KVKK Information Notice
1. Identity of the Data Controller
Pursuant to Turkish Personal Data Protection Law No. 6698 ("KVKK" or the "Law"), your personal data may be processed by Anadolus Turizm Medya ve Ticaret A.Ş. ("Company"), acting as the data controller. The Company's registered office is located at Küçükbakkalköy Mah. Dudullu Cad. No: 23-25A, Brandium Residence R1 Blok, Kat: 3, Daire: 38, 34750 Ataşehir, İstanbul, Türkiye. Its MERSIS number is 0069-1619-1740-0001, telephone number is +90 (850) 309 80 00, e-mail address is kurumsal@anadolus.com, registered electronic mail address is anadolus@hs01.kep.tr, and website is www.dijitalarena.com.
2. Purpose and Scope of this Notice
This Information Notice applies to website visitors, contact or quotation-form users, prospective and existing clients, client representatives, newsletter subscribers, campaign and event participants, social media users, representatives of suppliers and business partners, and other natural persons whose personal data are processed through the Company's digital media, advertising, communications, sales, and marketing activities. Separate information notices may apply to employees, job applicants, and specific client projects.
3. Principles Applicable to Personal Data Processing
Your personal data are processed lawfully and fairly; accurately and, where necessary, kept up to date; for specified, explicit, and legitimate purposes; in a manner that is relevant, limited, and proportionate to those purposes; and retained for the period prescribed by applicable legislation or required for the relevant processing purpose. The Company observes the principles of data minimization, transparency, confidentiality, purpose limitation, and accountability throughout its personal data processing activities.
4. Identity, Contact, and Professional Data
Depending on the nature of the processing activity, the Company may process identity, contact, and professional data such as your name, surname, position, professional title, employer, industry, telephone number, e-mail address, postal address, communication preferences, signature, and other information that may be required, without being limited to the foregoing. Any additional information processed under this provision is limited to data that are relevant, necessary, and proportionate to the applicable processing purpose. Turkish identity numbers, passport details, or identity-document information are processed only where necessary to comply with a statutory obligation, establish or perform a contract, or establish, exercise, or protect a legal right.
5. Client Transaction, Contractual, Financial, and Legal Data
The Company may process quotation requests, orders, contracts, project and campaign records, meeting notes, client requests, approvals, revisions, delivery records, support requests, complaints, invoices, payments, collections, bank-account information, reconciliation records, and dispute files. Where online payment services are provided, payment-card information may be processed by the relevant bank or payment-service provider under its own legal obligations. The Company may receive only limited information concerning the transaction result and payment status.
6. Digital Transaction, Traffic, and Security Data
The Company may process IP addresses, device types, browser and operating-system information, session and traffic records, access dates and times, visited pages, referring websites, form-transaction records, error records, and security logs. Depending on the technologies used and user preferences, device identifiers, advertising identifiers, and online-engagement data may also be processed.
7. Marketing, Advertising, and Engagement Data
The Company may process marketing and commercial-communication preferences, newsletter subscriptions, campaign participation, advertisement impressions and clicks, form conversions, e-mail openings, link clicks, service interests, audience segments, and campaign-performance information. Such data may be used for personalization, audience analysis, advertising optimization, conversion measurement, and retargeting only where an applicable personal data processing condition exists and the required user preferences have been obtained.
8. Social Media and Audiovisual Data
When you interact with social media accounts managed by the Company, your username, public profile details, messages, comments, likes, shares, and other interaction data may be processed. Photographs, videos, voice recordings, interviews, client statements, and testimonial materials are processed only after the required information has been provided and an appropriate legal basis has been identified. Where explicit consent is required for promotional publication, content is published only after valid explicit consent has been obtained.
9. Methods and Sources of Personal Data Collection
Your personal data may be collected through the website, contact and quotation forms, e-mail, telephone, online meetings, messaging applications, social media accounts, advertising lead forms, event registrations, contracts, invoices, customer-relationship management systems, cookies, pixels, tags, analytics tools, and information-security systems. Data may be collected wholly or partly by automated means or by non-automated means, provided that the processing forms part of a data filing system.
