Version 2.2 · Last updated: 11 October 2026
1. Introduction and Data Controller
This Privacy Policy (the "Policy") explains which personal data is collected through the reklamgidiyor.com website, its subdomains, the iOS and Android mobile applications and the application programming interfaces behind them (together, the "Platform"), operated by Yizgo Medya Yazılım Ltd. Şti. (the "Company", "we") under our registered trademark Reklamgidiyor (name and logo); for which purposes and on which legal bases it is processed; with whom it is shared; how long it is kept; and which rights you have over it.
Data controller: Yizgo Medya Yazılım Ltd. Şti. · Address: Pınarbaşı Mah. Hürriyet Cad. Akdeniz University Antalya Teknokent Ar-Ge 2 Uluğbey Building No:3A/B203 Konyaaltı / Antalya / Türkiye · MERSİS No: 0981170305300001 · Tax office / number: Antalya Kurumlar Vergi Dairesi / 9811703053 · E-mail: [email protected] · KEP (registered e-mail): [email protected]
The Platform is a listing and communication service that brings businesses that own out-of-home advertising media (billboards, LED screens, megalights, building wraps, totems, bus-shelter panels, vehicle wraps and similar) ("Stores") together with advertisers who wish to rent them. The Company does not own, operate or let the media shown in listings; the rental agreement and any payment take place directly between the parties. Organisations looking for advertising media may also use a Premium Brand account whose corporate identity and authority to represent have been verified; this account does not publish listings and currently includes no order, booking or payment service. This Policy is drafted primarily under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and its secondary legislation, and also addresses users covered by the EU General Data Protection Regulation ("GDPR") (Section 13).
2. What We Collect and When
We collect only the data needed to provide the service. The lists below show when each item is collected and whether it is linked to your account.
2.1 Data you provide
- Account details: first name, last name, e-mail address, password (stored only as a one-way hash), phone number required by the registration and verification flow, preferred language and appearance settings.
- Profile content: profile and cover photo, store name, description, logo and cover images, service area; for a Premium Brand account, the approved corporate display name and an optional corporate logo.
- Social sign-in: if you choose to sign in with Apple, Google or LinkedIn, we receive only an identity token, your name and a verified e-mail address from the provider. If you use Apple's "Hide My Email", Apple's relay address is processed as your contact address. Your provider password never reaches the Platform.
- Listing content (Stores): the medium's title, description, photos, price, technical specifications, availability calendar and the physical location of the medium. The medium's location belongs to the listing; it is not the user's location.
- Store application: trade name, authorised person, tax office and tax number, MERSİS / trade registry details, address, phone, e-mail, website, and documents such as the tax certificate, trade registry gazette, signature circular or signature declaration. These documents are visible only to the authorised review team (see Section 5).
- Premium Brand application and corporate-detail review: type of organisation, trade or official name, the authorised person's full name, tax office and tax identification number (for sole proprietorships this may be a Turkish ID number), MERSİS / trade registry number, KEP address if any, country, province, district and head-office address, phone, e-mail, website, the proposed display name and, depending on the type of organisation, the tax certificate, trade registry gazette, signature circular, signature declaration or authority/assignment letter. The documents may contain personal data of organisation officers and signatories. The application language, submission time, time of acceptance, the versions of the Premium Brand Terms of Use and the Personal Data Protection Notice in force on that date, and a one-way digest of the application content used to prevent duplicate submissions are recorded. The documents are visible only to the authorised review team (see Section 5).
- Premium Brand account operations: corporate logo, the decision to withdraw an application and the reason for a request to return to a standard account. A return-to-standard request is created as a support record with the name, e-mail and phone details in your account.
- Messages, offers and booking requests: in-platform messaging history, offer form content and attachments you send.
- Reviews and comments: ratings and comments you post on listings and "helpful" votes on them.
- Reports: when you report a listing, message, user or review — the reason you select, your description and a snapshot of the reported content at that moment.
