Personal Data Notice (KVKK)

Last updated: 14 October 2026

This Notice has been prepared under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the “Law”, known as KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform you about the processing of your personal data in connection with www.leopati.com and your communication with Leopati. The Turkish text of this Notice is the authoritative version.

1. Data controller

Your personal data is processed by Güneş Polater, founder of Leopati Agency, as data controller. Leopati Agency is an AI agency founded by Güneş Polater, based in Ankara, Türkiye, and operating as a sole proprietorship.

• Email: agency@leopati.com
• Telephone / WhatsApp: +90 542 652 19 73
• Address: Ankara, Türkiye

2. Personal data processed and processing activities

• Contact form and direct communication: full name, email address, telephone number, company or brand, preferred contact channel, the content of the message and any project information attached to it. Messages sent through the form are also recorded in the Site’s administration panel.
• Submitting a question: name, optional organisation, email address, the text of the question, the page it was sent from and the time of submission. Name, organisation and email address are not shown with published questions.
• Client review: the invited person’s email address, organisation, job title, name, the text of the review and the time of consent. A review is published with the organisation; failing that, the job title; failing that, the name.
• Contact record: a summary record kept for the email address used in the activities above, consisting of name, organisation, telephone, the times of the first and latest activity, and the type of activity.
• Proposal and contract process: identity and contact details, invoicing details, correspondence on the scope of the project and project files shared by the client.
• Use of the Site: IP address, browser and device information, pages visited, date and time, and security logs. Analytics data is collected only if you allow it in your cookie preferences.
• Security verification: browser and device signals processed by the verification service that runs during form submissions to check that a submission is not made by automated tools.

Leopati does not request special categories of personal data through the Site. Please do not send such data through forms or messages.

3. Purposes of processing

• Responding to enquiries, understanding the project need, preparing a proposal and conducting the contract process.
• Planning, providing and delivering the production service.
• Answering questions, publishing them on the Site with their answers, and notifying the person who asked that the answer has been published.
• Collecting, verifying and publishing client reviews.
• Keeping the Site secure and preventing misuse and unsolicited submissions.
• Where permitted, measuring use of the Site and improving its content.
• Meeting legal obligations, keeping accounting and tax records, and protecting rights in any dispute.

4. Legal grounds for processing

Your personal data is processed on the following legal grounds set out in Article 5 of the Law:

• Processing is directly related to the conclusion or performance of a contract (Art. 5/2-c): proposal, contract and production processes; responding to enquiries.
• Processing is necessary for the data controller to comply with a legal obligation (Art. 5/2-ç): invoices, accounting and tax records.
• Processing is necessary for the establishment, exercise or protection of a right (Art. 5/2-e): disputes and claims.
• The legitimate interests of the data controller, provided the fundamental rights and freedoms of the data subject are not harmed (Art. 5/2-f): site security, prevention of misuse, answering questions and keeping the contact record.
• Explicit consent (Art. 5/1): non-essential analytics cookies, and the publication of a client review with its signature.

Where processing rests on explicit consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it.

5. How personal data is collected

Your personal data is collected electronically and partly by automated means, through the contact, question and review forms on the Site, email, telephone and WhatsApp correspondence, documents you provide during the contract process, and the technical logs generated by the Site and its infrastructure.

6. Transfer of personal data

Your personal data may be transferred, in accordance with Articles 8 and 9 of the Law and limited to the purpose of processing, to the following groups of recipients:

• Providers of hosting, email, content delivery network (CDN) and site security services.
• The analytics provider, where you have allowed it.
• Accounting, financial and legal advisers.
• Partners and service providers engaged to carry out the project.
• Competent public authorities and judicial bodies, where there is a legal obligation.

The providers of the content delivery network, security verification and analytics services used are located outside Türkiye. The technical data those services process may therefore be transferred abroad. Transfers abroad are carried out in accordance with the conditions set out in Article 9 of the Law. Your personal data is never sold and is not shared with third parties for marketing purposes.

7. Retention periods

• Form messages, questions, review invitations and contact records: 24 months from the date of the latest activity. At the end of that period the records are deleted or anonymised.
• Published questions and reviews: for as long as they remain published; the email address and name behind them are deleted at the end of the 24 months.
• Contract, invoice and accounting records: for the period required by the applicable commercial and tax legislation.
• Cookies and technical logs: for the periods stated in the Cookie Policy.

Data whose period has expired is deleted, destroyed or anonymised in the next periodic disposal.

8. Your rights as a data subject

Under Article 11 of the Law, by applying to the data controller you have the right to:

• learn whether your personal data is processed,
• request information about it if it has been processed,
• learn the purpose of processing and whether the data is used in accordance with that purpose,
• know the third parties to whom it is transferred, in Türkiye or abroad,
• request its correction if it is incomplete or inaccurate,
• request its deletion or destruction under the conditions set out in Article 7 of the Law,
• request that third parties to whom the data has been transferred be notified of correction, deletion and destruction,
• object to a result to your detriment arising from the analysis of the data exclusively by automated systems,
• claim compensation if you suffer damage because your personal data has been processed unlawfully.

9. How to apply

You may send requests concerning your rights, with information sufficient to verify your identity, by email to agency@leopati.com or in writing. Your application must state your full name, your contact details and the subject of your request. Depending on its nature, your request is concluded as soon as possible and within thirty days at the latest, free of charge; if the process involves a separate cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is refused, the reply is found insufficient or no reply is given in time, you have the right to lodge a complaint with the Personal Data Protection Board.

10. Updates

This Notice is updated when processing activities or legislation change. The current text is published on this page.