Privacy Policy

In short

• Unless you allow it, no cookies are set in your browser and no requests go to outside servers.
• We receive details such as your name, phone number and email address only when you fill in a form or write to us directly.
• We do not sell or rent your data, and we do not add it to marketing lists.
• The site has no newsletter, map or social media widget. Advertising measurement runs only if you give separate permission, and it is never used to show you personalized ads.
• We resolve every request about your data within thirty days at the latest.

1. Who we are

This policy explains what happens when you visit ecegunesagency.com.tr and use its forms, and how we process personal data. The site belongs to Ece Güneş Agency, based in Bursa, Türkiye. The data controller is Ecehan Özün Güneş Durna (Bursa, Türkiye; Osmangazi Tax Office, tax no. 4330630484), who runs the business under the name Ece Güneş Agency. You can reach us at info@ecegunesagency.com.tr, on +90 532 600 13 13 or through our contact page.

We prepared this policy to inform you under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”). It is for information only; you do not need to accept it. Cookies and browser storage are explained in detail in our Cookie Policy.

2. Who this policy covers

• Site visitors: people who visit ecegunesagency.com.tr.
• People who contact us: people who fill in the forms on the site, or write to us by phone, email, WhatsApp or through our social media accounts.
• Clients: owners, representatives and employees of the businesses we provide services to.
• Suppliers and business partners: freelancers we work with and representatives of the companies we receive services from.

3. What data we collect and how

Forms on the site

When you fill in one of the contact forms on our site, we receive your name, email address, phone number, brand or company name, how you would like us to contact you, the service you are interested in, the package you are interested in and anything you share in your message. We collect this data only when you send it voluntarily; you can leave the fields that are not required empty.

The page where you filled in the form and the page you came to the site from (for example, a blog post, a search engine or Instagram) are also added to your request. We keep this information with your request, only to understand where the request came from.

Server and security logs

Our hosting provider keeps server logs to detect security issues and faults; these logs may include your IP address and browser information. We also keep the security records needed to protect the site against misuse, only for that purpose and only for a short time.

Visit statistics and advertising measurement

When you first open the site, a banner appears at the bottom and asks for two separate permissions. Both start switched off:

• Analytics. If you allow it, we use Google Analytics to count which pages are read.
• Advertising measurement. If you allow it, we use Google Ads to count whether someone who clicked one of our ads ended up contacting us. To do this we store the click number from the ad address in your browser. That is all we measure; we do not use it to show you personalized ads or to add you to an advertising list.

If you choose “Reject”, or simply keep browsing without touching the banner, nothing is loaded. We do not embed the tags page by page: when you give permission, Google Tag Manager loads and only the measurement you allowed runs. Our Cookie Policy lists each cookie that is set, how long it lasts and how we restrict both tools.

Change your cookie preference

Summary by group

We do not ask for or process special categories of personal data (such as health, religion, ethnic origin or biometric data). Please do not share them in your messages either. If we notice that such data has been sent to us, we delete it.

4. Outside connections you start

Fonts, images and scripts are served from our own server. A connection to an outside service is made only when you take an action:

• Playing a video. The videos on our work pages are hosted on YouTube. No request goes to YouTube until you press the play button. When you do, the video loads from YouTube’s privacy-enhanced mode player (youtube-nocookie.com), and from that point Google’s own privacy rules apply.
• Writing to us on WhatsApp. When you press the WhatsApp button, you are taken to WhatsApp; the conversation there is subject to the rules of WhatsApp (Meta).
• Our social media accounts. The Instagram, LinkedIn, Facebook and YouTube links in the footer take you to those platforms; what you do there is subject to each platform’s rules.

5. Why we process your data and on what legal basis

6. Who we share your data with

We do not sell or rent your personal data. We share it with the following parties only as far as the purposes above require:

• Authorized public institutions and bodies: in cases set out by law and when requested, to meet our legal obligations.
• Accounting and financial advisory service providers, and banks: for billing, payment and tax obligations.
• Our payment provider (PayTR): if you choose to pay by credit card, the payment is taken through a payment link we send via PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş., a licensed payment institution in Türkiye. You enter your card details on PayTR’s payment page; your full card number and security code never reach us. The amount, date and result of the payment are kept as an accounting record.
• Freelancers we work with: to deliver the service, limited to the information their task requires.
• Our hosting provider (Hostinger): because the site and its database run on this service and site emails are sent through it.
• Google: our business email service (Google Workspace), which also receives form notifications; and, only if you have allowed it, Google Analytics, Google Ads conversion measurement and Google Tag Manager, which brings those two tags to the site.
• Meta (WhatsApp, Instagram, Facebook): when you write to us through these channels and when we manage our clients’ accounts on these platforms.