- Saved searches, favourites and blocks: saved search criteria, favourite listings and stores, users you have blocked.
- Support and contact form: name, e-mail and the content of your message.
- Account deletion request: the reason you select and an optional explanation.
2.2 Data collected automatically
- Session and security records: for each device you sign in from — device name (model), platform (iOS/Android/web), app version, IP address, browser/client information (user agent) and last-used time. The mobile app identifies your device with a random identifier generated by the app itself; the server stores only a one-way hash (SHA-256) of it. Advertising identifiers (IDFA/GAID), IMEI or Android ID are not used.
- Push registration token: when you allow push notifications — the registration token issued by your device's notification service (FCM registration token), device label, language and app version.
- Listing view counter: when you open a listing, your IP address and user agent are recorded to avoid counting the same visit twice. This record is not linked to your account.
- Website cookies and similar technologies: described in Section 8.
2.3 Location data
When you start a "Near me" search in the mobile app and approve the operating-system permission prompt, your device's approximate location is sent to the server only to run that search. Your location is not stored on the server, is not written into saved searches, is not linked to your account and is never collected in the background. You can withdraw the location permission at any time in your operating-system settings; only the "Near me" feature stops working.
2.4 Photo metadata
EXIF/XMP/IPTC metadata embedded in the profile, cover and listing photos and the corporate logo you upload — such as GPS position, device model and capture time — is removed before the file leaves the Platform server. Published images do not contain this information.
2.5 What we do not collect
Membership and listing services do not request health, biometric, political-opinion or similar sensitive personal data. Please do not include unnecessary personal information in messages, documents or images. If you accidentally share such information, you can contact us to request its removal. Where uploaded content contains it, the necessary safeguards and processing conditions must be assessed separately. Optional website visit measurement is explained in Section 8.
3. Purposes and Legal Bases
| Purpose | Data used | Legal basis (KVKK art. 5–6 / GDPR art. 6) |
|---|---|---|
| Creating your account, authentication, session management and account security | Account details, session and security records, social sign-in identities | Performance of a contract; legitimate interest (security) |
| Publishing, searching and mapping listings, and "Near me" search | Listing content, search criteria, transient location | Performance of the contract; separate information and explicit consent where location use relies on consent. Device permission alone is not KVKK consent |
| Messaging, offers and booking communication between advertisers and Stores | Messages, offers and — depending on your preference — your phone number | Performance of a contract |
| Reviewing and verifying Store applications | Store application data and documents | Entering into a contract; legal obligation (tax and commercial law) |
| Reviewing Premium Brand applications; verifying the organisation's identity and the applicant's authority to represent; matching Store and Premium Brand applications made with the same tax identifier | Premium Brand application data and documents, earlier application and decision records | Entering into a contract; legitimate interest regarding organisation officers and signatories named in the documents (verifying authority to represent, preventing impersonation); establishment, exercise or defence of legal claims |
| Managing the approved corporate profile and verification status; showing the corporate name, logo and badge in conversations; corporate-detail changes, suspension, removal of verification and return to a standard account | Approved display name, corporate logo, verification status, event and decision records, the support record opened for a return-to-standard request | Performance of a contract; legitimate interest (platform security, preventing misleading corporate identities); establishment, exercise or defence of legal claims |
| Sending service notifications by push, in-account notification and e-mail (new message, offer, booking, saved-search results, application and verification outcomes, security alerts) | Push registration token, e-mail, notification preferences | Performance of a contract; push permission is managed in the operating system and account settings |
| Handling reports, moderation, preventing abuse and fraud | Report records, related content snapshots, session records, IP | Legitimate interest; legal obligation |
| Assessing account closure and erasure requests; separately retaining only necessary records | Deletion record, account data | Legal obligation; establishment, exercise or defence of legal claims |
| Responding to lawful requests, resolving disputes, record-keeping obligations | All relevant records | Legal obligation; defence of legal claims |
| Evaluating website usage through visitor statistics | Cookie-based analytics data (website only, Section 8) | Consent (cookie preference) |
Your data is not processed for profiling, behavioural advertising or sale to data brokers.
