Yükleniyor...
Yükleniyor...
Contact Us
For quotes and information
This Privacy Policy is published by the company below, which acts as data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR").
This policy covers three applications:
Effective date and last updated: 17 September 2026.
The permanent address of this policy is https://alisdijital.com/sozlesme/gizlilik-politikasi and its English version is at https://alisdijital.com/en/legal/gizlilik-politikasi. The Turkish text prevails; in case of conflict with this English version, the Turkish text applies.
This Privacy Policy applies to Alis Dijital, including the Alis Dijital customer portal at portal.alisdijital.com, operated by Alis Dijital Reklam Yazilim Ltd. Sti., Gevhernesibe Mah. Gok Gecidi Sk. Finans Plaza No:14 K:3 D:5, Kocasinan / Kayseri, Turkiye, contact: ajans@alisdijital.com.
As a data controller, we determine the purposes and means of processing for data relating to our own visitors, client contacts, job applicants and people requesting appointments or quotes. The whole of this policy applies to that data.
As a data processor, we also process data on our client's instructions and on their behalf: the client's Google Analytics, Search Console and Google Ads data; recipient name, address and phone in e-commerce orders; Meta Lead Ads form responses collected for the client; and recipient lists for WhatsApp, SMS and e-mail messages sent on the client's behalf. For that data our client is the controller, and the terms of processing are set by a data processing agreement concluded with them under KVKK Art. 12/2 and GDPR Art. 28. Please address requests about such data to the company you are a customer of; requests reaching us are forwarded to the relevant controller without delay.
If we detect a breach in data we process as a processor, we notify our client, as controller, without delay.
With your permission, the Alis Dijital customer portal reads reporting data from your Google Analytics 4, Google Search Console and Google Ads accounts on a read-only basis and displays it to you inside the portal. Our use of that data is governed by the Google API Services User Data Policy and its Limited Use requirements.
Alis Dijital's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We limit our use of Google user data to providing or improving user-facing features that are prominent in the application's user interface.
These commitments apply to the raw data obtained from Google API scopes as well as to data aggregated, anonymized, or derived from them.
Policy text: Google API Services User Data Policy.
The portal has a single "Connect with Google" flow; the permissions below are requested together on Google's consent screen, and you can cancel the flow at any point.
| Scope | Data we access | Purpose and where it is displayed | Write access |
|---|---|---|---|
https://www.googleapis.com/auth/analytics.readonly |
The names and IDs of the GA4 properties your account can reach (listed at the moment of connection; only the property you select is stored); and, from the selected property, aggregated reports: sessions and user counts, page/screen views, event name and count, e-commerce purchases and purchase revenue, items purchased and item revenue, date, country/region/city, device category, traffic channel, source and campaign, on-site search term, and new vs. returning breakdown. | Portal > Analytics (visitor funnel, traffic sources, geographic breakdown, insight cards) and Marketing dashboards. | Read-only |
https://www.googleapis.com/auth/webmasters.readonly |
The list of Search Console sites you can access and your permission level; and, for the selected site, search query text, page URLs, and clicks, impressions, CTR and average position broken down by date. | Portal > Analytics > Search Performance report. | Read-only |
https://www.googleapis.com/auth/adwords |
Your Google Ads account list and account name; campaigns, ad groups, ad texts and their statuses; keywords and search terms; geographic and hour-of-day breakdowns; cost, impressions, clicks, conversions and conversion value; and the optimisation recommendations Google generates for your account. | Portal > Marketing (Google Ads) — campaign performance, cost/ROAS tables, search-term analysis and recommendations. Also the operator view in the agency management panel (see section 8). | Google offers no read-only equivalent for this scope, so it technically also grants write access. We run read-only queries only; we never create, modify or pause campaigns, budgets, bids or ads. |
Narrowest-scope principle: for Analytics and Search Console we request Google's read-only scopes and do not request the write-capable analytics.edit or webmasters scopes. The Google Ads API offers no read-only equivalent, so the single available adwords scope must be requested. We access no other Google user data scope such as Gmail, Drive, Google Photos, Google Chat or Google Business Profile, and the portal offers no "Sign in with Google".
https://www.googleapis.com/auth/analytics.readonly — read-only access to your Google Analytics 4 reporting data (sessions, users, traffic sources, conversions), used solely to display analytics dashboards inside the application.
https://www.googleapis.com/auth/webmasters.readonly — read-only access to your Search Console performance data (queries, clicks, impressions, CTR, average position) and property list, used solely to display SEO performance reports inside the application.
https://www.googleapis.com/auth/adwords — access to your Google Ads account data (campaigns, spend, conversions), used solely to display advertising performance reports inside the application. We execute read-only queries and never create or modify campaigns, budgets or ads.
