Personal Data Protection Notice (KVKK)
Last updated: 15.10.2026
This English version is provided for information. In case of any conflict, the Turkish version prevails.
Under Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”), Satıcı, acting as data controller, informs you of the purposes for which your personal data are processed, the legal bases relied on, how they are collected, to whom they are transferred, and your rights.
1. Data controller
- Legal name
- —
- Address
- —
- Phone
- —
- —
- Tax office
- —
- Tax / ID number
- —
- MERSIS no.
- —
- Trade registry no.
- —
Not yet provided: Unvan, Adres, Telefon, E-posta, Vergi dairesi, Vergi / TC kimlik no.
2. Whose data
- Users: account holders and team members.
- Visitors: people who visit our website (cookieless, de-identified measurement; additionally Google Analytics for those who consent).
- Applicants: people who contact us through support, contact or newsletter sign-up.
- Our users' customers: order/conversion data transmitted when a user connects their store. For this data the user is the data controller; 14ads acts as a data processor and processes it only on the user's instructions.
3. Categories of data processed, purposes and legal bases
| Data category | Example | Purpose | Legal basis (KVKK Article 5(2)) |
|---|---|---|---|
| Identity | First and last name; Turkish ID or tax number where required for invoicing | Opening an account, establishing the contract, invoicing | (c) necessary for the establishment or performance of a contract; (ç) compliance with a legal obligation |
| Contact | Email, phone, address | Verification, transactional notices, support, invoicing | (c) performance of a contract; (ç) compliance with a legal obligation |
| Customer transaction | Plan, credit movements, campaign and ad settings, support requests | Providing the service, credit and subscription management | (c) performance of a contract; (f) legitimate interest |
| Financial | Payment amount, date, transaction reference (card data excluded) | Payment tracking, accounting, tax | (c) performance of a contract; (ç) compliance with a legal obligation |
| Transaction security | Session, sign-in logs, IP address, audit and error logs, password hash, two-step verification | Information security, abuse prevention, obligations under Law No. 5651 | (ç) compliance with a legal obligation; (f) legitimate interest |
| Connected account data | Ad/social account IDs, access authorizations (encrypted), performance metrics | Running ads, measurement and optimization on your instructions | (c) performance of a contract |
| Images and content | Images/logos you upload, product page content, generated ads | Ad production | (c) performance of a contract |
| Marketing | Newsletter subscription, the channel you arrived from (utm) | Commercial electronic messages, marketing analysis | Explicit consent / consent under Law No. 6563 (newsletter); (f) legitimate interest (channel analysis) |
| Analytics cookie data | Google Analytics cookie ID, pages visited, device/browser information, approximate location | Statistical analysis and improvement of site use | Explicit consent (KVKK Art. 5(1)); given in the cookie banner and can be withdrawn at any time |
Card details are not processed: the card number, expiry date and security code never reach our systems; they are processed directly by a licensed payment institution. Special categories of personal data (KVKK Article 6) are not processed.
4. Method of collection
Your data are collected electronically, by partly or fully automated means, through sign-up and dashboard forms, the support form, email, the publicly available content of pages whose links you provide, the APIs of platforms you connect via OAuth, notifications from payment institutions, and server logs.
5. Transfers
Within Turkey
Where required by law, data may be transferred under KVKK Article 8 to competent public authorities and institutions (tax offices, judicial authorities, the Information and Communication Technologies Authority (BTK), etc.) and to our accounting and legal advisers.
Abroad
A significant share of the providers we use to deliver the service have servers outside Turkey: cloud infrastructure (Google Cloud), AI and media generation providers (Anthropic, OpenAI, Google Gemini, Kling, HeyGen, ElevenLabs), visibility measurement (Perplexity, SerpApi), site statistics if you consented (Google Analytics), a payment institution (Stripe), job queue and email services, and the advertising and social media platforms you connect (Meta, TikTok, Google, OpenAI, LinkedIn). The current list is in our Privacy Policy.
These transfers are made under KVKK Article 9 on the basis of the standard contracts announced by the Board (the Personal Data Protection Board) and their notification to the Board within the period set out in the legislation, and, where a standard contract cannot be concluded, on the basis of the Article 9(6) occasional transfers (in particular, where the transfer is necessary for the performance of our contract with you or for transactions with the platforms you connect at your request). Transfers to the advertising platforms you connect take place on your instructions and within the framework of your contract with that platform.
6. Retention periods
| Data | Period |
|---|---|
| Account, content and connected account data | For as long as the account is open; after a deletion request, deleted/anonymized at the end of a 7-day recovery period |
| Invoice, payment and credit ledger records | 10 years under the Tax Procedure Law and Turkish Commercial Code (linked to an anonymized account) |
| Distance sales records | The period required by the legislation (at least 3 years) |
| Access and security logs | For the period set in the applicable legislation; application error logs 30 days |
| Immutable audit log | Indefinitely, for security and evidentiary purposes; fields containing personal data are anonymized when the account is deleted |
| Cookieless site measurement | 13 months (not linked to an individual) |
| Google Analytics data (with consent) | 14 months; cookies up to 2 years, deleted when consent is withdrawn |
| Support correspondence | For as long as the account is open; deleted when the account is deleted |
| Newsletter subscription | Sent until you unsubscribe; the record of consent and opt-out is kept as evidence as required by law |
At the end of the period, data are deleted, destroyed or anonymized in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.
7. Your rights under KVKK Article 11
By applying to the data controller, you have the right to:
- learn whether your personal data are processed and, if so, request information about it;
- learn the purpose of processing and whether the data are used in line with that purpose;
- know the third parties in Turkey or abroad to whom the data are transferred;
- request correction if the data are incomplete or inaccurate;
- request deletion or destruction within the conditions of KVKK Article 7;
- request that corrections and deletions be notified to the third parties to whom the data were transferred;
- object to a result against you arising from analysis exclusively by automated systems;
- claim compensation if you suffer damage due to unlawful processing.
8. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your application in Turkish, clearly stating your identity and your request,
- in person or through a notary, with a wet-signed petition sent to the address above;
- via registered electronic mail (KEP), a secure electronic signature or a mobile signature;
- from the email address registered in our system, to our support address.
Applications are concluded free of charge within 30 days at the latest; if the action incurs an additional cost, the fee in the tariff set by the Board may be charged. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board. You can also delete your account and data yourself from the dashboard (how?).
9. Data security
Under KVKK Article 12, we take technical and administrative measures including encryption in transit, envelope encryption with KMS for secret keys, role- and scope-based access, mandatory two-step verification for staff, an immutable audit log, rate limiting and abuse prevention, regular backups, and confidentiality obligations with service providers. In the event of a data breach, the Board is notified within 72 hours and affected individuals as soon as reasonably possible.
10. Commercial electronic messages
Transactional emails such as account verification, payment, security and campaign status are part of the Service and do not require consent. Newsletter, campaign and promotional messages are sent only if you give consent under Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communications and Commercial Electronic Messages; you can opt out at any time via the link in each message or by notifying us.