4. Who We Share Data With
4.1 Other users
- When you send a message, offer or booking request to a Store, your name, your message and — if you have enabled "share my phone number in messages" in your preferences — your phone number are visible to that Store.
- Users who message a Premium Brand account see the approved corporate display name, the corporate logo (or a generic corporate icon) and, while verification is valid, the badge; in conversations this corporate identity is shown instead of the name and personal photo of the person using the account. Tax identifiers, application documents, authorised-person details and review notes are not shared with other users. A Premium Brand account has no public profile page.
- Store profiles, listings and the reviews you publish are public. Whether your online status and last-seen time are shown is controlled in your account settings.
- When you block a user, that person can no longer message you; the blocked person is not notified of your decision.
4.2 Service providers
The following service groups may receive data depending on the feature and enabled configuration. A provider may act as a processor or an independent controller depending on the service and agreement; not all providers are assumed to act solely on our instructions:
| Provider | Service | Data transferred |
|---|---|---|
| OpenFreeMap; Esri / ArcGIS World Imagery | Web map styles, tiles and satellite views | IP address, browser connection details and displayed map region |
| OpenStreetMap Nominatim (if enabled) | Reverse geocoding | Queried location and server connection details |
| Configured AI moderation provider (OpenRouter integration) | Reviewing listing content when enabled | Listing fields sent for review, including any personal data contained in them |
| Google LLC – Google Maps SDK | Rendering listing and store maps in the Android app | Device IP address and the map region displayed. The user's location is not passed to the SDK. |
| Apple Inc. – MapKit | Maps in the iOS app | Device IP address and the map region displayed |
| Google LLC – Firebase Cloud Messaging; Apple Inc. – Apple Push Notification service | Delivering push notifications to your device | Push registration token, notification title and body |
| Google LLC, Apple Inc., LinkedIn Corporation | Social sign-in (only if you choose it) | Authentication token; the provider records your sign-in under its own policy |
| Cloudflare, Inc. – Turnstile | Bot protection on the sign-in, registration, password-reset, contact, report and review forms and on Store and Premium Brand applications | IP address and browser signals |
| Google LLC – Google Analytics | Aggregate visit statistics on the website only, subject to your cookie preference | Cookie identifier, page-view data. Not loaded in the mobile app or in in-app web views. |
| Hosting, database, content delivery (CDN), e-mail and SMS delivery providers | Server infrastructure, image delivery, sending verification and notification e-mails/SMS | Data required by the service (e.g. e-mail address, phone number, uploaded images and corporate logos). Store and Premium Brand application documents are kept in private storage on the hosting infrastructure and are not uploaded to the content delivery network. |
4.3 Where required by law
Data may be shared, limited to the scope of the request, with courts, prosecutors, law enforcement, the Information and Communication Technologies Authority, the Personal Data Protection Authority and other public bodies authorised by law.
4.4 Corporate changes
In a merger, acquisition or transfer of assets, your data may be transferred to the acquiring party provided the commitments in this Policy are honoured; you will be informed in advance.
4.5 International transfers
Maps, notifications, social sign-in, security, analytics and enabled content-review services may involve sending personal data to recipients outside Türkiye. A provider's name or server region does not establish a legal basis for a transfer.
Regular transfers require the conditions and applicable safeguards under Article 9 of the KVKK. Accepting general terms or cookies does not establish such a safeguard. The explicit-consent exception for occasional transfers cannot serve as a general permission for ongoing infrastructure services. This notice does not represent that a standard contract has been signed with a particular provider or that Board approval has been obtained. You may request information about actual recipients, transfer grounds and access to the relevant documentation at [email protected].
Disabling analytics consent stops analytics loading. Other functions, such as viewing a map or completing a security check, may still communicate with their providers for their own purposes; this does not disconnect all external services.
