Last updated: 27.09.2026
At ADTOUCH LABS TÜRKİYE BİLGİ TEKNOLOJİLERİ TİC. LTD. ŞTİ. (“AdTouch Labs” or the “Company”), we care about the security and lawful processing of your personal data. This Privacy Notice is issued under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains for what purposes, on which legal bases and by which methods we process the personal data of visitors to the adtouchlabsturkiye.com website, people who fill in our forms, our customers and members, and the representatives and employees of organisations we do business with; to whom the data may be transferred; and your rights under the KVKK. The Turkish version of this notice is the legally binding version; this English version is provided for information.
1. Data Controller
The data controller under the KVKK is ADTOUCH LABS TÜRKİYE BİLGİ TEKNOLOJİLERİ TİC. LTD. ŞTİ., whose details are set out below.
| Legal name | ADTOUCH LABS TÜRKİYE BİLGİ TEKNOLOJİLERİ TİC. LTD. ŞTİ. |
|---|---|
| Address | Skyport Rezidans No:1 Ofis 151, Beylikdüzü / İstanbul |
| MERSİS number | 0008191010700001 |
| Tax office / number | Beylikdüzü 0081910107 |
| info@adtouchlabsturkiye.com | |
| Phone | +90 850 303 10 81 |
| Website | adtouchlabsturkiye.com |
2. Scope of this Notice
This notice covers the following processing activities carried out by the Company as data controller:
- Website visitors: everyone who visits the adtouchlabsturkiye.com website.
- Form applicants: people who complete our contact, demo, quote or information request forms, and people who verify their e-mail address to download free digital products.
- Customers and members: individuals who create a customer account or purchase software licences, website templates, digital marketing services, technical support or digital products, and the representatives of corporate customers.
- Business contacts: representatives and employees of customers, suppliers, business partners and prospective partners.
Data we process as a data processor
Corporate customers using our AI products such as AdTouch Legal, NeuroAds, StayPanel, Meditouch, Belediye Yapay Zekâ (Municipal AI) and BrainCommerce may upload or process personal data through these products in the course of their own activities (for example, data about persons in case files, hotel guests, patients or appointments, or citizen requests). In that case the organisation using the product is the data controller, and the Company acts as a data processor solely on that organisation’s instructions under the service agreement and data processing agreement concluded with it. Providing information on and handling requests about such data is the responsibility of that organisation. Please address requests concerning such data directly to the relevant organisation; where possible, we will forward any such request we receive to it.
Special categories of personal data
We do not request, through our website, any special categories of personal data under Article 6 KVKK, such as health or biometric data, religious beliefs or criminal convictions. Please do not include such data in free-text form fields, support requests or uploaded documents. If such data is nevertheless sent to us, it will not be processed unless one of the conditions in Article 6 KVKK (as amended by Law No. 7499) applies, and it will be deleted at the earliest opportunity.
3. Categories of Personal Data Processed
| Data category | Examples |
|---|---|
| Identity | First name and surname; Turkish ID number where legally required for issuing an e-Archive invoice. |
| Contact | E-mail address, phone number, billing and correspondence address. |
| Professional | Company or organisation name, title, position. |
| Customer transaction | Product or service of interest, request and message content, order and cart details, licence and subscription details, support records, download records. |
| Financial | Payment method and status, transaction reference and result received from the payment service provider, payer name, bank, IBAN and amount shown on a bank transfer receipt, billing details, tax office and tax number. Your card details are neither seen nor stored by the Company. |
| Transaction security | IP address, browser and device information (user agent), session information, access and error logs, one-time code verification records, password stored as a one-way hash, bot protection signals. |
| Marketing | Traffic source and campaign details (UTM parameters, gclid and similar click identifiers, landing page, referring page), data obtained through analytics and marketing cookies if you consent, communication preferences. |
| Legal transaction | Records of acknowledgements of notices, explicit consents, commercial message permissions and contract acceptances (text version, date and time, IP address, page), correspondence, requests and complaints. |
4. How We Collect Personal Data
We collect personal data by fully or partly automated means, or by non-automated means as part of a filing system, through the following channels:
- contact, demo and quote request forms, the free-download verification form, and the registration, cart and checkout pages on our website;
- server logs, strictly necessary cookies and browser storage technologies while you use the website, and analytics and marketing cookies only if you consent (see our Cookie Policy);
- e-mail, phone, SMS and instant messaging communications, meetings and correspondence with us;
- our service providers (e.g. the payment service provider reporting the payment result, SMS delivery reports, security infrastructure signals);
- your employer, where it shares your details with us in the course of a business relationship.
