Privacy Notice
This page is provided in English. The Turkish version is the authoritative text.
This text is provided in English for convenience; the Turkish version is the authoritative one.
This notice explains, in line with Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Obligation to Inform, how your personal data is processed when you visit agarajans.com and when you contact us.
1. Data controller
- Erdem Ulutaş (natural person), Agara Ajans
- E-mail: [email protected]
2. What we process, why, and on what legal basis
Your personal data is processed only for the purposes listed below, proportionately and in line with the principles in KVKK Art. 4. It is collected wholly or partly by automated means (web server, forms, cookies) or through channels you use to write to us directly.
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Website access logs | IP address, date and time, requested page, referrer, browser/device information | Information security, abuse detection, troubleshooting, aggregate visit statistics | KVKK Art. 5(2)(ç) (compliance with a legal obligation); KVKK Art. 5(2)(f) (legitimate interest, provided it does not harm your fundamental rights) | 1 year. Panel statistics do not keep IP addresses, only a one-way hash for 180 days. |
| Contact form | Name, phone and/or e-mail, subject, the content of your message | Replying to your request, preparing a quote or appointment you asked for | KVKK Art. 5(2)(c) (necessary for entering into or performing a contract); KVKK Art. 5(2)(f) (legitimate interest, provided it does not harm your fundamental rights) | 1 year from submission; if it leads to a contract, together with contract records as below |
| Direct contact | When you contact us by e-mail: name, phone number/e-mail address, message content | Answering your question, quotes and order discussions | KVKK Art. 5(2)(c) (necessary for entering into or performing a contract); KVKK Art. 5(2)(f) (legitimate interest, provided it does not harm your fundamental rights) | 1 year after the conversation ends; with order records if an order is placed |
| Clients and business relations | Name and contact details of clients and their representatives, billing details, project correspondence, contract and payment records | Entering into and performing service contracts, invoicing, statutory bookkeeping | KVKK Art. 5(2)(c) (necessary for entering into or performing a contract); KVKK Art. 5(2)(ç) (compliance with a legal obligation); KVKK Art. 5(2)(e) (establishment, exercise or defence of a right) | During the contract and 10 years after it ends (Tax Procedure Law Art. 253, Commercial Code Art. 82) |
| Admin panel accounts | Username, password hash (the password itself is not stored), session and login records, IP address, audit log of actions | Account security, preventing unauthorised access, traceability of changes | KVKK Art. 5(2)(c) (necessary for entering into or performing a contract); KVKK Art. 5(2)(f) (legitimate interest, provided it does not harm your fundamental rights) | Failed login attempts 7 days, audit log 2 years, account data until the account is closed |
Access to Google and Meta advertising accounts
Clients who use our advertising management service may grant read-only OAuth access to their own Google Ads and Meta (Facebook/Instagram) ad accounts. With this access we read ad account data such as campaign names, budgets, spend and performance metrics (impressions, clicks, conversions) and use it only to prepare reports for that client. Access tokens are stored encrypted on our server and are not shared with third parties, sold, used for ad targeting or used to train AI models. Clients can revoke access at any time from their Google Account "Third-party access" page or the Meta "Business Integrations" settings; tokens and cached report data of revoked or ended accounts are deleted within 30 days.
Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Where we host and manage websites for our clients, the client is the data controller for the visitor data of those sites; we act only as a data processor on the client's instructions. The privacy notices of those sites apply.
3. Who we share data with
We do not sell your personal data or give it to others for marketing. It is shared only with the following providers and in the following cases:
- Hosting: The site and its database run on a rented server located in Türkiye (Istanbul).
- Cloudflare, Inc. (USA): provides DNS, content delivery and attack protection. Every request to this site, including your IP address and anything you submit in forms, passes through Cloudflare's network, so your data is transferred abroad (KVKK Art. 9).
- Competent public authorities: only where required by law and to the extent requested (KVKK Art. 8(2)(a), 5(2)(ç)).
- Accountant: invoices and accounting records, for statutory obligations (KVKK Art. 5(2)(ç)).
4. Retention and deletion
Data is deleted or anonymised automatically at the end of the periods in the table. Server backups are encrypted and rotated on their own cycle; a deleted record disappears from backups once that cycle completes. Records may be kept longer while a legal dispute or official request is pending.
5. Security
The site only works over an encrypted connection (HTTPS). Access to the admin panel is protected by passwords and session security, admin actions are logged, access to backups is restricted and off-site backups are encrypted. In case of a data breach, the Board and affected persons are notified under KVKK Art. 12.
We do not send you commercial electronic messages (SMS, e-mail, calls) without your consent (Law No. 6563).
6. Your rights
Under KVKK Art. 11 you may apply to the controller to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether data is used in line with it,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction under KVKK Art. 7,
- request that corrections and deletions be notified to the third parties the data was transferred to,
- object to a result against you arising exclusively from automated analysis,
- claim compensation for damage caused by unlawful processing
How to apply
Under the Communiqué on Applications to the Data Controller you can submit your application signed with a secure electronic or mobile signature, or from an e-mail address you previously gave us and that is in our records, to [email protected]. It must include your name, your signature for written applications, your Turkish ID number (for foreigners: nationality and passport/ID number), your address for notifications, your e-mail and phone if any, and the subject of your request.
Applications are concluded within 30 days, free of charge as a rule. We may ask for additional information to verify your identity. If you find the answer insufficient or receive no answer in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application (KVKK Art. 14).
7. Cookies
The use of cookies and similar technologies is described in the Cookie Policy.
8. Changes
This notice is updated whenever the processing on the site changes. Last updated: 4 October 2026.