5. Store and Premium Brand Application Documents and Corporate Data
The tax number, MERSİS and trade-registry details and the documents submitted with a Store application are processed to evaluate the application, to open and maintain the Store account, to fulfil obligations under tax and commercial law and to resolve disputes. The documents are not public; only the authorised review team can see them, and they are never shown to other users or on the Store profile. Identity details of sole traders are processed within the same scope and under the same protection.
The organisation, tax, registry, representation and contact details and the documents submitted with a Premium Brand application are processed to evaluate the application, to verify the organisation's identity and the applicant's authority to represent it, to create and maintain the corporate profile, to review changes to corporate details, to prevent abuse and to resolve disputes. The documents are kept in private server storage that cannot be accessed directly from the internet, are not uploaded to the content delivery network and are viewed only by the authorised team assigned to review Premium Brand applications. When an account is converted from the administration panel at the organisation's request, authorised staff upload the information and documents to the same storage and the same rules apply.
During the review, Store and Premium Brand applications made from other accounts with the same tax identifier may be shown to the review team to assess authority to represent and the reason for using a separate account; accounts are not merged. The proposed display name may be corrected before approval with the reason recorded; the original value and the correction record are preserved. Applications, decisions, rejection reasons, suspension, removal of verification, return to a standard account and the delivery status of decision notifications are recorded together with the staff member who performed the action. After approval, only the corporate identity details described in Section 4.1 are shared with other users.
6. How Long We Keep Data
There is no single retention period for all data. Retention depends on the service need, the obligation related to the record and the scope genuinely necessary to protect a right. Where several valid periods apply, the longest applicable period is used subject to statutory maximum limits. This does not authorise keeping an entire account, every message or every uploaded document for 10 years.
| Record | Period and starting point |
|---|---|
| Account, profile, favourites and search preferences | For as long as necessary to use the account and the relevant feature. After closure, only records with a separate retention ground are retained; the entire profile is not archived indefinitely. |
| Records necessary to evidence contracts, acceptance of terms and transactions | For the limitation period applicable to the relevant claim; where the general period applies, 10 years from the date the claim becomes due. Special periods, suspension and interruption are assessed separately. Unrelated messages and attachments are not automatically included. |
| Commercial books and documents subject to statutory retention | For documents within Article 82 of the Turkish Commercial Code, 10 years from the end of the relevant calendar year. Other tax-record duties are assessed separately; this period does not apply to every Store application document. |
| Store and Premium Brand application documents | For as long as necessary to verify the application, the organisation's identity and authority to represent. Verification and contract evidence for approved applications is assessed separately from unnecessary copies in rejected, withdrawn or superseded applications. Rejection, withdrawal or return to a standard account does not delete documents automatically, but it is not a reason for indefinite retention either. Only the part needed for an identified legal or contractual purpose may fall within the periods above. |
| Premium Brand corporate profile and verification records | Approved display name, corporate logo and verification status: while the account keeps the Premium Brand role and the feature is used. Event records of applications, decisions, display-name corrections, suspension, removal of verification and return to a standard account may be kept with restricted access for the limitation period of the relevant claim to evidence the decision and the verification of authority. Profile content such as the logo is not automatically included in that period. |
| Session and technical security records | Session validity differs from event-record retention. A mobile access token lasts 60 minutes; a session lasts up to 90 days and expires after 30 days of inactivity. Where traffic-record duties under Law No. 5651 apply, the relevant periods and limits govern; not every IP or device record is automatically in scope. |
| Support, reporting and moderation records | For as long as necessary to investigate, follow up and protect a specific right. Records related to a dispute may be retained with restricted access for the legal retention need of that case. |
| Push registration token | Actively used until the device registration is revoked or the provider invalidates it. Under the current default cleanup, registrations not refreshed for 30 days are revoked; daily cleanup deletes them 90 days after revocation. |
| Commercial electronic-message consent and message records | If this activity is carried out, consent records are kept for 3 years from expiry of the consent and other message records for 3 years from their recording date. Retention does not renew permission to market. |
| Cookie choice and optional browser records | The periods in Section 8; 180 days for choice validity and the current decision record. These periods are not increased to the general contract period. |
| Deletion, destruction and anonymisation operation records | At least 3 years from the operation; another applicable retention obligation for the operation record may require longer. The deleted data is not copied in full into the deletion log. |
If ongoing litigation, an authority request or a specific dispute requires longer retention, its scope and justification must be limited to the relevant record. When the purpose and all other processing grounds end, data must be deleted, destroyed or anonymised. Backups and copies held by service providers are included in the assessment; disabling access alone is not erasure. You may ask about the outcome of a retention or deletion request through the channels in Section 12.
