KVKK Information Notice

Data controller

Your personal data is processed by raxads as data controller. Our contact details are in the Contact and Imprint section. Email: info@raxads.com.

Personal data processed

We do not process special categories of personal data (such as health, religion, biometric data); we ask that you do not write such information in our forms and messages.

• Site visitor; transaction security: IP address (in transit), irreversible digest of the IP address, browser information.
• Site visitor; tool use: business name and district typed into tools.
• Person who writes to us; identity and contact: full name, phone number, email address, message content.
• Panel user; identity and contact: full name, email address, optional mobile phone.
• Panel user; transaction security: password digest, session records, shortened device information, activity and audit records.
• Panel user; legal transaction: confirmation of reading the information notice and consent records (with time and text version).
• Client business (if a sole proprietorship); client transaction: business name, address, phone, website, services, ad budget; Google Ads account and ad data.
• Person who clicks our client's ad; marketing (measurement): click time and Google ad click ID (gclid) on the tracked WhatsApp link; IP, number and message are not recorded.

Purposes of processing

• Providing the services you request and establishing and performing the contract.
• Running the client panel; reporting ad and map performance.
• Managing Google Ads accounts with the client's approval or within the limits the client sets.
• Responding to requests and complaints, communicating with you.
• Ensuring information security, preventing abuse and fraud.
• Fulfilling legal obligations and proof in possible disputes.
• Only if you give separate consent, sending campaign and news messages.

Legal grounds

We process your personal data on the following grounds in Article 5(2) of the KVKK:

• Being directly related to the establishment or performance of a contract (subparagraph c): panel account, provision of the service, management of the Google Ads account.
• Fulfilment of the data controller's legal obligation (subparagraph ç): obligations under tax and commercial law and Law No. 5651.
• Establishment, exercise or protection of a right (subparagraph e): change log, consent and audit records.
• Our legitimate interest, provided that it does not harm the fundamental rights and freedoms of the data subject (subparagraph f): information security, limiting abuse, improving the service.

Legal grounds: commercial electronic messages

Commercial electronic messages (campaigns, news) are based only on consent you give separately and are not a condition of the service.

Method of collection

Your personal data is collected electronically, partly by automated means, through the forms on our site and client panel, WhatsApp and email correspondence, Google APIs when you link your Google Ads account, and the automatic records of our servers.

Transfer and transfer abroad

Your personal data may be transferred to the following recipients, limited to the purposes above:

• Cloudflare, Inc. (hosting, database, security): running the site and panel; database in the EU jurisdiction; US company, database in the European Union.
• Google LLC: linking and managing the Google Ads account; US.
• Anthropic, PBC: ad suggestions with artificial intelligence; only business and ad data, no personal contact information is sent; US.
• Meta Platforms (WhatsApp): WhatsApp correspondence; US / Ireland.
• Google LLC (Google Workspace): sending verification, password reset and notification emails; US.
• Competent public authorities and institutions: legal obligations; Türkiye.

Transfer abroad: safeguards

Transfer abroad is made under Article 9 of the KVKK: standard contracts determined by the Personal Data Protection Board are signed with our service providers and notified to the Board. In incidental cases where this safeguard is not available, the transfer is based on the explicit consent you give when registering in the panel; you can withdraw your explicit consent at any time, in which case services that depend on service providers abroad may not be provided.

Retention periods

Data whose period has expired is deleted, destroyed or anonymised in a disposal process carried out at least once every 6 months.

• Panel sessions: 30 days after last use.
• IP address digests: 30 days.
• Temporary access token during Google connection: at most 30 minutes.
• Account, business and ad data: for the duration of the contract and the account; deleted or anonymised within 30 days after the account is closed.
• Consent, change and audit records: for the statutory limitation periods; personal fields are anonymised when the account is closed.
• WhatsApp and email correspondence: 12 months; if you become a client, for the duration of the contract.

Your rights

Under Article 11 of the KVKK, you have the right to:

• learn whether your personal data is processed,
• request information about it if it has been processed,
• learn the purpose of processing and whether it is used in line with its purpose,
• know the third parties to whom it is transferred in Türkiye or abroad,
• request correction if it has been processed incompletely or inaccurately,
• request its deletion or destruction within the framework of the conditions in Article 7 of the KVKK,
• request that correction, deletion and destruction be notified to third parties to whom the data has been transferred,
• object to a result against you arising from analysis exclusively by automated systems,
• request compensation for damage if you suffer damage due to unlawful processing.

How to apply

You can send your application regarding your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, from the email address registered in our system to info@raxads.com. What the application must contain and a sample text are on the Data Subject Application page. Your application is answered free of charge within 30 days at the latest; if the process requires an additional cost, the fee in the tariff set by the Board may be charged.