International transfers

These providers’ servers are outside Türkiye: the server hosting our site is in the United Kingdom, and Google’s and Meta’s servers are in various countries, mainly the United States. When we use these services, your personal data is therefore transferred abroad. Google Analytics and Google Ads measurement run only if you allow it in the consent banner; if you don’t, no data about your visit goes to Google.

Where form data is kept and who can access it

When you send a form, your message is kept in two places: it reaches us by email, and it is stored as a record in the site’s own database. Email notifications go only to our business email address, which runs on Google Workspace. Only the authorized administrator account can access the database record.

7. Data we process on behalf of our clients

In the social media, advertising and design work we do for clients, we may come across personal data that belongs to the client (for example, images of people who appear in content, or data in the client’s ad account). The client is the data controller for this data. We process it only on the client’s instructions and only as far as the service requires. For requests about this data, please contact the brand concerned first.

8. How long we keep your data

• Forms and contact requests: if no service relationship is established, up to two years from the date your request reached us. If a service relationship is established, the data is kept for the retention periods set out in the relevant legislation.
• Client and supplier data: for the term of the contract and, after it ends, for the retention periods in tax and commercial legislation and the applicable limitation periods.
• Social media and ad account access details: only for the duration of the service; they are deleted from our records when the work ends. We connect to your accounts through partner access granted in Meta Business Suite, not with your password. When our work together ends, we recommend that you remove that access and, if you ever shared a password, change it.
• Google Analytics records: visitor-level data for up to fourteen months.
• Google Ads conversion records: an ad click can be linked to an enquiry for up to ninety days; after that the click and the enquiry are no longer connected.

When the period ends, the data is deleted, destroyed or anonymized.

9. How we protect your data

We take technical and administrative measures to prevent unauthorized access to your personal data, its loss and its unlawful processing:

• The whole site is served over an encrypted connection (HTTPS).
• Only authorized people can access the data, and administrative access is protected with strong authentication.
• Our software is kept up to date, and we take measures against unauthorized access attempts.

10. Your rights

Under Article 11 of the KVKK, you can apply to us to:

• learn whether your personal data is processed and, if so, request information about it
• learn the purpose of the processing and whether the data is used in line with that purpose
• know the third parties in Türkiye or abroad to whom your data is transferred
• ask for your data to be corrected if it is incomplete or inaccurate
• ask for your data to be deleted or destroyed under the conditions in Article 7 of the KVKK
• ask for any correction, deletion or destruction to be notified to the third parties to whom the data was transferred
• object to a result against you that arises from analysis of your data exclusively by automated systems
• claim compensation if you suffer damage because of unlawful processing

If you are in another jurisdiction, for example the EU/EEA or the UK, you may have similar rights under your local law. You can use the same email address, info@ecegunesagency.com.tr, to exercise them.

11. How to exercise your rights

You can apply by email or in writing, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• By email: write to info@ecegunesagency.com.tr from the email address you have previously given us and that is in our records.
• With an electronic signature: send your application, signed with a secure electronic signature or mobile signature, to info@ecegunesagency.com.tr.
• In writing: sign your application by hand and send it by post. You can get our postal address by writing to info@ecegunesagency.com.tr or calling +90 532 600 13 13.

Your application should include:

• your name and, for written applications, your signature
• for citizens of Türkiye, your Turkish national ID number; for foreign nationals, your nationality and passport number or, if you have one, your ID number
• your residential or business address for official notices
• if available, an email address and phone number for notifications
• the subject of your request and any related information and documents

You do not have to use a form; a letter with this information is enough. A printable application form in Turkish is available at /kvkk-basvuru-formu/ (Turkish only). We may ask for additional information to confirm that the application is yours. Applications made on behalf of someone else require a notarized power of attorney or a document of authority. For a quick question, simply write to info@ecegunesagency.com.tr.

How we respond

• We resolve your request as quickly as its nature allows, and within thirty days at the latest.
• As a rule, we do not charge a fee. If the process involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.
• We send our reply in writing or electronically, by the method you chose in your application. If we reject your request, we explain why.

Complaint to the authority

If your application is rejected, you find our answer insufficient, or we do not reply in time, you can file a complaint with the Personal Data Protection Board of the Turkish Personal Data Protection Authority. The complaint must be made within thirty days of learning of our answer, and in any case within sixty days of the date of your application (KVKK Art. 14).

12. Changes to this policy

When the tools we use on the site change, we update this policy the same day. We also update it when our processing activities change. The current version is always published on this page, with the last update date at the top.