Only you can create the connection. When agency staff switch into your account view for support purposes, the Google connection flow is rejected both at the start and at the callback; staff cannot connect a Google account on your behalf.
A given Google asset (a GA4 property, a Search Console site or a Google Ads account) can be linked to only one client company in our systems. This is enforced both in the application layer and by a uniqueness constraint in the database.
A second access route for Google Analytics: in some legacy or manually configured connections, instead of an OAuth grant we use an agency service account added as a "Viewer" to your property. Data is still read only to be shown to you, but that permission was granted on Google's side in the GA4 interface: disconnecting in the portal does not end it. To remove the service account's access entirely, remove it under GA4 > Admin > Property access management, or write to us.
We do not store report content. Rows returned by Google Analytics, Search Console and Google Ads are never written to our database; we keep no archive table for them. When you open a screen, the data is read from Google at that moment, displayed to you, and no persistent copy is created. For performance, data is held only in server memory: at most 5 minutes on portal screens, at most 10 minutes in the aggregate advertising report of the agency management panel, and 6 hours for technical settings such as a GA4 property's time zone and currency. When that period expires or the server is recycled, the data is gone. All requests to Google are made with no-store caching; no CDN or persistent disk cache is used for this data.
The only thing we store permanently is the connection record: your encrypted access and refresh tokens, the list of permissions granted, the token expiry, the identifier of the asset you selected (GA4 property ID, Search Console site URL, Google Ads customer ID and account name), the names of accessible assets listed at the time of connection, the connection status, the last sync time and the user who created the connection.
Google user data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256. OAuth tokens are never stored or transmitted in plaintext. Access is restricted to authorized personnel on a least-privilege basis.
In practice: because report content is never written to persistent storage, the AES-256-GCM encryption described above applies to the OAuth tokens and connection records we retain.
Two portal features interpret Google data with AI and run only when you initiate them: the "Alis" assistant, which answers when you ask a question, and search-term analysis, which runs when you press the button on the Ads screen. The processing is performed with Google's Gemini API; the data stays within Google's ecosystem, but this is a separate product and a separate processing purpose. This transfer falls under limb (a) of the transfer exceptions in section 9.
What is sent to the model: the aggregate statistics shown on the relevant screen — channel and revenue summaries, funnel and city/region breakdowns, the titles and first rows of insight cards; the top 10 Search Console query texts and the top 10 page URLs (hence your domain) with their clicks, impressions, CTR and position; and the Google Ads account name (or the account number when no account name is set) together with campaign names and performance figures. In assistant conversations, your company name and which data sources are connected are also sent so the commentary is meaningful; for that feature the data is therefore processed in association with your company identity.
What is never sent: your OAuth access and refresh tokens are never sent under any circumstances. In search-term analysis your company name is not sent either; only an industry hint such as "service business" or "e-commerce store" is included, alongside the term texts and their click, cost and conversion figures.
Masking: every tool result read by the Alis assistant passes through an automatic masking layer before reaching the model; fields such as e-mail address, phone number, IBAN and recipient name are stripped. Search query and search term texts are not stripped, because they are the subject of the analysis — they are free text typed into Google by internet users, and Google withholds rare queries before we see them. We cannot guarantee that this filter produces complete results in every case.
Logging: the content sent to the model and the responses returned are not written to our server logs; only the tool name and call duration are recorded. Assistant conversation content is not stored in our database. We use the Gemini API on a paid tier, on which submitted content is not used for model training. You may ask us to disable the AI features for your company entirely.
Google user data obtained through Google APIs is not used to develop, improve, or train non-personalized AI and/or ML models.