5. Purposes and Legal Bases
We process personal data in line with the general principles in Article 4 KVKK and on the legal bases set out below. The legal bases in Article 5(2) KVKK are: (a) the processing is expressly provided for by law; (b) it is necessary to protect the life or physical integrity of a person who is unable to give consent due to actual impossibility; (c) it is necessary to process the personal data of the parties to a contract, provided that it directly relates to the conclusion or performance of that contract; (ç) it is necessary for compliance with a legal obligation of the controller; (d) the data has been made public by the data subject; (e) it is necessary for the establishment, exercise or protection of a right; and (f) it is necessary for the legitimate interests of the controller, provided that it does not harm the fundamental rights and freedoms of the data subject. Where none of these applies, we process data only on the basis of your explicit consent under Article 5(1) KVKK.
5.1. Website visitors
| Processing activity | Data categories | Purpose | Legal basis |
|---|---|---|---|
| Delivering and securing the website and preventing attacks and abuse (content delivery network, firewall, bot protection, rate limiting, access logs) | Transaction security | Information security, service continuity | Art. 5(2)(f) (legitimate interest); for records required by law, Art. 5(2)(a) and 5(2)(ç) |
| Use of the strictly necessary session cookie (form security, cart, login) | Transaction security | Providing the function you request, preventing cross-site request forgery (CSRF) | Art. 5(2)(c) and 5(2)(f) |
| Recording your cookie preference | Transaction security, legal transaction | Respecting your choice and proving consent | Art. 5(2)(ç) and 5(2)(f) |
| Temporarily keeping your traffic source (UTM, click identifiers) in your browser session | Marketing | Identifying the channel of a request if you submit a form, using the advertising budget efficiently | Art. 5(2)(f) |
| Analytics cookies (Google Analytics 4, Yandex Metrica) | Transaction security, marketing | Statistical measurement and improvement of website use | Art. 5(1) (explicit consent) |
| Marketing cookies (Google Ads conversion tracking, Meta Pixel) | Marketing | Measuring advertising conversions, interest-based advertising and remarketing | Art. 5(1) (explicit consent) |
5.2. Form applicants
| Processing activity | Data categories | Purpose | Legal basis |
|---|---|---|---|
| Receiving, assessing and responding to contact, demo and quote requests | Identity, contact, professional, customer transaction (product of interest, message) | Handling your request, running demo and quotation processes | Art. 5(2)(c) (directly related to concluding a contract) and 5(2)(f) |
| Keeping a proof record of the submission | Transaction security (IP, user agent), legal transaction (page, text version, date and time) | Proving the submission and any consents given, protecting rights in potential disputes | Art. 5(2)(ç) and 5(2)(e) |
| Recording the campaign and channel the request came from | Marketing (UTM, gclid and similar identifiers, landing page) | Measuring the effectiveness of marketing activities | Art. 5(2)(f) |
| Instant notification of new requests to the relevant team (e-mail, Telegram) | Identity, contact, request summary | Ensuring requests are answered quickly by the right person | Art. 5(2)(f) |
| E-mail verification (one-time code) for free digital products and sending the download link | Contact, transaction security, customer transaction | Delivering the product, preventing automated misuse | Art. 5(2)(c) and 5(2)(f) |
| Sending commercial electronic messages and processing for marketing | Identity, contact, marketing | Announcing campaigns, products and events | Permission under Article 6 of Law No. 6563 and Art. 5(1) KVKK (explicit consent), only if you separately opt in |
5.3. Customers and members
| Processing activity | Data categories | Purpose | Legal basis |
|---|---|---|---|
| Creating and managing your customer account; login with e-mail/password and optional SMS one-time code | Identity, contact, transaction security | Performing the membership agreement, securing the account | Art. 5(2)(c) and 5(2)(f) |
| Taking orders, collecting payment, delivering digital products and licences, performing services, installation support | Identity, contact, customer transaction, financial | Concluding and performing the sales contract | Art. 5(2)(c) |
| Checking receipts uploaded for bank transfer payments | Financial | Verifying and recording the payment | Art. 5(2)(c) and 5(2)(ç) |
