KVKK Privacy Notice (Turkey)

This notice is issued by Ajansify as data controller under article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It informs people who use the Ajansify service, open an account, make a payment, are invited to a team, visit our websites or write to us.

1. Data controller

2. Scope of this notice

• We are the data controller for your account, subscription, payment, security, communication, marketing and cookie data. This notice describes that processing.
• The content our customers upload to or create in Ajansify may contain other people's data, such as people in photos and videos, Google reviewers or the customer's own customers. For that data the customer is the controller and we act as a data processor, only on the customer's instructions. The customer is responsible for informing those people. See the Data Processing Agreement.
• General information for users outside Türkiye is in the Privacy Policy.

3. Categories of personal data processed

Special categories of personal data. We do not knowingly process special categories of data under article 6 KVKK (health, religion, biometric data and so on), and we ask you not to upload such data. Your own face and voice data is not used to identify or authenticate you; it is processed only with your explicit consent and only to produce content.

4. Purposes and legal grounds

The "Legal ground" column refers to article 5 KVKK: (2-a) expressly provided for by law, (2-c) necessary for the conclusion or performance of a contract, (2-ç) necessary to comply with a legal obligation, (2-e) necessary to establish, exercise or protect a right, (2-f) legitimate interest, (1) explicit consent.

We do not ask for explicit consent for processing that relies on another legal ground. Explicit consent is requested only for the optional purposes above, in a separate text.

5. How we collect personal data

We collect your personal data electronically, by automated or partly automated means:

• the sign-up form and payment step;
• the customer panel (brand profile, uploads, editor, settings, support);
• integrations: publishing tools, cloud storage, Google Business Profile and the payment institution you use;
• cookies and the browser's local storage;
• automated records such as server and application logs;
• e-mail and support correspondence;
• your brand's public website, when you ask us to scan it.

Data collected in these ways is processed on the legal grounds given for each purpose in section 4.

6. Transfers of personal data

Your personal data may be transferred to the recipient groups below, in line with articles 8 and 9 KVKK and limited to the purposes and legal grounds in section 4.

6.1 Recipients in Türkiye

6.2 Recipients abroad

Transfers abroad are made under the standard contracts announced by the Personal Data Protection Board, in accordance with article 9(4) KVKK. After signature, the contracts are notified to the Personal Data Protection Authority within the statutory period. The current list of providers is on Service Providers & Sub-processors.

7. Retention periods

We keep personal data for as long as the purpose requires and the law provides. The main periods are:

• account data: while the account is open; after closure, customer content can be exported for 30 days and is then deleted (from backups within 90 days at the latest);
• invoices, orders and contract records: 10 years (Turkish Commercial Code art. 82, Tax Procedure Law);
• records of legal acceptances: term of the contract plus 10 years;
• commercial message approval records: 3 years after the approval ends;
• consumer transaction records and notification delivery records: 3 years;
• traffic, access and security logs: 2 years;
• AI prompt and output logs: up to 1 year;
• cookie choice: 12 months.

When a period ends, the data is deleted, destroyed or anonymised.

8. Your rights under article 11 KVKK

By applying to the data controller, you may:

1. learn whether your personal data is processed;
2. request information about it if it has been processed;
3. learn the purpose of processing and whether it is used in line with that purpose;
4. know the third parties in Türkiye or abroad to whom it has been transferred;
5. request correction if it is incomplete or inaccurate;
6. request deletion or destruction under the conditions in article 7 KVKK;
7. request that the actions in items 5 and 6 are notified to third parties to whom the data was transferred;
8. object to a result against you that arises from analysis of your data exclusively by automated systems;
9. claim compensation if you suffer damage because of unlawful processing.

9. How to apply

Under the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can apply in one of these ways:

• In writing: with a wet-signed letter to Adres Adres Adres Adres Adres Adres;
• By KEP: to ajans,[email protected];
• With a secure electronic signature or mobile signature: to [email protected];
• From the e-mail address registered in our system: from the e-mail address registered to your Ajansify account to [email protected].

Your application must include: your name, surname and, for written applications, your signature; your Turkish ID number if you are a Turkish citizen, or your nationality and passport number or ID number if you are a foreign national; your residential or business address for notifications; your e-mail address and phone number, if any; the subject of your request; and any relevant documents.

We may ask for more information to verify your identity. We conclude your application as soon as possible according to its nature and within 30 days at the latest, free of charge. We reply in writing or electronically.

10. Complaint to the Board

If your application is rejected, you find our reply insufficient, or we do not reply in time, you can complain to the Personal Data Protection Board within 30 days of learning of our reply, and in any case within 60 days of your application (article 14 KVKK).

11. Explicit consent and commercial message approval

• The two optional purposes that rely on explicit consent (marketing and personalisation; face and voice data) are described in the separate KVKK Explicit Consent Form. Consent is not a condition of the service.
• Approval for campaign messages is requested with the separate Marketing Communications Consent text.

12. Information note

This notice is for information only under article 10 KVKK; it does not ask for your approval or acceptance. The "I have read and understood" statement you give at sign-up only confirms that you have read this notice; it is not explicit consent or acceptance of a contract. We may update this notice; the current version is always on this page.