We do not transfer, sell, or use Google user data to create, train, or improve any machine learning or artificial intelligence model beyond that specific user's personalized model for the user-facing feature the data was obtained for.
We operate no model training, fine-tuning, tuned-model creation or persistent embedding store of our own; all AI calls are one-off text generation requests.
We do not allow humans to read Google user data, except: (a) with your affirmative agreement to view specific data; (b) where necessary for security purposes, such as investigating a bug or abuse; (c) where required to comply with applicable law; or (d) where the data (including derivations) is aggregated and used for internal operations in accordance with applicable privacy and other jurisdictional legal requirements.
In practice these exceptions mean:
Beyond these cases, no employee reads your Google data. We read only aggregated statistics from Google; no dimension containing person-level identifiers such as user ID, client ID, IP address or e-mail address is ever requested. The only exception is search queries and search terms, which are free text by nature; we use them only for performance analysis, never to build profiles of individuals.
We share Google user data only with the following categories of recipients: (1) our infrastructure and processing sub-processors that host, operate or provide processing functions for the application (named individually below, with their role and processing region); (2) legal or regulatory authorities where required by applicable law; and (3) an acquirer in the event of a merger, acquisition, or sale of assets, subject to your explicit prior consent. We do not share Google user data with any other third party, including our external legal or financial advisers.
| Provider | Role and contact with Google data | Region |
|---|---|---|
| Vercel Inc. | Application hosting and server-side processing. Google data passes through these servers' memory while being rendered for you; technical error logs are held here. | US-based, global infrastructure |
| Turso (libSQL) | Database hosting. Only encrypted OAuth tokens, the granted scope list and your selected asset identifiers. No report content is written. | Outside Turkiye |
| Cloudflare, Inc. (R2) | File storage and nightly database backups. The backup also contains the encrypted OAuth tokens. | Global infrastructure |
| GitHub, Inc. (Microsoft) | The environment in which the nightly backup job runs; the database dump is created there temporarily during transfer. | United States |
| Google LLC (Gemini API) | AI interpretation, only when you ask the assistant a question or press the analysis button (see section 7). | United States / global |
Your Google data goes nowhere else. In particular, our Fly.io background workers, our internal Telegram notifications, our e-mail and SMS providers, the payment institution, and our e-invoice, shipping, marketplace and data-collection/proxy integrations never access Google API data. Google API calls are made only from the application servers on Vercel, within the session context of the requesting user. Sharing with our lawyers and financial advisers also excludes Google user data.
We do not transfer Google user data, except: (a) to provide or improve user-facing features that are visible and prominent in the application's user interface, and only with your consent; (b) for security purposes; (c) to comply with applicable laws; or (d) as part of a merger, acquisition, or sale of assets, after obtaining your explicit prior consent.
You can end our access at any time:
You may revoke our access at any time at https://myaccount.google.com/permissions or by disconnecting the integration in the application. Disconnecting all three Google services in the application deletes the stored OAuth tokens immediately. Upon your deletion request or the closure of your account, all Google user data and OAuth tokens associated with your account are permanently deleted from our production systems within 30 days, and from our encrypted backups when the backup rotation that contains them completes.
In practice deletion is faster: when you disconnect in the portal, the record is removed immediately. Nightly backups of our database are destroyed on a rolling basis, so a deleted record may persist in backup copies until that rotation completes; backups are held in a private, access-restricted store that the provider encrypts at rest. If your account is closed, your Google connection records are deleted independently of the statutory retention periods that apply to other commercial and financial records; those retention duties do not cover Google user data. Because report content is never stored, there is no copy of it to delete.
We do not transfer or sell Google user data to third parties such as advertising platforms, data brokers, or information resellers, and we do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
We do not use Google user data to determine credit-worthiness or for lending purposes.
When you book an online meeting through our website, the meeting link is created by opening an event in the agency's own Google Calendar account. The data written to Google is: the event title (appointment type and your name), the description (meeting note and attendee name), the start and end time (Europe/Istanbul) and, as an attendee, your e-mail address and display name. The event is updated if the appointment changes and deleted if it is cancelled; because of Google's trash and audit records, permanent deletion may take up to 30 days.