| Issuing e-Archive invoices, accounting and tax records | Identity, contact, financial | Complying with tax and commercial law obligations | Art. 5(2)(a) and 5(2)(ç) (Tax Procedure Law No. 213, Turkish Commercial Code No. 6102) |
| Recording acceptance of the pre-contractual information, the distance contract and the right-of-withdrawal exception | Legal transaction, transaction security | Complying with, and evidencing compliance with, consumer protection law | Art. 5(2)(a), 5(2)(ç) and 5(2)(e) |
| E-mail and SMS notifications about orders, payments, delivery and account security | Contact, customer transaction | Information necessary to perform the contract (these are not commercial electronic messages) | Art. 5(2)(c) |
| Technical support and handling of requests and complaints | Identity, contact, customer transaction | Ensuring service quality and resolving requests | Art. 5(2)(c) and 5(2)(f) |
| Managing disputes and responding to requests from competent authorities | All relevant categories (to the extent necessary) | Conducting legal proceedings | Art. 5(2)(a), 5(2)(ç) and 5(2)(e) |
5.4. Business contacts
| Processing activity | Data categories | Purpose | Legal basis |
|---|---|---|---|
| Communication, meetings, quotations and contract processes with customers, suppliers and partners | Identity, contact, professional | Establishing and managing the business relationship | Art. 5(2)(c) (where you are a party to the contract) and 5(2)(f) |
| Purchasing, payment and invoicing | Identity, contact, financial | Running finance and accounting processes | Art. 5(2)(c) and 5(2)(ç) |
No decision based solely on automated processing that produces legal effects concerning data subjects or similarly significantly affects them is made on our website.
6. Transfers of Personal Data
Your personal data may be transferred, only to the extent necessary for the purposes above and in accordance with Articles 8 and 9 KVKK, to the recipient groups below. We enter into agreements with our service providers to safeguard the security and confidentiality of the data.
| Recipient group | Service provider | Purpose of transfer |
|---|---|---|
| Payment service provider | iyzico | Accepting card payments, refunds and chargebacks. Card details are processed directly by iyzico; the Company neither sees nor stores them. |
| Accounting and e-invoicing provider | Paraşüt | Issuing and sending e-Archive invoices; invoices are reported to the Revenue Administration as required by law. |
| SMS provider | Netgsm | Sending one-time verification codes and order/account SMS notifications; commercial SMS only if you consent. |
| Analytics and advertising providers (only with your cookie consent) | Google (Google Analytics 4, Google Tag Manager, Google Ads), Meta (Meta Pixel), Yandex (Yandex Metrica) | Measuring website use, tracking advertising conversions, interest-based advertising. |
| Infrastructure and security provider | Cloudflare | Content delivery, attack and bot protection (including Turnstile), secure transmission of traffic. |
| Hosting provider | Our virtual private server (VPS) provider | Hosting the website, database and backups. |
| E-mail service provider | Our e-mail infrastructure provider | Delivering transactional e-mails, verification codes and correspondence. |
| Internal notification service | Telegram | Instantly notifying the relevant team members of new requests (with a minimal request summary). |
| Banks | The banks through which you pay or receive refunds | Collecting bank transfers and processing refunds. |
| Advisers and auditors | Legal, accounting and audit service providers | Meeting legal and financial obligations and protecting rights, subject to confidentiality duties. |
| Competent public authorities | Courts, the Revenue Administration, the Ministry of Trade, the Personal Data Protection Authority and other competent authorities | Complying with legal requests and obligations. |
Some of our blog content may be prepared with the help of the Google Gemini AI model. No personal data is sent to Google Gemini for this purpose; only topics and general content instructions are provided to the model.
If you contact us by phone or through an instant messaging application (e.g. WhatsApp), the provider of that application may process your data under its own privacy terms.
International transfers
Depending on the infrastructure of our service providers, your personal data may be processed on servers located in Turkey and/or abroad. In particular, Google, Meta, Yandex, Cloudflare and Telegram, and — depending on their infrastructure — our e-mail and hosting providers, may process data on servers outside Turkey.
