Privacy

Last updated: 31 October 2026

This notice is provided under Article 13 of Regulation (EU) 2016/679 (GDPR) and Article 11 of Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). A summary table comes first, followed by the details.

Summary

Controller

Tarık Kaan Muşlu, trading as Saha İspanya, NIF/NIE Z3475666A. Address: Avenida de Pablo Iglesias 17, planta 5, puerta 6, 28003 Madrid, Spain. Email: tarik@sahaispanya.com. A data protection officer is not required and has not been appointed.

Data we process

This site has no contact form. You contact us only by email or WhatsApp. The data we process is the data you send us: name, company, position, email address, telephone number and the content of your message. If you use WhatsApp, your telephone number and profile name are also visible.

When you visit the site, the hosting provider (Netlify) may keep technical server logs such as IP address, date and time, requested page and browser type, for security and to deliver the service. We do not use these logs to identify visitors.

We use Cloudflare Web Analytics to see which pages of the site are visited and how often. It collects technical measurements such as the page address, referring site, browser and device type, country and page load time. It sets no cookies, stores nothing in your browser and does not recognise you from one visit to the next. Your IP address is discarded at the nearest Cloudflare data centre and is not stored. Results are available only for this site, as aggregated and anonymous statistics, and measurement data can be accessed for up to six months.

Purposes and legal bases

• Replying to your enquiry, preparing proposals and managing the agency or consulting relationship: GDPR Art. 6(1)(b) (steps at your request before entering into a contract, and performance of a contract).
• Recording you as a contact person of the company you represent and maintaining business-to-business communication: GDPR Art. 6(1)(f) (legitimate interest; Article 19 LOPDGDD recognises this basis for business contact details). You may object at any time.
• Measuring the number of visits to the site and its technical performance as anonymous statistics: GDPR Art. 6(1)(f) (legitimate interest).
• Compliance with legal obligations, such as tax and accounting records: GDPR Art. 6(1)(c).

Providing your data is not mandatory, but without it we cannot reply to you. We do not carry out automated decision-making or profiling.

Recipients

• Zoho Corporation B.V. (email service, EU data centres, mx.zoho.eu): processor.
• WhatsApp Ireland Limited / Meta: only if you choose to write to us through WhatsApp. Message metadata is processed under WhatsApp's own privacy terms; if you prefer not to use this channel, use email.
• Netlify, Inc. (website hosting, United States): technical server logs only.
• Cloudflare, Inc. (cookieless visit measurement, Cloudflare Web Analytics, United States): processor.
• Our manufacturer clients established in Türkiye: only when a buyer enquiry needs to be matched with the relevant manufacturer, and only the contact details needed for that purpose. We inform you before sharing.

Your data is not sold and is not shared for advertising purposes.

International transfers

• Türkiye: there is no European Commission adequacy decision. Any transfer to a Turkish manufacturer is safeguarded by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module One, controller to controller), which are incorporated into the contract with the relevant manufacturer before any transfer. You may request a copy at tarik@sahaispanya.com.
• United States: Netlify, Meta and Cloudflare state that they participate in the EU-US Data Privacy Framework recognised by Commission Implementing Decision (EU) 2023/1795. Where that framework does not apply, Standard Contractual Clauses apply.
• Zoho email data is kept within the EU.

Retention

Correspondence is kept for as long as the business relationship lasts and, after it ends, for the period needed to deal with possible legal liabilities (in Spanish law generally 5 years, and 6 years for tax and accounting records). Enquiries that do not lead to a relationship are deleted after 12 months at the latest.

Your rights

You may exercise your rights of access, rectification, erasure, restriction of processing, objection and data portability by writing to tarik@sahaispanya.com. We may ask for reasonable information to verify your identity. We reply within one month at the latest.

If you believe your rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).

Cookies

This site uses no cookies, local storage or fingerprinting. Visits are counted with Cloudflare Web Analytics, which stores nothing in your browser. This measurement produces only anonymous statistics for this site and stays within the limits that the Spanish Data Protection Agency (AEPD) guide on audience measurement tools (January 2024) treats as exempt from consent. For that reason no cookie banner is shown.

Changes

This notice is updated when the service or the law changes. The current version is always the one published on this page.