This flow is entirely separate from the Alis Dijital customer portal's Google connection: it runs through the agency's own account and a separate OAuth client, no calendar permission is requested from you, and your calendar is never accessed. Booking an appointment results in your name and e-mail address being transferred to Google LLC infrastructure (outside Turkiye). If you prefer not to use an online meeting, you can request an appointment by phone or e-mail.
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, company name, e-mail, phone, address, WhatsApp number; tax/national ID for e-invoicing | The data subject |
| Quote and contact forms | Request content, sector, the source/campaign you arrived from | The data subject |
| Appointments | Name, e-mail, phone, date and time, meeting note | The data subject |
| Account and transaction security | Username, role, session and sign-in records, records derived from IP address, server error logs, SMS verification | Automatically by our systems |
| Commercial and financial records | Contracts, services, invoices, payments and balances. Card number, expiry date and CVV never reach our systems; payment is taken within PayTR's secure payment frame. If you choose to pay with a saved card, only a card token generated by PayTR — which cannot be converted back into a card number — is stored in encrypted form. | The data subject, PayTR, e-invoice providers |
| Orders and shipping | Recipient name, address, phone and order contents (for clients using e-commerce integrations — see section 2) | Marketplace and store integrations |
| Messaging | In-portal messages, WhatsApp, Instagram/Messenger and e-mail correspondence, attachments, delivery and read records | The data subject and messaging platforms |
| Advertising and social media | Meta advertising performance, Lead Ads form responses (name, phone, e-mail) | Meta platforms |
| Credential vault | Usernames and passwords of third-party accounts you ask us to manage on your behalf. Stored encrypted with AES-256-GCM; you may request deletion at any time. | The client or staff authorised by the client |
| Visitor journey | The channel you arrived from, the pages you viewed, form interactions | Visitor's browser |
| Candidate data | CV, answers and attachments submitted with a career application | The candidate |
| Browser notifications | If you grant permission, the notification endpoint and encryption keys generated by your browser | Your browser |
Collection method: this data is collected through website and portal forms, cookies and measurement tags, e-mail/phone/WhatsApp/SMS channels, payment and e-invoice infrastructure, and the APIs of third-party platforms you authorise — by wholly or partly automated means, and in part by non-automated means. Data relating to our employees falls outside this policy and is covered by a separate Employee Privacy Notice.
Data we do not obtain directly from you: for market research we collect corporate contact details from publicly available sources (company websites, business directories, marketplace pages). The legal basis is our legitimate interest; the people concerned are informed of the source and purpose at first contact and in any event within one month. You may object without giving reasons and ask for your record to be deleted.
| Purpose | KVKK Art. 5 basis | GDPR Art. 6 basis |
|---|---|---|
| Formation and performance of the service agreement; creating and operating your portal account | Art. 5/2-c (performance of a contract) | 6(1)(b) |
| Connecting your Google account and producing advertising, analytics and SEO reports | Art. 5/2-c; explicit consent additionally for international transfer and AI features | 6(1)(b), 6(1)(a) |
| Invoicing, e-invoice issuance, payment and collection management | Art. 5/2-a and 5/2-ç (provided by law / legal obligation) | 6(1)(c) |
| Handling quote, contact and appointment requests | Art. 5/2-c (directly related to formation of a contract), 5/2-f | 6(1)(b), 6(1)(f) |
| Session security, abuse prevention, error logging | Art. 5/2-f (legitimate interest) | 6(1)(f) |
| Commercial electronic messages (SMS, e-mail, WhatsApp marketing) | Art. 5/1 (explicit consent) plus IYS consent under Law No. 6563 | 6(1)(a) |
| Non-essential cookies and measurement/advertising tags | Art. 5/1 (explicit consent) | 6(1)(a) |
| Strictly necessary cookies, access and security logs | Art. 5/2-f; applicable legislation | 6(1)(f), 6(1)(c) |
| Collecting B2B market and contact data from public sources | Art. 5/2-f (legitimate interest; a balancing test has been carried out) | 6(1)(f) |
| Statutory retention duties, establishing and defending legal claims | Art. 5/2-ç, 5/2-e | 6(1)(c), 6(1)(f) |
| Assessing job applications | Art. 5/2-f (conduct of the recruitment process); explicit consent under Art. 5/1 for keeping a CV in our talent pool | 6(1)(b), 6(1)(f) |
The explicit consent we rely on for measurement and advertising tags is collected through the cookie preference panel described in section 17; until that panel is live you can block these tags through your browser settings and the providers' own opt-out tools.