10. Purposes of Processing Personal Data
Your personal data may be processed to respond to communications; assess requirements; arrange meetings; prepare quotations; conduct pre-contractual procedures; establish and perform contracts; provide digital media and marketing services; manage projects and campaigns; maintain client relationships; provide after-sales support; conduct financial and accounting processes; improve service quality; ensure information security; comply with statutory obligations; and establish, exercise, or protect legal rights.
11. Legal Bases for Processing
Depending on the specific processing activity, your personal data may be processed on the basis of your explicit consent; an express provision of law; necessity for the establishment or performance of a contract; necessity for the Company to comply with a legal obligation; data made public by you; necessity for the establishment, exercise, or protection of a right; or necessity for the Company's legitimate interests, provided that your fundamental rights and freedoms are not prejudiced. The appropriate legal basis is determined separately for each processing purpose.
12. Separation of the Obligation to Inform and Explicit Consent
The fulfilment of the obligation to inform and obtaining explicit consent are separate processes. The obligation to inform applies irrespective of whether the processing relies on explicit consent or another processing condition under the Law. Where explicit consent is required, it is obtained through a separate statement that is specific, informed, and freely given. Continuing to browse the website, continuing a communication, requesting information, or failing to respond to a message does not, by itself, constitute valid explicit consent.
13. Commercial Electronic Communications
Commercial electronic communications relating to campaigns, advertising, promotions, newsletters, events, or similar activities are sent in accordance with Law No. 6563 on the Regulation of Electronic Commerce, the applicable secondary legislation, and the Message Management System ("İYS") requirements. Except where a statutory exception applies, the required commercial-communication approval is obtained. Commercial-communication approval and the personal data processing condition required under the KVKK are assessed separately. Recipients may change their preferences through an easy and free method, and communications through the relevant channel are discontinued within the period prescribed by applicable legislation following receipt of a refusal request.
14. Cookies and Similar Technologies
The website may use strictly necessary cookies and, depending on your preferences, functional, performance, analytics, and advertising cookies, pixels, and similar technologies. Cookies requiring explicit consent are not activated before the user makes an active affirmative choice. Users are provided with the ability to accept, reject, or manage cookies by category. The name, provider, purpose, type, retention period, and international-transfer status of the cookies used are explained in the Privacy and Cookie Policy.
15. Domestic Transfers of Personal Data
Where necessary for the relevant processing purposes and where a processing condition under Article 5 or Article 6 of the Law exists, your personal data may be transferred in a limited and proportionate manner to competent public authorities, courts, legal and financial advisers, auditors, banks, payment institutions, suppliers, subcontractors, hosting, software, CRM, e-mail and communications providers, advertising and analytics providers, production partners, and other business partners. Transfers may be made for service delivery, operation of technical infrastructure, payment and accounting processes, campaign management, compliance with legal obligations, and protection of legal rights.
16. Transfers of Personal Data Abroad
Where cloud, hosting, e-mail, social media, advertising, analytics, software, or communications services are provided by recipients located abroad, your personal data may be transferred abroad. Such transfers are carried out where a processing condition under Article 5 or Article 6 of the Law exists and on the basis of an adequacy decision or an appropriate safeguard, such as a standard contract, binding corporate rules, or a written undertaking authorized by the Personal Data Protection Board. Where neither an adequacy decision nor an appropriate safeguard is available, the incidental-transfer circumstances provided by the Law may be relied upon only for exceptional and non-continuous transfers. Regular cloud, advertising, or analytics transfers are not treated as incidental transfers.
17. Data-Controller and Data-Processor Roles in Client Projects
The Company acts as the data controller for its own website, communications, sales, marketing, and client-management activities. When providing social media account management, advertising campaigns, CRM, lead-form management, e-mail distribution, analytics, or reporting services on behalf of a client, the Company may act as a data processor or an independent data controller, depending on the purposes and means of the specific processing operation. The applicable role is determined by the relevant contracts, the client's documented instructions, and the actual processing activities.
