Data controller
The controller responsible for personal data processed through ChefChantier is ChefChantier, based in Şişli, İstanbul, Türkiye. You can reach us for any data-protection request through the contact form on this website.
Information we collect
Depending on how you use the service we may process: identity and contact data (such as name and e-mail), account and authentication data, workspace and project records, files you upload, and technical usage and log data such as IP address and device or browser information. Only information necessary for the service is collected.
Purposes of processing
Data is used to authenticate users, run project operations, store files, provide support, keep the service secure and improve the product. Personal data is never sold, and it is not used for advertising or cross-site profiling.
Legal bases
We process personal data on the following grounds: performance of our contract with you (to provide your account and the service); our legitimate interests (to secure, maintain and improve the product); compliance with legal obligations; and, where required, your explicit consent. These correspond to articles 5 and 6 of Turkish Law No. 6698 (KVKK) and to article 6 (and article 9 where relevant) of the GDPR.
Storage, security and retention
Data is stored on authorized cloud infrastructure with access controls, encryption in transit and least-privilege access. We keep personal data only as long as necessary for the purposes above and for the periods required by applicable law (for example commercial, tax and statute-of-limitation periods), after which it is deleted or anonymized.
Project and administration data
Workspace administrators may manage members, roles and project records. Project files and operational records remain available only to authorized workspace users and to the service providers needed to operate ChefChantier.
Third-party processors
ChefChantier relies on a small number of processors: Supabase (database, authentication and file storage), Vercel (application hosting), and map-tile providers (OpenStreetMap, CARTO and Esri) for the map view. Each processes data only to deliver its part of the service, under its own terms and privacy notice.
International transfers
Some processors (including Supabase and Vercel) operate infrastructure outside Türkiye and the European Economic Area. Where personal data is transferred abroad we rely on the safeguards required by law — your explicit consent or an adequate-protection or appropriate-safeguards mechanism under KVKK article 9, and standard contractual clauses or an equivalent mechanism under Chapter V of the GDPR.
Your rights
Subject to applicable law you may: learn whether your data is processed and request information about it; know the purpose and whether it is used accordingly; know the third parties to whom it is disclosed; request correction, deletion or destruction; object to outcomes produced solely by automated analysis; request restriction or portability; and seek compensation for damage caused by unlawful processing. These correspond to article 11 of the KVKK and articles 15–22 of the GDPR.
Exercising your rights and complaints
To exercise any of these rights, contact us through the contact form; we respond within the periods set by law (30 days under the KVKK). If you believe your rights have been infringed you may also lodge a complaint with the competent authority — the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, in the EEA, your local data-protection supervisory authority.
Changes to this policy
We may update this policy as the product or the law changes. The date above shows the current version, and material changes will be reflected here.
Your rights and contact
Use the contact form for access, correction, deletion or any other data-protection request.
Contact