Where we rely on legitimate interest, that interest is specifically: session security and prevention of account takeover; technical continuity and troubleshooting; detection of abuse; production of aggregate statistics to improve the service; and the conduct of our B2B marketing. For each of these we have carried out a legitimate interest assessment weighing our interest against your fundamental rights and freedoms, a summary of which we will share on request. You may object at any time on grounds relating to your particular situation, and object to direct marketing without giving any reason; on objection we stop processing for that purpose immediately.
Is providing data mandatory: name, e-mail and company details are required to conclude the contract and open an account; without them we cannot provide the service. A tax/national ID is legally required for invoicing. Meeting notes, marketing consent, AI features and connecting a Google account are optional; declining does not prevent you from using the core service, only the related feature.
Automated decision-making and profiling: we take no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The AI features operate on aggregate statistics and do not produce decisions about individuals. The visitor journey record involves limited profiling used only to measure marketing effectiveness, and you may object to it.
Where processing relies on consent you may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out beforehand. This policy is an information notice; consent, where required, is always obtained separately and explicitly.
We do not request special categories of personal data within the meaning of KVKK Art. 6 and GDPR Art. 9 (health, biometric and genetic data; racial or ethnic origin, political opinion, philosophical belief, religion or sect, dress, association/foundation/union membership, criminal convictions and security measures, sex life), and none of our services is built on processing such data. Please do not enter information of this nature into forms, messages or documents.
There are two exceptional flows. Job applications: data such as health, disability, criminal record or photographs that you may include in a CV is not used in the assessment; where legally required it is processed only with your separate explicit consent under KVKK Art. 6 and GDPR Art. 9(2)(a). Free-text channels: special category data you send in messages or meeting notes is used only to fulfil your request and is removed from the field once the matter is concluded. We never send such data to AI features under any circumstances. Wherever special category data is processed, the additional technical and organisational measures set out in the Turkish Data Protection Board's decision no. 2018/10 of 31 January 2018 are applied.
Promotional, campaign and announcement e-mails, SMS and WhatsApp messages are sent only with your prior consent. Under Law No. 6563 your consents are registered with the Turkish Message Management System (IYS); you can view and change your consent status at iys.org.tr.
Every commercial message offers a free and easy opt-out (an unsubscribe link in e-mail, a stop code in SMS, a "STOP" reply on WhatsApp); your opt-out is applied within three business days at the latest and recorded in IYS. Transactional notifications arising from the contractual relationship (invoices, payments, appointments, security alerts) are not commercial electronic messages and are not subject to consent.
This section concerns visitors to alisdijital.com rather than clients who connect a Google account. The following cookies and trackers may be used:
Through these tags your IP address, device and browser information and browsing behaviour are sent directly to the relevant provider; this is a direct transfer rather than processing on our behalf, and it is subject to those providers' own privacy policies.
Managing your preferences: our site does not yet have a category-based cookie preference panel. You can block non-essential cookies and tags through your browser's cookie settings, the Google Analytics opt-out add-on, and the advertising settings of Google, Meta and TikTok. When we deploy the category-based consent panel we will update this section and will not run any non-essential tag without your consent. See our Cookie Policy for details.
We use no third-party error tracking or session recording tools (no Sentry, PostHog, Hotjar, etc.); server logs remain with our hosting provider. Web fonts are served from our own domain, so your browser sends no request to Google for them.
