Privacy Policy

Last updated: 27.09.2026

At ADTOUCH LABS TÜRKİYE BİLGİ TEKNOLOJİLERİ TİC. LTD. ŞTİ. (“AdTouch Labs” or the “Company”), we regard the confidentiality of the information entrusted to us as a core responsibility when providing enterprise AI software, ready-made website templates, digital marketing and technical support services. This Privacy Policy explains our approach to privacy, the security measures we take and our general principles in relation to the adtouchlabsturkiye.com website and our services. The statutory notice on the processing of personal data is set out in our Privacy Notice (KVKK), and details of our use of cookies in our Cookie Policy; this policy applies together with those documents. The Turkish version of this policy is the legally binding version.

1. Our Core Principles

• Lawfulness and fairness: We process personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and related legislation.
• Data minimisation: We collect only the data necessary for specific, explicit and legitimate purposes, and keep mandatory form fields to a minimum.
• Purpose limitation: We do not use data for purposes other than those for which it was collected, and we do not sell it.
• Transparency: We clearly state what data we process and why, with whom we share it and how long we keep it.
• Respect for your choices: Analytics and marketing cookies and commercial electronic messages are used only with your consent, which you may withdraw at any time.

2. What Information We Collect

In summary, we process the information you send us through forms (name, surname, company, e-mail, phone, product of interest and your message), customer account and order details, billing and payment result information, technical information generated while you use the website (IP address, browser information, access logs) and, if you consent, information obtained through analytics and marketing cookies. To evidence your submissions, we record the page, date and time, IP address, browser information and the version of the text you accepted. For the full list, purposes, legal bases and retention periods, please see our Privacy Notice (KVKK).

Your card details are processed directly by the licensed payment institution iyzico during payment; the Company never sees or stores your card number, expiry date or security code.

3. Artificial Intelligence and Your Data

• Website content: Some of our blog content may be prepared with the help of the Google Gemini AI model under editorial control. No personal data is sent to the model in this process.
• Our enterprise products: For data processed in our AdTouch Legal, NeuroAds, StayPanel, Meditouch, Belediye Yapay Zekâ (Municipal AI) and BrainCommerce products by the organisations using them, the organisation is the data controller and the Company is the data processor. Such data is processed only on the organisation’s instructions and for providing the service, under the service agreement and data processing agreement with that organisation, and, unless the contract expressly provides otherwise, is not used to train general-purpose AI models.
• Automated decisions: No decision based solely on automated processing that produces legal effects is made about visitors or applicants on our website.

4. Information Security Measures

In accordance with Article 12 KVKK, we take administrative and technical measures to ensure an appropriate level of security to prevent unlawful processing of and access to personal data and to safeguard it. Our main measures include:

Technical measures

• Encryption in transit: All traffic between you and the website is encrypted with TLS (HTTPS).
• Encryption at rest: Sensitive fields and secret keys are stored encrypted on the server using current encryption algorithms; user passwords are stored irreversibly using strong one-way hashing algorithms.
• Access control: Access to the administration panel is restricted on a role and permission basis under the need-to-know principle.
• Two-factor authentication: Two-factor authentication (2FA) is applied for staff accessing the administration panel.
• Logging and monitoring: Administrative actions and security events are logged and regularly monitored.
• Attack protection: We use measures such as content delivery network and firewall services, bot protection (Cloudflare Turnstile), rate limiting, cross-site request forgery (CSRF) protection and a content security policy (CSP).
• One-time codes: SMS and e-mail verification codes are valid for a short time and the number of attempts is limited.
• Backups and updates: Data is backed up regularly, and software and server components are kept up to date with security patches.

Administrative measures

• Employees with access to personal data are bound by confidentiality obligations and receive periodic training.
• Agreements containing data security obligations are concluded with service providers.
• Internal notifications contain only the minimum necessary information.
• Data whose retention period has expired is deleted, destroyed or anonymised through periodic destruction processes.

No method of transmission or storage is completely secure. If personal data is nevertheless obtained by others through unlawful means, we will notify the data subjects concerned and the Personal Data Protection Board as soon as possible in accordance with Article 12(5) KVKK.

5. Your Account Security

We recommend that you use a strong, unique password for your customer account, never share it, and never pass SMS verification codes on to anyone. Company staff will never ask you for your password or verification code. If you notice any unauthorised activity on your account, please report it immediately to info@adtouchlabsturkiye.com.

6. Sharing and International Transfers

We do not sell your personal data. Your data is shared only as necessary with the payment (iyzico), e-invoicing (Paraşüt), SMS (Netgsm), infrastructure and security (Cloudflare), analytics and advertising (Google, Meta, Yandex; only with your consent), internal notification (Telegram), e-mail and hosting service providers we work with to provide our services, and with legally authorised authorities. Depending on these providers’ infrastructure, your data may be processed on servers in Turkey and/or abroad; international transfers are carried out under the mechanisms in Article 9 KVKK. For details, please see our Privacy Notice (KVKK).

7. Children’s Privacy

Our website and services are intended for businesses and persons aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you become aware that a person under 18 has sent us information, please let us know and we will delete it promptly.

8. Third-Party Links

Our website may contain links to websites of our partners, social media platforms or other third parties. The Company is not responsible for the privacy practices of those websites; we recommend that you review the privacy policy of every site you visit.

9. Your Rights

Under Article 11 KVKK you have rights such as requesting information about, rectification or erasure of, and objecting to the processing of your personal data. How to apply is explained in our Privacy Notice (KVKK). You can stop marketing messages at any time free of charge.

10. Changes

We may update this policy to reflect changes in our services or legislation. The current version is always published on this page and the date at the top is updated. We will announce material changes separately on the website.

11. Contact

• Legal name: ADTOUCH LABS TÜRKİYE BİLGİ TEKNOLOJİLERİ TİC. LTD. ŞTİ.
• Address: Skyport Rezidans No:1 Ofis 151, Beylikdüzü / İstanbul
• E-mail: info@adtouchlabsturkiye.com
• Phone: +90 850 303 10 81