally for seven years after the engagement ends, to meet contractual, tax and professional record obligations.
  • Rate limiting records: counters keyed to a hashed IP address, discarded within an hour.
  • Form error logs: retained for up to 90 days for troubleshooting, then deleted.
  • Hosting access logs: retained according to our provider's standard period, typically no more than 30 days.

8. How it is kept

The site is served over HTTPS from a server we operate ourselves. Credentials for the mail and spam prevention services are held as server environment variables rather than in the website's source code. Form logs are written outside the public web directory so they cannot be requested by a browser, and server access is limited to the partners. Enquiries live in our business email, which is protected by multi-factor authentication.

9. Your rights

Under the UK GDPR you have the right to:

  • ask what personal data we hold about you, and get a copy
  • have inaccurate data corrected
  • have data erased, where we have no continuing reason to hold it
  • restrict or object to processing carried out on the basis of legitimate interests
  • receive data you gave us in a portable format
  • withdraw consent, where consent is the basis we relied on

Write to privacyinfo@omerbeyogluunlu.com and we will respond within one month. There is no charge unless a request is manifestly unfounded or excessive, and we will tell you before treating it that way.

If you are not satisfied with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk, by telephone on 0303 123 1113, or in writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you raised it with us first, but you do not have to.

10. Changes to this policy

If we change what the site does, we change this page at the same time and update the date at the top. We do not backdate it.

11. Contact

Omerbeyoglu Unlu Ltd
82A James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom
Data protection enquiries: privacyinfo@omerbeyogluunlu.com
General enquiries: contact@omerbeyogluunlu.com