We do not sell personal data. We share it only with contractually bound service providers needed to deliver the service, and with competent authorities where legally required. The sub-processors that touch Google data are listed separately in section 9.
| Provider | Service | Region |
|---|---|---|
| Vercel Inc. | Application hosting, scheduled jobs, technical logs | United States / global |
| Turso (libSQL) | Database | Outside Turkiye |
| Cloudflare, Inc. (R2) | File and media storage, database backups | Global |
| GitHub, Inc. (Microsoft) | Source code, backup workflow | United States |
| Fly.io, Inc. | Background workers (message queue, media transcoding, data collection) | US-based; servers in Frankfurt, Germany |
| Google LLC | Analytics, Search Console and Ads APIs, Gemini API, Calendar and Meet, measurement tags, browser push delivery | United States / global |
| Meta Platforms Ireland Ltd. / Inc. | Advertising data, Lead Ads responses, Messenger/Instagram and WhatsApp messaging | Ireland / United States |
| Resend | Transactional and notification e-mail | United States |
| ElevenLabs | Text-to-speech | United States / United Kingdom |
| Telegram | Internal team notifications | Outside Turkiye |
| Apify, Bright Data, SerpApi, PublicWWW, SecurityTrails | Collection of publicly available market and competitor data | Outside Turkiye |
| NetGSM | SMS and one-time passcodes | Turkiye |
| PayTR Odeme ve Elektronik Para Hizmetleri A.S. | Online payments (card details are entered on PayTR's secure page) | Turkiye |
| BizimHesap | E-invoice / e-archive issuance | Turkiye |
| Uyumsoft Bilgi Sistemleri ve Teknolojileri A.S. | E-invoice / e-archive issuance | Turkiye |
| ikas, Trendyol, Hepsiburada, N11, Koctas (Mirakl platform) | E-commerce and marketplace integrations | Turkiye (Mirakl platform: France) |
| Aras Kargo, BasitKargo | Shipment creation and tracking | Turkiye |
We may also share data (i) with competent public authorities where legally required, (ii) with our lawyers and financial advisers for establishing or defending legal claims, and (iii) with an acquirer in a merger, acquisition or sale of assets. For Google user data, case (ii) is out of scope and in case (iii) your explicit prior consent is obtained.
Using the providers shown above as located outside Turkiye results in personal data being transferred abroad. These transfers are a structural part of delivering the service and are not incidental; they therefore rely not on the exceptions in KVKK Art. 9/6 but on the appropriate safeguards in Art. 9/3: the standard contract published by the Turkish Data Protection Board is signed with the relevant providers and notified to the Authority within five business days of signature. Since the Board has to date issued no adequacy decision for any country or sector, none of our transfers relies on an adequacy decision. Under the GDPR, transfers are made on the basis of the Standard Contractual Clauses adopted by European Commission Decision 2021/914 or, where the recipient is certified under the EU–US Data Privacy Framework, on that framework. You may request a copy of the safeguards we apply by writing to ajans@alisdijital.com.
In the exceptional cases where your explicit consent is required for a transfer, that consent is obtained separately and with notice of the nature of the transfer. Reading this text or using the service does not by itself constitute consent to a transfer.
| Data | Retention |
|---|---|
| Google Analytics, Search Console and Google Ads report content | Not stored. Read on demand; held in server memory for at most 5 minutes in the portal, at most 10 minutes in the agency panel's aggregate advertising report, and 6 hours for GA4 technical settings. |
| Encrypted OAuth tokens and Google connection records | Until you disconnect or your account is closed. Deleted immediately on disconnection, and in any event from production systems within 30 days; backup copies are destroyed when the rotation containing them completes. |
| Prompts sent to and responses returned by the AI model | Not stored by us. |
| Client account, contract, invoice and accounting records | For the duration of the contract and 10 years thereafter (Tax Procedure Law, Turkish Commercial Code and limitation periods). |
| Messaging records and attachments | For the duration of the service relationship and 10 years thereafter (evidence and limitation periods). |
| Credential vault | Until you request deletion or the service relationship ends; destroyed within 30 days thereafter. |
| Quote, contact and appointment form records | Up to 2 years after the request is concluded. |
| Job application records | Up to 2 years after the application is concluded. |
| Visitor journey records | Visitor records not linked to a request or client record are deleted automatically after 90 days. Journeys linked to a quote or contact request follow that request's retention period. |
| Server, access and security logs | In line with applicable legislation and our hosting provider's retention setting; 12 months maximum. |
| Database backups | Destroyed on a rolling basis; once the rotation completes, the copy held in backups is erased in full. |
Our retention and destruction activities follow our Personal Data Retention and Destruction Policy; data whose retention period has expired is deleted, destroyed or irreversibly anonymised through periodic destruction at intervals not exceeding six months. Because selectively deleting a single record from a full database backup is not technically possible, backups are used only for disaster recovery and are destroyed in full at the end of the rotation period.