18. Personal Data Obtained from Third Parties
Obtaining personal data through referrals, recommendations, client introductions, business partners, social media platforms, or other third parties does not, by itself, provide a legal basis for using such data for advertising or marketing. The source, purpose, and legal basis of processing are assessed separately for each activity. Where data cannot be obtained directly from the data subject because of factual impossibility or inability to reach the person, the information obligation is fulfilled within a reasonable period, at the first communication if the data are used to contact the person, or no later than the first transfer.
19. Special Categories of Personal Data
The Company does not ordinarily request special categories of personal data in connection with its digital media and marketing activities. Where such data are voluntarily submitted through a form, message, file, photograph, or similar channel, the Company assesses whether processing is necessary and lawful. Special categories of personal data are processed only where one of the conditions set out in Article 6 of the Law exists and the adequate measures determined by the Personal Data Protection Board are implemented. Data for which no legal processing condition exists, or which are not necessary for the service, are erased or destroyed.
20. Profiling and Automated Analysis
Statistical segments or audience groups may be created from visit, engagement, and conversion data through advertising and analytics tools. Such activities are carried out only where an appropriate legal processing condition exists and in accordance with the user's cookie and marketing preferences. Unless an additional appropriate legal basis exists, the Company does not make decisions producing legal or similarly significant adverse effects on a data subject solely through automated processing.
21. Retention and Disposal of Personal Data
Personal data are retained for the periods prescribed by applicable legislation or required for the relevant processing purpose. Contractual, tax, accounting, commercial, consumer-protection, electronic-communications, evidentiary, and limitation-period obligations are considered when determining retention periods. Where all conditions requiring processing cease to exist, personal data are erased, destroyed, or anonymized ex officio or upon a valid request, in accordance with applicable legislation and the Company's retention and disposal procedures.
22. Personal Data Security and Data Breaches
The Company implements risk-based technical and organizational measures to prevent unlawful processing of or access to personal data and to ensure their secure retention. Such measures may include access controls, authorization management, strong-password requirements, multi-factor authentication, logging, backups, updates, encryption, security testing, staff training, confidentiality obligations, supplier controls, and incident-response procedures. Where the Company becomes aware that processed personal data have been unlawfully obtained by third parties, the breach is notified to the Personal Data Protection Board without undue delay and no later than seventy-two hours, and affected data subjects are informed within the shortest reasonable period after they have been identified.
23. Rights of the Data Subject
Under Article 11 of the Law, you have the right to learn whether your personal data are processed; request information concerning processing; learn the purposes of processing and whether the data are used in accordance with those purposes; know the third parties to whom the data are transferred in Türkiye or abroad; request rectification of incomplete or inaccurate data; request erasure or destruction where the statutory conditions are met; request notification of rectification and disposal operations to the third parties to whom the data have been transferred; object to an adverse result arising from analysis conducted solely through automated systems; and claim compensation where you suffer damage due to unlawful processing.
24. Application to the Data Controller
Applications under the Law must be submitted in Turkish. You may submit your application by delivering a written and signed application to Anadolus Turizm Medya ve Ticaret A.Ş., Küçükbakkalköy Mah. Dudullu Cad. No: 23-25A, Brandium Residence R1 Blok, Kat: 3, Daire: 38, 34750 Ataşehir, İstanbul, Türkiye; through the registered electronic mail address anadolus@hs01.kep.tr; by using a secure electronic signature or mobile signature; or from an e-mail address previously registered in the Company's systems to kurumsal@anadolus.com. The application must include your name, surname, signature for written applications, Turkish identity number for Turkish citizens, passport number or foreign identity number for foreign applicants, an address suitable for notification, available e-mail and telephone details, the subject of the request, and supporting information and documents.
25. Responses, Complaints, Amendments, and Prevailing Language
Applications are concluded as soon as possible and no later than thirty days, depending on the nature of the request, and are generally processed free of charge. Where additional costs arise, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board. If an application is rejected, the response is considered insufficient, or no response is provided within the prescribed period, the data subject may lodge a complaint with the Board within thirty days of learning the response and, in any event, within sixty days of the application date. This Notice may be amended following changes in legislation, Board decisions, or the Company's personal data processing activities. Effective date: 01.08.2026 — Version: 1.0. This English version is provided for information purposes; in the event of inconsistency or difference in interpretation, the Turkish version shall prevail.