International transfers are carried out in accordance with Article 9 KVKK (as amended by Law No. 7499) and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. Accordingly, where one of the conditions in Article 5 or 6 is met, a transfer is based primarily on an adequacy decision issued by the Personal Data Protection Board for the destination country; in the absence of an adequacy decision, on one of the appropriate safeguards, such as the standard contract announced by the Board (notified to the Personal Data Protection Authority within five business days of signature), binding corporate rules, or a written undertaking approved by the Board. Where none of these mechanisms can be applied, a transfer is made only on an occasional basis and in reliance on one of the exceptions in Article 9(6) KVKK (for example, your explicit consent after being informed of the possible risks, or where the transfer is necessary for the performance of a contract with you).
7. Retention Periods
We retain personal data for as long as necessary for the purpose for which it is processed and for the periods required by law. The main retention periods are:
| Data / process | Retention period |
|---|---|
| Contact, demo and quote requests (lead records) | 2 years from the last contact. If the request leads to a contract, the periods for customer records apply. |
| Customer account (membership) data | For as long as the membership continues; after the account is closed, deleted or anonymised in the first periodic destruction cycle (within 6 months at the latest), except for the records below that must be kept. |
| Order, contract, payment, receipt, invoice and accounting records | 10 years from the end of the relevant calendar year (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253 and general limitation periods). |
| Records of acceptance of the pre-contractual information, distance contract and withdrawal exception | 10 years from performance of the contract (without prejudice to minimum statutory periods). |
| Commercial electronic message consent and opt-out records | For as long as the consent is valid and for 3 years after it ends; in case of a dispute, for the relevant limitation period. |
| Proof records of notices, explicit consents and form acknowledgements (text version, date and time, IP address) | For as long as the relevant processing continues and thereafter for the applicable limitation periods (up to 10 years). |
| Security and access logs | 2 years; for records that must be kept under Law No. 5651 and related legislation, the statutory period. |
| One-time verification codes | The code itself only for its short validity period; the verification record for 2 years. |
| Free download records | 2 years. Download records for paid products are kept together with the order records. |
| Technical support correspondence | 3 years from the end of the relevant service; in case of a dispute, for the relevant limitation period. |
| Business contact details | 2 years from the end of the business relationship; correspondence qualifying as commercial books and records, 10 years. |
| Internal notification copies (e-mail, Telegram) | With minimal content and for no more than 6 months. |
| Cookies and browser storage data | The periods stated in the Cookie Policy. |
Personal data whose retention period has expired is deleted, destroyed or anonymised in periodic destruction cycles not exceeding six months, in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Where there is an ongoing dispute, investigation or request from a competent authority, the relevant data may be retained until it is concluded.
8. Your Rights under Article 11 KVKK
By applying to the Company, you have the right to:
- learn whether your personal data is processed;
- request information if your personal data has been processed;
- learn the purpose of the processing and whether the data is used in line with that purpose;
- know the third parties in Turkey or abroad to whom your personal data is transferred;
- request rectification if your personal data is incomplete or inaccurate;
- request erasure or destruction of your personal data under the conditions in Article 7 KVKK;
- request that rectification, erasure and destruction be notified to third parties to whom your data has been transferred;
- object to a result against you arising from the analysis of processed data exclusively by automated systems;
- claim compensation for damage suffered as a result of unlawful processing of your personal data.
Where processing is based on explicit consent, you may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.
9. How to Apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request in Turkish by one of the following methods:
- by a signed written application delivered in person, through a notary public or by registered mail with return receipt to Skyport Rezidans No:1 Ofis 151, Beylikdüzü / İstanbul;
- to the Company’s registered electronic mail (KEP) address, signed with a secure electronic signature or mobile signature;
- by e-mail to info@adtouchlabsturkiye.com from the e-mail address you have previously provided to us and that is registered in our systems.
Your application must include your name, surname and, for written applications, your signature; your Turkish ID number for Turkish citizens, or your nationality and passport number or, if any, ID number for foreign nationals; your residential or business address for notifications; your e-mail address, phone and fax number for notifications, if any; and the subject of your request. Relevant information and documents should be attached. We may ask for additional information to verify your identity.
We will conclude your request free of charge as soon as possible and within 30 days at the latest, depending on its nature. If the process involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your request is rejected, if you find the answer insufficient or if we do not respond in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 KVKK within 30 days of learning of our response and, in any case, within 60 days of your application.
10. Changes
We may update this Privacy Notice to reflect changes in legislation or in our processing activities. The current version is always published on this page, and material changes are announced separately on the website. The date of the last update appears at the top of this notice.
WhatsApp