KVKK Disclosure Notice

KVKK Disclosure Notice

This KVKK Disclosure Notice explains the purposes, legal grounds and methods of processing personal data of persons who contact Devasa Media via portal, form, proposal, communication, application, service and business-relationship channels.

Purpose

This text aims to provide transparent, understandable and auditable information on personal-data processing pursuant to Law No. 6698 on the Protection of Personal Data and related secondary legislation.

Devasa Media assesses personal data only for specified, explicit and legitimate purposes, in a manner that is relevant, limited and proportionate to the data processed.

Scope

This text applies to visitors, prospects, clients, suppliers, business partners, job applicants, form users and all data subjects who communicate with Devasa Media through digital or physical channels.

Portal use, proposal requests, contact forms, email correspondence, phone calls, application processes, support requests, project discussions and service relationships fall within this scope.

Definitions

Personal data means any information relating to an identified or identifiable natural person. Processing includes obtaining, recording, storing, updating, transferring, classifying or deleting data.

The data subject is the natural person whose personal data are processed. The data controller is the party that determines the purposes and means of processing.

Personal data processed

Name, surname, company title, role, phone number, email address, website, request content, service preference, budget range, application details, limited invoicing and payment information, transaction-security logs, IP address, and date and time may be processed.

Project documents, brand information, technical-access requests, brief contents and communication notes freely shared by the data subject may also be assessed to the extent the service relationship requires.

Purposes of processing

Personal data are processed to prepare proposals, define service scope, run project communications, manage contract and payment processes, respond to client requests, operate support, assess applications and fulfil legal duties.

Data may also be processed to improve service quality, ensure information security, prevent misuse, resolve disputes, manage commercial-communication permissions and protect Devasa Media’s corporate rights.

Legal grounds

Personal data are processed on legal grounds including explicit provision in law, necessity for concluding or performing a contract, fulfilment of a legal duty, establishment, exercise or protection of a right, legitimate interest, and explicit consent.

For processing subject to explicit consent, the data subject is informed separately. Where explicit consent is not required, processing proceeds on the legal grounds set out in the law.

Rights of the parties

Data subjects have the right to learn whether their personal data are processed, to request information if so, to learn the purpose and whether use matches that purpose, and to know third parties to whom data are transferred in Türkiye or abroad.

Data subjects may also request correction of incomplete or inaccurate data, erasure or destruction where legal conditions are met, notification to third parties to whom data were transferred, objection to adverse outcomes via automated systems, and compensation for damage.

Obligations of the parties

Devasa Media must process personal data lawfully, take necessary organisational and technical measures, reduce unauthorised-access risks, and assess data-subject requests within the periods set by law.

The data subject is responsible for ensuring shared information is accurate, current and does not infringe third-party rights. Where another person’s data are shared, providing the required notices and permissions rests with the data subject.

Service terms and data processing

Given the nature of Devasa Media’s services, only data required by the work are processed in project analysis, design, software, digital marketing, SEO, production and consulting.

If additional processing is required within the project, that need is assessed separately as to scope, security, access and retention.

Prohibited uses

Sharing unlawful third-party data, misleading information, special-category personal data, unauthorised access credentials or content intended for misuse via portal forms or contact channels is prohibited.

Devasa Media reserves the right not to act on unlawful, misleading or security-risk notices, to restrict access, and where necessary to pursue legal remedies.

Intellectual and industrial property

Personal-data processing does not extinguish rights in designs, software, strategy, content, reports, analyses and similar intellectual products created by Devasa Media.

It is assumed the client has authority to use the brand, logo, visuals, texts, documents and data it provides. Liability arising from unauthorised-use claims rests with the party that supplied the content.

Privacy

Personal data and information shared within the project are not disclosed to third parties other than authorised persons required by the work. The confidentiality duty continues for a reasonable period after the service relationship ends.

Cases required by legal duties, competent-authority requests, audit obligations and dispute resolution constitute exceptions to confidentiality.

Transfer and third parties

Personal data may be shared, to the extent the service requires, with authorised team members, hosting and infrastructure providers, software tools, accounting advisers, payment services, legal counsel and competent public authorities.

Where data is shared with third-party providers, data minimisation, limitation of authority and security principles are observed.

Retention and destruction

Personal data are retained for as long as the processing purpose requires, taking into account limitation, retention and proof periods under applicable law.

When the retention ground ceases, data are deleted, destroyed or anonymised. Devasa Media reserves a lawful right of retention where a legal dispute, audit or protection of rights may arise.

Limitation of liability

Devasa Media must take reasonable technical and organisational measures required by law. It is not liable, to the extent it is not at fault, for consequences arising from internet infrastructure, third-party services, user devices or user-caused security breaches.

Devasa Media reserves its legal rights in respect of claims arising from inaccurate, incomplete or unauthorised data shared by the data subject.

Force majeure

Cyberattack, infrastructure outage, natural disaster, war, epidemic, a public-authority decision, power or internet outage, provider failure and events beyond the parties’ reasonable control constitute force majeure.

In force majeure, Devasa Media takes reasonable measures for data security and service continuity, but cannot be held liable for delay or interruption to the extent it is not at fault.

Amendments to this text

Devasa Media may amend this text due to legal changes, its service model, portal infrastructure or updates to processing operations.

The current text takes effect upon publication on the portal. Data subjects are advised to review it at reasonable intervals.

Dispute resolution and entry into force

Turkish law governs disputes arising from this text. Statutory rules on competent authorities and courts remain reserved.

The KVKK Disclosure Notice takes effect on the date of publication on the portal and remains in force for personal-data processing.