7. Deleting Your Account
You can delete your account at any time in the mobile app via Account → Delete my account, or without installing the app at reklamgidiyor.com/en/account-deletion. For your security, your password and a one-time code sent to your e-mail are required. Once your request is confirmed:
- your sessions on all devices and your push registrations are terminated immediately,
- your listings and listing groups are unpublished; if you own a Store, the Store profile is closed to the public,
- if you have a Premium Brand account, your open applications and return-to-standard requests are concluded, and your corporate profile and verification badge are closed to others,
- your profile, reviews and your name in messages appear to other users as "anonymous member",
- your account is set to inactive and can no longer be signed in to.
Account closure ends access; it does not mean that all data is immediately and permanently erased. Each retained record must be assessed separately under Section 6. Permanent deletion or anonymisation is a separate operation required when the retention ground ends. During that time it is accessed only to fulfil legal obligations, to resolve disputes, or — exceptionally, on your written request — to restore the account. If you have an active booking or an unexpired publication commitment, the deletion request is held until those are completed, and you are informed of the status.
8. Cookies and Similar Technologies
8.1 Website
| Cookie / record | Type | Purpose | Duration |
|---|---|---|---|
| Session cookie | Strictly necessary | Keeping a signed-in user's session | 2 hours after the last activity |
| "Remember me" cookie | Strictly necessary | Keeping you signed in after the browser is closed (only when "remember me" is selected or you signed in with a social provider) | Until you sign out; at most 5 years |
| Form security record | Strictly necessary | Protecting form submissions against forgery | Session |
| Your chosen appearance (reklamgidiyor-theme) | Requested preference | Remembering the light/dark appearance you choose in this browser | Until you clear it |
| Recent searches and viewed adverts (search_history, viewed_adverts) | Optional — easier browsing | Remembering recent searches and viewed adverts in local browser storage for the relevant domain | Up to 180 days; only with permission |
| Cloudflare Turnstile | Strictly necessary (security) | Bot protection on sign-in, registration, password-reset, contact, report and review forms and on Store and Premium Brand applications | For the duration of the verification |
| Cookie preference (rg_consent) | Strictly necessary | Remembering your choice for the main site and store pages in this browser with a random preference identifier and your selections | 180 days |
| Google Analytics (_ga, _ga_*) | Analytics | Visit statistics | Up to 180 days; loaded only with your consent |
On your first visit, you can accept all optional features, reject all, or choose them individually. Both acceptance and rejection are remembered for 180 days across the main site and store pages in the same browser. A new purpose or provider may require a new choice. Clearing browser records or using a different browser may cause the question to appear again.
Without permission, Google Analytics is not loaded and optional visit measurement and browsing records do not start. If you allow visit statistics, Google Analytics sends visit information to Google. This choice does not grant permission for personalised advertising. The relevant sections of this policy and the KVKK notice cover providers and international transfers.
Use “Cookie preferences” at the bottom of the page to change your choice. Withdrawal stops future use and clears relevant browser records we can access. Other open pages apply the current decision when you return to them. Previously transmitted data is not automatically deleted. Local records belonging to other store domains are cleared when those pages are next opened.