Section 6 sets out the measures applying to Google data. In addition: every data-changing operation passes a server-side authorisation check; roles and permissions follow the least-privilege principle; third-party integration keys and the credential vault are encrypted with AES-256-GCM; the database is backed up nightly to a private, access-restricted store that the provider encrypts at rest; and staff are bound by confidentiality undertakings.
If we determine that personal data has been unlawfully obtained by others, we notify the Turkish Data Protection Board within 72 hours of becoming aware of the breach and, where it presents a high risk to you, notify you directly as soon as reasonably possible (KVKK Art. 12/5 and Board decision no. 2019/10 of 24 January 2019; GDPR Arts. 33–34). For data we process as a processor, notification is made to our client as controller without delay.
Under KVKK Art. 11 you have the right to: learn whether your personal data is processed and, if so, request information about it; learn the purpose of processing and whether the data is used accordingly; know the third parties, in Turkiye or abroad, to whom data is transferred; request rectification of incomplete or inaccurate data; request erasure or destruction; request that rectification and erasure be notified to those third parties; object to an adverse outcome produced solely by automated analysis; and claim compensation for damage arising from unlawful processing. Under the GDPR you additionally have the rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent; portability requests are fulfilled in a structured, commonly used, machine-readable format (JSON or CSV).
Application channels (Communiqué on the Procedures and Principles of Application to the Data Controller, Art. 5): a wet-signed letter delivered in person or through a notary to the postal address above; an e-mail to ajans@alisdijital.com signed with a secure electronic signature or mobile signature; or an e-mail to the same address from the e-mail address registered in our systems. Your application must state your name (and signature in written applications), Turkish ID number (for foreign nationals, nationality and passport/ID number), address for notification, any e-mail and phone, and the subject of your request. Where we cannot verify your identity we may request further information for security reasons.
Applications are concluded as soon as possible and in any event within 30 days; the outcome, with reasons if refused, is communicated in writing or electronically. No fee is charged unless the operation entails an additional cost; under Art. 7 of the Communiqué, 1 TRY per page may be charged for written responses exceeding 10 pages, and the cost of the medium for responses provided on a recording medium. GDPR requests are answered within one month, extendable by two further months with reasons where the request is complex.
Complaints: if your application is refused, our response is insufficient or we fail to respond in time, you may lodge a complaint with the Turkish Data Protection Board within 30 days of learning our response and in any event within 60 days of your application (KVKK Art. 14); the complaint route cannot be used before applying to us. If you reside in the European Union, you may lodge a complaint directly with the supervisory authority of your member state under GDPR Art. 77.
For requests concerning your Google connection (stopping access, deleting tokens) you may also use any of the three routes in section 10.
Our services are aimed at businesses, are not marketed to anyone under 18, and we do not knowingly collect personal data from children. If we learn that a child's data has been provided to us without the consent of a parent or guardian, we delete it after verification as soon as reasonably possible and in any event within 30 days, save where legislation requires retention. Data of job applicants aged 16–18 is processed with parental or guardian consent under the Turkish Labour Law and the related regulation. For persons in the European Union, under GDPR Art. 8 we do not offer services directly to children under 16 (or the lower age set by the relevant member state). You can contact us about this at ajans@alisdijital.com.
We update this policy in line with changes to our services or to applicable law. The current version is always published on this page and the last-updated date is shown at the top. If we make a change affecting how Google user data is used, we notify users with an active Google connection at their registered e-mail address at least fifteen days before the change takes effect and announce it in the portal. Other changes are announced on this page as of their effective date.
Last updated: 17 September 2026. If we change how the application uses Google user data, we will update this policy and notify affected users before the change takes effect.
The disclosure obligation under KVKK Art. 10 is fulfilled by reading this policy together with our KVKK Disclosure Notice; in case of conflict, the provision more favourable to the data subject applies. Related documents: Cookie Policy, Terms of Use, Data Deletion Instructions.
For any question, request or complaint about this policy, our Google integrations or your personal data:
You can remove the access you granted to your Google account at any time at myaccount.google.com/permissions.
For any questions about this document, please contact us.