1. Data controller and contact
PLEC Mühendislik Danışmanlık Çözümleri ve Ticaret Limited Şirketi, Türkiye, is the data controller for the processing described in this notice. For questions or requests about personal data, contact consult@plec.solutions.
2. Personal data we process and how we receive it
When you submit a project inquiry, we may process your name, work email address, company, project type and timing, message or engineering brief, and any CAD or supporting files you choose to upload. We receive this information from you through the inquiry form and files you submit.
Admin sign-in may involve authentication and session information processed by Clerk. For website analytics, we record page views and active reading time aggregated by page, day, and country. The server uses the request IP address to derive country; raw IP addresses and visitor IDs are not retained in the analytics records.
3. Purposes and possible lawful bases
We use inquiry information to review and respond to project requests and follow up with you; authentication information to protect administrative access; and aggregated analytics to understand site usage and improve the website.
Depending on the purpose and circumstances, processing may rely on steps requested before a potential contract, legal obligations, our legitimate interests, or consent where required. Optional analytics is collected only after you choose “Accept analytics”; “Necessary only” disables optional analytics. The specific GDPR lawful basis for each activity and the wording of this mapping have not been confirmed by qualified counsel and must be reviewed before this notice is relied on as a final legal statement.
4. Service providers and international processing
Replit — hosting and storage: Replit provides PLEC’s development workspace, website hosting, managed database, and Object Storage. Replit’s published Data Processing Agreement describes Replit as a processor for customer personal data handled on the customer’s behalf. PLEC’s Workspace and published Project are configured for the EU geography. Replit says published compute, database, and Object Storage are colocated in the selected geography, but resources created before publishing may be in another location. We have not confirmed the region of the private Object Storage bucket used for uploaded files, so we cannot confirm that those files are stored in the EU. Replit’s public subprocessor list identifies Google, Inc. (USA) and Cloudflare (USA) for cloud infrastructure; those supplier locations do not establish the location of each PLEC data resource.
Replit references: Project geography — https://docs.replit.com/features/publishing/project-geography; subprocessor list — https://replit.com/subprocessors; Data Processing Agreement — https://replit.com/dpa.
Clerk — authentication: Clerk acts as a processor for PLEC’s admin authentication and session personal data. Project inquiries and uploaded files are processed in Replit-hosted application, database, and storage services, not by Clerk. Clerk states that it does not offer regional data residency and hosts data in the United States. Its public materials identify Google Cloud and Cloudflare as infrastructure providers. Clerk’s current detailed subprocessor list is available through its Trust Center; its public subprocessor page links to that list.
Clerk references: Trust Center — https://trust.clerk.com/; public subprocessor page — https://clerk.com/legal/subprocessors; Data Processing Agreement — https://clerk.com/legal/dpa.
International transfers: Replit’s published DPA describes transfers to adequate countries or under appropriate safeguards, including EU Standard Contractual Clauses and UK transfer terms where applicable. Clerk’s DPA describes the EU-U.S. Data Privacy Framework, its UK extension, and the Swiss-U.S. framework where applicable, and Standard Contractual Clauses when Clerk cannot rely on the Framework for a GDPR-covered transfer. These are provider-published terms; PLEC must confirm which agreements apply and assess transfer requirements under the laws governing each transfer, including transfers from Türkiye under KVKK.
5. Retention and security
We review personal information at least annually and delete or anonymize it when it is no longer needed, subject to legal retention duties and the handling of legal claims. Uploaded quote files are assigned a 30-day retention deadline; the deadline is removed for leads marked “ordered,” and expired files are removed through cleanup. This file deadline does not set the retention period for the related lead record.
We use appropriate technical and organizational measures to protect personal information.
6. Your data-protection rights
Subject to the conditions and limits that apply under data-protection law, you may ask to access your personal data, correct inaccurate data, request erasure or restriction of processing, and receive data you provided in a portable format where the right applies. You may object to processing based on legitimate interests where the right applies. Where processing is based on consent, you may withdraw it at any time; withdrawal does not affect processing carried out before withdrawal.
You may also lodge a complaint with a competent data-protection supervisory authority. The precise rights, conditions, and wording in this section require review by qualified EU data-protection counsel.
To submit a request, contact consult@plec.solutions. Requests will be handled under the applicable rules and time limits.
7. Cookies and analytics choices
Essential browser storage supports site operation and admin authentication. Your cookie choice is stored in local browser storage so the site can remember it; this preference is not itself a cookie. Optional first-party analytics is not required to use the website. You can choose “Necessary only” or “Accept analytics,” and change your choice through the cookie settings on the Cookie Policy page. A changed choice affects future analytics collection.
8. Notice status and updates
This draft describes the website practices currently recorded in PLEC’s other notices. The published Project geography is EU, but the location of the private Object Storage bucket used for uploaded files remains unconfirmed. Qualified EU data-protection counsel must review GDPR applicability, the lawful-basis mapping, rights wording, the applicable provider agreements, and transfer disclosures before the notice is treated as complete or final. We may update it when practices or legal obligations change. The date above identifies this version.