KVKK Disclosure Notice.

// data controllerWho Processes Your Data?

Data Controller	DATA ANALYTICS TEKNOLOJİ REKLAM ANONİM ŞİRKETİ
Mersis No.	0271-1964-6050-0001
Tax Office / No.	Maslak Tax Office · 2711964605
Address	Maslak Mah. Eski Büyükdere Cad. No: 21 İç Kapı No: 1 Sarıyer / İstanbul, Türkiye
KEP	mesut.sefizade@hs01.kep.tr
VERBİS Status	We are not subject to VERBİS registration
Contact	info@d-dat.com

// 01Categories of Personal Data Processed

The following categories of personal data are processed:

Category	Data types
Identity	First name, last name
Contact	Email address, telephone, postal address
Customer transaction	Orders, subscriptions, account transaction logs
Transaction security	Username, password hashes, magic-link records, IP address, log records, cookie records
Finance	Invoice details, payment confirmation data, last 4 digits of card (full card data is not stored by us)
Marketing	Cookies, ad interaction data, campaign response data
Professional / Business info	Company, role, sector
Legal	Data subject applications, contracts, KEP correspondence
Visual and audio	Event photographs (with consent), telephone call recordings (subject to prior notification)

// 02Purposes of Processing

Pursuant to KVKK Art. 4 and Art. 5/6, your personal data is processed for the following purposes:

• Providing services: creating d-lens accounts, ad-account analysis, message sending via d-reach, B2B ad management service
• Formation and performance of contracts: payment collection, billing, subscription management
• Replying to contact-form messages, sales and quotation processes
• Compliance with legal obligations: tax, commercial books, KVKK notifications, court orders
• Carrying out information security processes
• Auditing of company activities, finance and accounting transactions
• Customer relationship management
• Tracking of requests and complaints
• Marketing and promotional activities (only with explicit consent)
• Site analytics and advertising via cookies (only with consent — see Cookie Policy)

// 03Method of Collection

Your data is collected through the following channels, by both automated and non-automated means:

• Website forms (d-dat.com, /en/contact) and product signup pages (lens.d-dat.com, app.d-dat.com)
• Email correspondence
• Telephone calls
• In-person and online meetings (events, demos, sales calls)
• Cookies and similar identifiers (during page visits)
• API integrations (Google, Meta, TikTok, GA4, Shopify and similar platforms, via OAuth authorisation)
• Third-party service providers (payment, email, analytics)
• Social channels (LinkedIn DM, event registrations)

// 04Legal Basis for Processing

Based on KVKK Art. 5 and Art. 6:

Processing purpose	Legal basis
Formation/performance of contract (signup, service delivery, invoicing)	Art. 5/2-c — directly related to the formation or performance of a contract
Billing records, tax, commercial books	Art. 5/2-a — expressly stipulated by law
KEP, court / prosecutor request	Art. 5/2-ç — fulfilling a legal obligation
Reply to contact form, sales call	Art. 5/2-f — legitimate interest (without harming fundamental rights and freedoms)
Information security, log retention	Art. 5/2-f — legitimate interest
Marketing emails, product announcements	Art. 5/1 — explicit consent
Targeting cookies for advertising	Art. 5/1 — explicit consent

// 05Transfers of Personal Data

5.1 Domestic transfer (KVKK Art. 8)

Your personal data may be transferred to:

• Authorised public bodies (judicial authorities, tax office, KVK Authority, prosecution offices) — within the scope of legal obligations
• Companies whose services we use (financial advisor, legal counsel, audit firm, software providers) — within the scope of contract performance and legitimate interest
• Business partners (Meta, Google and certified integration partners) — within the scope of contract performance

5.2 International transfer (KVKK Art. 9)

Parts of our service infrastructure are located abroad. International transfers are made under KVKK Art. 9 with the following safeguards:

• Standard Contract (issued by the KVK Authority, filed with the Authority within 5 working days)
• EU-US Data Privacy Framework certified providers (Google Cloud, AWS, Meta, Microsoft)
• Without your explicit consent, no transfers are made to jurisdictions lacking adequate protection

Service Provider	Purpose	Location	Protection Mechanism
Amazon Web Services EMEA SARL	Cloud infra, database, file storage	Frankfurt · EU	KVKK Std. Contract + EU SCC + DPF
Mailchimp (Intuit Inc.)	Marketing email blasts	USA	KVKK Std. Contract + EU SCC + DPF
Gupshup Inc.	WhatsApp Business infra (BSP)	USA / India	KVKK Std. Contract + EU SCC
Meta Platforms Ireland	WhatsApp Business, Pixel, Marketing API	Ireland / USA	KVKK Std. Contract + EU SCC + DPF
Google LLC	GA4, OAuth, Ads API	USA / Ireland	KVKK Std. Contract + EU SCC + DPF
LinkedIn Ireland	Insight Tag, Marketing API	Ireland / USA	KVKK Std. Contract + EU SCC + DPF
TikTok	Marketing API	EU / Singapore	KVKK Std. Contract + EU SCC

Domestic transfer: PayTR Ödeme ve Elektronik Para Hizmetleri A.Ş. is used for payment processing. PayTR is established in Türkiye and licensed by BDDK — this transfer is domestic and falls under KVKK Art. 8, not Art. 9.

// 06Data Subject Rights (KVKK Art. 11)

Under KVKK Article 11 you have the following rights:

1. Learn whether your personal data is being processed,
2. Request information about it if it is,
3. Learn the purpose of processing and whether the data is used in line with that purpose,
4. Know the third parties to whom data is transferred domestically or abroad,
5. Request correction in case of incomplete or incorrect processing,
6. Request deletion or destruction within the conditions of KVKK Art. 7,
7. Request that the correction/deletion be communicated to third parties,
8. Object to outcomes adverse to you resulting from analysis solely by automated systems,
9. Claim compensation if you suffer damage due to unlawful processing.

How to apply

• Email: info@d-dat.com (from your registered address)
• Written: Maslak Mah. Eski Büyükdere Cad. No: 21 İç Kapı No: 1 Sarıyer / İstanbul, Türkiye — with identity verification
• KEP: mesut.sefizade@hs01.kep.tr
• Application form: /en/data-request

As Data Controller we respond to your application free of charge within 30 days. If the request entails additional cost, the fee schedule set by the KVK Authority may apply.

// 07Retention Period

Personal data is stored for the period required by the processing purpose and in line with the minimum periods stipulated by legislation. For a detailed retention table, refer to our Personal Data Retention and Disposal Policy.

Data category	Retention period
Active account data	While account is active + 30 days
Billing / tax	10 years (Tax Procedure Law, Turkish Commercial Code)
Contact form records	2 years
Marketing-consent list	Until consent withdrawn
Server log records	6 months
Backups	90-day rotation

At the end of the retention period the data is deleted, destroyed or anonymised.

// 08Cookies

Our website uses cookies and similar technologies. See Cookie Policy for details. Explicit consent for non-essential cookies is collected via the cookie banner.

// 09Changes to This Notice

When this notice is updated it will be announced on our website. You can track the version date at the top of the page.