GDPR & KVKK Compliance

Hardal serves companies across the EU, Turkey, and the rest of the world, so we build our data protection practices to satisfy both the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Turkey's Personal Data Protection Law No. 6698 ("KVKK"). The two regimes share the same core principles: lawful basis for processing, data minimization, purpose limitation, and a data subject's right to access, correct, and delete their own data. We treat them as one compliance program rather than two separate checklists.

1. Who we are

Hardal is operated by Hardal Inc., a Delaware corporation, and Bubrise Teknoloji A.Ş., a Turkish corporation. Depending on where you or your company are based, one or both entities may be party to your agreement with us. Questions about data protection can be sent to our founders, Berkay Demirbaş and Barış Gürbüzler, at support@usehardal.com.

2. Two roles Hardal plays

This is the distinction that matters most for compliance, and it's easy to miss:

When you use Hardal to collect analytics and event data about the visitors and customers on your own website or app, you are the Data Controller (GDPR) / Veri Sorumlusu (KVKK), and Hardal acts as your Data Processor / Veri İşleyen. We process that data only per your configuration: which events you send us, which destinations you connect, and how long you keep it. We don't decide what personal data flows through the pipeline; your implementation does.

When we collect data about you directly (as a prospect, a signed-up customer, or a visitor to usehardal.com), Hardal itself is the Data Controller / Veri Sorumlusu. That relationship is covered by our Privacy Policy and our KVKK Aydınlatma Metni, not by this page.

3. Lawful basis for processing

Where Hardal acts as your processor, our own legal basis for handling data on your behalf is the contract between us (GDPR Art. 6(1)(b); KVKK md. 5/2-c). Where Hardal acts as controller (for our own customer and prospect data), we rely on contract performance, our legitimate interest in operating and improving the service, and consent where a lawful basis requires it (for example, marketing email).

4. Data residency & infrastructure

Our shared analytics infrastructure (ingestion and the ClickHouse database behind it) runs on Amazon Web Services in Frankfurt, Germany (eu-central-1), inside the EU. Customers on a dedicated deployment (a private "Hardal Signal" instance) can run on either AWS or Microsoft Azure; both default to an EU region (Azure: West Europe), and the region is configurable per deployment. See our Subprocessors page for the full list of infrastructure vendors and what each one handles.

5. Data Processing Agreement

We offer a Data Processing Agreement (DPA) covering both GDPR Art. 28 processor obligations and KVKK's equivalent data processing terms. Reach out to support@usehardal.com or your account contact to have one executed.

6. Security

We don't currently hold a SOC 2 report. We're happy to complete security questionnaires directly and walk your security team through how the pipeline is built: get in touch at support@usehardal.com.

7. Your rights

Under GDPR Art. 15–22 and KVKK md. 11, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise these rights:

GDPR: use our GDPR Data Subject Access Request Form
KVKK: use our KVKK Başvuru Formu

We aim to respond within one month of receiving a complete, verified request.

8. Supervisory authorities

If you believe we haven't handled your data lawfully, you can lodge a complaint with your local data protection authority in the EU, or with Turkey's Kişisel Verilerin Korunması Kurumu (KVKK Kurumu) if you're in Turkey.