To document your choice, we keep a random preference identifier, your selections, the date, scope, language and the version of the notice shown. This decision record does not include your name, email address, account identifier, IP address or browsing history. By default, decision records are kept for 180 days and removed by daily cleanup after expiry. A random preference identifier does not guarantee anonymity.
Blocking essential cookies in your browser may affect sign-in and form submissions. If your preference cannot be saved, we explain this and keep optional features off on that page.
8.2 Mobile app
The mobile app does not use cookies. Your session credentials are stored in your device's secure storage (iOS Keychain / Android Keystore). Some screens opened inside the app (creating a listing, applying for a Store or a Premium Brand account) run in an embedded view of the website; in that view only the session cookie is used, and Google Analytics and other analytics tools are not loaded.
9. Security
Your data is encrypted in transit with TLS. Passwords are stored as one-way hashes, and session and device identifiers in hashed form; social sign-in and account-deletion flows use one-time codes and short-lived tokens. Access rights are role-based and actions in the administration panel are logged. No transmission over the internet can be guaranteed to be absolutely secure; please do not share your password and report any suspicious activity to us immediately. If a breach affecting your personal data is detected, the Personal Data Protection Board and, where required, you will be notified within the period prescribed by law.
10. Notifications and Commercial Communication
Service notifications — new message, offer, booking, saved-search results, application and verification outcomes and security alerts — are sent because your account needs them; you can turn off push notifications in your operating-system settings and e-mail notifications in your account settings. Commercial electronic messages with campaign or promotional content are sent only if you have given prior consent under Law No. 6563; you can withdraw consent from the link in any message or in your account settings.
11. Children
The Platform is intended for persons aged 18 or over and for businesses. If we become aware that data of a person under 18 has been processed, we close the account and delete the data. You can report such a case to [email protected].
12. Your Rights
Under Article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether the data is used in line with it; to know the third parties to whom it is transferred in Türkiye or abroad; to request rectification of incomplete or inaccurate data; to request erasure or destruction under the conditions of the law; to request that such rectification, erasure or destruction be notified to third parties who received the data; to object to a result that is to your detriment arising from analysis exclusively by automated systems; and to claim compensation for damage caused by unlawful processing.
Send your requests, together with information that verifies your identity, to [email protected], to our KEP address or in writing to the Company address. Requests are answered free of charge within 30 days at the latest; if the operation involves an additional cost, the tariff set by the Personal Data Protection Board applies. If your request is refused, the answer is found insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board. You can view and update your account details and preferences directly in My Account, and delete your account as described in Section 7.
13. Additional Information for Users in the EEA and the United Kingdom
If you are covered by the GDPR or UK GDPR: Section 3 shows the legal basis for each processing purpose (performance of a contract – art. 6(1)(b); legal obligation – art. 6(1)(c); legitimate interests – art. 6(1)(f); consent – art. 6(1)(a)). You may exercise your rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests by writing to [email protected]; where processing is based on consent you may withdraw it at any time. Your data is processed in Türkiye and in the countries where the providers in Section 4.2 are located; where GDPR/UK GDPR applies, the relevant international-transfer requirements must also be met. This text does not represent that signed European Commission standard clauses or any other safeguard are in place. You have the right to lodge a complaint with the data protection authority of your country. Automated tools may be used to review content. You may request a review or explanation of a decision concerning you through the contact channel above.
14. Changes to This Policy
We may update this Policy to reflect changes in our services or in the law. Material changes are announced on the Platform and, where appropriate, by e-mail before they take effect; the version and last updated date at the top of the page identify the current version. Previously published versions are kept in the Company's records and are available on request.
15. Contact
Questions about privacy and personal data: [email protected] · General support: [email protected] · Yizgo Medya Yazılım Ltd. Şti., Pınarbaşı Mah. Hürriyet Cad. Akdeniz University Antalya Teknokent Ar-Ge 2 Uluğbey Building No:3A/B203 Konyaaltı / Antalya / Türkiye.
"Reklamgidiyor" (name and logo) is a registered trademark of Yizgo Medya Yazılım Ltd. Şti.