Version 2.2 · Last updated: 11 October 2026
1. Data Controller
Under the Turkish Personal Data Protection Law No. 6698 (the "Law"), your personal data is processed by Yizgo Medya Yazılım Ltd. Şti. (the "Company"), acting as data controller, through the reklamgidiyor.com website and the iOS and Android mobile applications operated under its registered trademark Reklamgidiyor (together, the "Platform"), within the scope described in this Notice. This Notice is issued under Article 10 of the Law and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, and should be read together with the Privacy Policy.
Yizgo Medya Yazılım Ltd. Şti. · Address: Pınarbaşı Mah. Hürriyet Cad. Akdeniz University Antalya Teknokent Ar-Ge 2 Uluğbey Building No:3A/B203 Konyaaltı / Antalya / Türkiye · MERSİS No: 0981170305300001 · Tax office / number: Antalya Kurumlar Vergi Dairesi / 9811703053 · KEP: [email protected] · E-mail: [email protected]
2. Categories of Personal Data Processed
| Category | Data | Data subjects |
|---|---|---|
| Identity | First name, last name; for sole traders, identity and tax details in Store and Premium Brand applications; full name of the organisation's authorised person stated in the application | Members, Store and Premium Brand applicants, organisation officers |
| Contact | E-mail address, phone number (required in the registration and verification flow); in Store and Premium Brand applications, the organisation's address, phone, e-mail address, KEP address if any and website | Members, Store and Premium Brand applicants, contact-form users |
| Customer transaction | Listings, listing groups, offers, booking requests, messaging history, favourites, saved searches, reviews | Members, Stores, Premium Brand accounts |
| Transaction security | Password hash, session tokens, IP address, device name and platform, app version, browser/client information, hash of the app-generated device identifier, push registration token, sign-in/sign-out and administration-panel activity logs | Members, visitors |
| Visual records | Profile and cover photo, store logo, Premium Brand corporate logo, listing photos (with metadata removed) | Members, Stores, Premium Brand accounts |
| Location | Approximate location used only for the duration of a "Near me" search request (not stored) | Mobile app users |
| Legal proceedings and risk management | Report and moderation records, block records, account deletion requests, dispute correspondence | Members |
| Corporate / financial information (Store and Premium Brand applications) | Type of organisation, trade or official name, authorised person, tax office and number, MERSİS and trade-registry details; in Premium Brand applications, the proposed display name; depending on the type of organisation, the tax certificate, trade registry gazette, signature circular, signature declaration or authority/assignment letter, and information about officers and signatories contained in those documents such as name, title, signature and, depending on the document, identity number | Store and Premium Brand applicants, organisation officers and signatories named in the documents |
| Corporate profile and verification records (Premium Brand) | Approved display name and correction history, corporate logo, verification status; application, review, decision, rejection reason, suspension, removal of verification and return-to-standard records; review notes, results of matching applications with the same tax identifier, application language, time of acceptance and accepted document versions, delivery status of decision notifications | Premium Brand applicants and account users |
| Marketing (only with consent) | Commercial electronic message consent and opt-out records, notification preferences | Members |
Membership and listing services do not request sensitive personal data such as health, biometric information, religion or political opinions. Users should not include unnecessary personal information in messages, documents or images. Application documents should not contain information that is not needed for verification (for example details of unrelated persons or an image of an identity card); such information may be redacted as long as verification remains possible. If uploaded content contains such data, the processing conditions and safeguards must be assessed separately. Embedded location and device information is removed during image processing.
3. Method of Collection and Legal Grounds
Your personal data is collected electronically, partly by automated means, through registration and sign-in forms, social sign-in providers (Apple, Google, LinkedIn), profile and listing screens, the Store application form, the Premium Brand application and corporate-detail review forms, the My Brand screen (corporate logo and return-to-standard request), messaging and offer tools, report forms, the contact form, automatic session records of the mobile app and website, and cookies. When a Premium Brand account is converted in the administration panel at the organisation's request, the information and documents are entered by authorised staff. Information in applications may be compared, where necessary, with public records such as MERSİS, the trade registry and tax identification queries. Data is processed on the following legal grounds listed in Article 5 of the Law:
- Being directly related to the establishment or performance of a contract (art. 5/2-c): membership, publishing listings, messaging, offer and booking communication, opening and maintaining a Store account, evaluating Premium Brand applications, creating and maintaining the corporate profile, showing the corporate identity and verification status in conversations, and service notifications including application and decision notifications.
- Fulfilment of the controller's legal obligations (art. 5/2-ç): traffic records to the extent that Law No. 5651 applies, record and document retention under tax and commercial law, responding to requests from authorised bodies, recording account deletion requests.
- Processing being mandatory for the establishment, exercise or protection of a right (art. 5/2-e): retaining dispute and report records, and records of applications, acceptance of terms, verification of authority to represent and verification decisions, only for the scope and period needed to protect the specific right.
- Our legitimate interests, provided they do not harm your fundamental rights and freedoms (art. 5/2-f): account and platform security, preventing abuse and fraud, moderation, improving service quality, listing view counters; for organisation officers and signatories named in application documents, verifying authority to represent, matching applications made with the same tax identifier, and preventing impersonation and misleading use of a corporate identity.
- Explicit consent (art. 5/1): separate purposes such as consent-based location use and website analytics cookies. Device location or notification permission alone is neither explicit consent under the KVKK nor commercial-message consent. Commercial-message consent is separately subject to Law No. 6563. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.
4. Purposes of Processing
- Managing membership, authentication, session and device management, securing accounts.
- Publishing, searching and mapping listings of out-of-home advertising media, and listing media near you.
- Conveying messages, offers and booking requests between advertisers and Stores.
- Reviewing, verifying, approving or rejecting Store applications; managing Store accounts.
