KVKK Privacy Notice
Last updated: 9 Eylül 2026
Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), we process your personal data as data controller within the scope described below.
1. Data Controller
Artistik Dijital / Mehmet Sancak (Kolay DM brand) İslambey Mah. İslambey Cad. Aydın Apt. No:97 İç Kapı No:5, Eyüpsultan 34050 İstanbul, Türkiye Email: [email protected] · Phone: +90 850 840 4496
2. Personal Data Processed
| Category | Examples |
|---|---|
| Identity | First name, last name |
| Contact | Email address, phone number |
| Customer transaction | Company name, Instagram account, subscription and request records |
| Transaction security | IP address, access logs, cookie records |
| Financial | Invoice details, payment transaction records (card details are not stored) |
| Customer messages | Instagram/WhatsApp conversation content processed to perform the service |
3. Purposes of Processing
- Evaluating and quoting service applications
- Formation and performance of the contract, running subscription processes
- Configuring and training the AI assistant for the specific brand
- Handling customer support requests
- Invoicing and meeting financial obligations
- Ensuring information security and preventing abuse
- Marketing and informational communication, where explicit consent has been given
4. Legal Bases
Your personal data is processed under article 5 of the KVKK on the following legal bases:
- Necessary for the formation or performance of a contract (art. 5/2-c)
- Compliance with a legal obligation (art. 5/2-ç) — for example invoicing
- Legitimate interest (art. 5/2-f) — information security and service quality
- Explicit consent (art. 5/1) — application form and marketing communication
5. Transfer of Personal Data
Your data may be transferred to the following parties, to the extent and only as far as necessary to deliver the service:
| Recipient | Data transferred | Purpose | Outside Türkiye |
|---|---|---|---|
| Meta Platforms Ireland/Inc. | Message and comment content, account identifiers | Receiving and sending messages via Instagram/WhatsApp | Yes |
| OpenAI | Conversation content and brand-specific knowledge base | Generating AI replies | Yes |
| iyzico Ödeme Hizmetleri A.Ş. | Name, email, invoice and payment details | Subscription collection | No |
| Accountants and legal advisers | Invoice and contract records | Meeting legal obligations | No |
| Competent public authorities | Requested records | Upon lawful request | No |
We operate our own server and database infrastructure; your data is not held in a third-party hosting provider's database.
International transfers. Meta and OpenAI are established outside Türkiye. These transfers are made under article 9 of the KVKK, limited to the data required to perform the service, and on condition that the providers do not use it for their own purposes. Using the service necessarily means your Instagram/WhatsApp messages pass through Meta and that the relevant conversation is sent to the model provider in order to generate an AI reply; if you do not want these transfers, the service cannot be used.
6. Method of Collection
Your personal data is collected electronically through the application form on the website, email, telephone, use of the panel, and the integrated messaging platforms.
7. Retention Periods
Your personal data is kept for as long as necessary for the purpose for which it is processed. Concrete periods:
| Data | Retention period |
|---|---|
| Message, conversation and contact (CRM) records | While the account is open; destroyed within 30 days upon a deletion request |
| AI conversation memory | While the account is open; destroyed within 30 days upon a deletion request |
| Access tokens (Instagram/WhatsApp) | Until the connection is removed; destroyed immediately on removal |
| System error and webhook diagnostic records | 60 days (pruned automatically) |
| Invoice, payment and subscription records | 10 years (Turkish Tax Procedure Law, Turkish Commercial Code) |
| Deletion request record (confirmation code + dates) | Indefinitely, as evidence that the request was fulfilled |
At the end of the period, data is deleted, destroyed or anonymised. For details of the deletion process see the Data Deletion page.
8. Your Rights as a Data Subject (KVKK art. 11)
By applying to the data controller you have the right to:
- Learn whether your personal data is being processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether the data is used in line with that purpose,
- Know the third parties, in Türkiye or abroad, to whom the data is transferred,
- Request correction if it has been processed incompletely or inaccurately,
- Request its erasure or destruction,
- Request that corrections/erasures be notified to the third parties to whom the data was transferred,
- Object to a result adverse to you arising from analysis carried out exclusively by automated systems,
- Claim compensation for damage suffered due to unlawful processing.
9. How to Apply
To exercise your rights, send your request:
- By email: to [email protected] (from the email address registered in our system),
- By post: İslambey Mah. İslambey Cad. Aydın Apt. No:97 İç Kapı No:5, Eyüpsultan 34050 İstanbul, Türkiye
Your application will be concluded free of charge within 30 (thirty) days at the latest, depending on the nature of the request. If the process incurs an additional cost, the fee set out in the tariff determined by the Board may be charged.
For the detailed deletion process see the Data Deletion page.
10. End-User (Message Sender) Data — Two Separate Roles
Kolay DM processes data in two different capacities, and this distinction determines against whom your rights are exercised:
a) If you are a Kolay DM customer (the business using the panel), we are the data controller for the data described in the sections above. You submit your requests directly to us.
b) If you are a person messaging a business via Instagram/WhatsApp, the data controller for the content of your message is the business you messaged; Kolay DM acts only as a data processor on that business's behalf. In this capacity:
- We do not use your data for our own purposes and do not sell it to third parties.
- We process it only on the business's instructions and only as far as needed to perform the service.
- We take the technical and administrative measures required by article 12 of the KVKK (encryption, access isolation, audit logging).
How do you exercise your rights? Submit your erasure, access or rectification request first to the business you were messaging; the business can fulfil it through its panel. You may also write to us directly ([email protected]): we will forward your request to the relevant business and act on its instruction. Stating which business you were messaging helps the request reach the right record.
The data processing obligations between us and businesses are set out in the Data Processing Addendum.