- Reviewing Premium Brand applications, the organisation's identity and the applicant's authority to represent; matching Store and Premium Brand applications made with the same tax identifier; managing the approved corporate profile, display name, logo and verification status and showing them in conversations; handling corporate-detail change reviews, suspension, removal of verification and requests to return to a standard account.
- Delivering service notifications — new message, offer, booking, saved-search results, application and verification outcomes, security alerts — by push, in-account notification and e-mail.
- Evaluating reports, moderating content, applying block requests, detecting and preventing abuse and fraud.
- Assessing account closure and erasure requests; retaining only records with a separate justification.
- Responding to requests from legally authorised bodies, resolving disputes, fulfilling commercial book and record obligations.
- Sending commercial electronic messages with campaign or promotional content, if you have consented.
- Evaluating website visit statistics in aggregate with your consent; the underlying cookie and visit records are not treated as anonymous.
5. Recipients of Personal Data and Purposes of Transfer
| Recipient group | Purpose of transfer | Data transferred |
|---|---|---|
| Other members of the Platform (Stores, advertisers and Premium Brand accounts) | Enabling messaging, offer and booking communication; displaying public profiles, listings and reviews; showing a Premium Brand account with its corporate identity in conversations | Name, message content, phone number if you chose to share it, profile details, reviews; for a Premium Brand account, the approved corporate name, corporate logo and verification badge. Tax identifiers, application documents, authorised-person details and review notes are not shared. |
| IT infrastructure providers (hosting, database, content delivery network, e-mail and SMS delivery) | Technical delivery of the service, sending verification and notification messages | Data required by the service. Store and Premium Brand application documents are kept in private storage on the hosting infrastructure and are not uploaded to the content delivery network. |
| Google LLC (Maps SDK, Firebase Cloud Messaging, Sign in with Google, Google Analytics), Apple Inc. (MapKit, Apple Push Notification service, Sign in with Apple), LinkedIn Corporation (social sign-in), Cloudflare, Inc. (bot protection) | Map rendering, push delivery, social sign-in, security verification, consent-based web analytics | IP address, map region displayed, push registration token and content, authentication token, browser signals, cookie identifier |
| OpenFreeMap, Esri/ArcGIS and enabled Nominatim services | Web maps, satellite imagery and reverse geocoding | Displayed/queried region and connection details |
| Enabled AI moderation provider (OpenRouter integration) | Reviewing listings against content rules | Listing fields submitted for review and personal data contained in them |
| Legally authorised public bodies and judicial authorities | Fulfilling legal obligations | Data limited to the scope of the request |
| Legal, audit and consultancy providers | Conducting legal proceedings, resolving disputes | Relevant records |
Maps, notifications, social sign-in, security, analytics and enabled content-review services may involve sending personal data to recipients outside Türkiye. A provider's name or server region does not establish a legal basis for a transfer.
Regular transfers require the conditions and applicable safeguards under Article 9 of the KVKK. Accepting general terms or cookies does not establish such a safeguard. The explicit-consent exception for occasional transfers cannot serve as a general permission for ongoing infrastructure services. This notice does not represent that a standard contract has been signed with a particular provider or that Board approval has been obtained. You may request information about actual recipients, transfer grounds and access to the relevant documentation at [email protected].
Disabling analytics consent stops analytics loading. Other functions, such as viewing a map or completing a security check, may still communicate with their providers for their own purposes; this does not disconnect all external services.
6. Retention Periods
Retention depends on the data category, related transaction, necessary evidential scope and applicable statutory period. Certain contract and commercial-document records may be subject to a 10-year period; this does not mean that all messages, profiles and application documents are kept for 10 years. Starting points and exceptions are explained in Section 6 of the Privacy Policy. Account closure ends access; permanent deletion and anonymisation are separate operations. Rejection or withdrawal of an application, or the return of a Premium Brand account to a standard account, does not mean that application documents and verification records are automatically deleted or kept indefinitely; each record is assessed under the same criteria. Erasure is required when processing grounds end; an ongoing specific legal retention need is assessed only for the relevant records.
7. Your Rights as a Data Subject (Article 11 of the Law)
- To learn whether your personal data is processed,
- To request information if it has been processed,
- To learn the purpose of processing and whether the data is used in accordance with it,
- To know the third parties to whom it is transferred in Türkiye or abroad,
- To request rectification if it is incomplete or inaccurate,
- To request erasure or destruction under the conditions in Article 7 of the Law,
- To request that rectification, erasure or destruction be notified to the third parties who received the data,
- To object to a result that is to your detriment arising from analysis exclusively by automated systems,
- To claim compensation for damage caused by unlawful processing.
8. How to Submit a Request
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, requests must include your name, Turkish ID number (passport number for foreign nationals), address for service, e-mail or phone for notifications and the subject of the request, and may be submitted:
- to [email protected], from the e-mail address registered on the Platform or with a secure electronic or mobile signature,
- to our registered electronic mail (KEP) address [email protected],
- by a signed letter delivered in person or through a notary to Pınarbaşı Mah. Hürriyet Cad. Akdeniz University Antalya Teknokent Ar-Ge 2 Uluğbey Building No:3A/B203 Konyaaltı / Antalya / Türkiye.
Requests are concluded free of charge as soon as possible and within 30 days at the latest; if the operation involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your request is refused, you find the answer insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the request. You can correct your account details directly in My Account and delete your account from the mobile app or the account deletion page.
9. Changes
This Notice may be updated to reflect changes in the law or in our services. The current version is published on the Platform; the version and last updated date at the top of the page prevail. Previously published versions are kept in the Company's records and shared on request.
"Reklamgidiyor" (name and logo) is a registered trademark of Yizgo Medya Yazılım Ltd. Şti.