Personal Data Protection (GDPR/KVKK)

As Fil360 Digital Marketing Agency, we value the security of your personal data as the data controller under Personal Data Protection Law No. 6698 ("KVKK").

This Notice has been prepared to inform you about the purposes for processing your personal data, to whom and for what purpose it may be transferred, the method of collection and legal basis, and your rights under KVKK.

We process your personal data in the following categories:

• Identity: First name, last name, title.
• Contact: Email, phone, address information.
• Customer Transaction: Request, quote, contract and invoice information.
• Transaction Security: IP address, log records, session information.
• Marketing: Cookie records, communication consents, behavior and preference analyses.

Your data is processed for the following purposes within the conditions set out in Articles 5 and 6 of KVKK:

• Fulfilling obligations arising from contracts.
• Ensuring service quality and customer satisfaction activities.
• Fulfilling legal obligations and providing information to authorized institutions.
• Conducting and auditing information security processes.
• Sending commercial electronic communications and marketing activities, where explicit consent has been obtained.

Your personal data may be transferred — within the scope of fulfilling the above purposes and pursuant to Articles 8 and 9 of KVKK — to authorized public institutions, to business partners essential for our operations (hosting, email services, payment infrastructure, etc.) and, within our legal obligations, to our financial advisors and lawyers.

Transfer abroad is carried out only when your explicit consent exists or when the exceptions under Article 9 of KVKK apply.

Your personal data is collected through automated or partly automated methods such as forms on our website, email, telephone, contracts, social media and physical documents.

The legal grounds for processing data are: the establishment or performance of a contract, fulfilling legal obligations, protecting our legitimate interests, and your explicit consent where required.

Your personal data is stored for the period required by relevant legislation or by the purpose of processing. When the period expires, the data is deleted, destroyed or anonymized.

For example, a 10-year retention period applies to data relating to commercial relationships under the Turkish Commercial Code.

Under Article 11 of KVKK, you have the following rights as a data subject:

• To learn whether your personal data is being processed.
• To request information if it has been processed.
• To learn the purpose of processing and whether the data is used in line with this purpose.
• To know the third parties to whom data is transferred domestically or abroad.
• To request correction if data has been processed incompletely or incorrectly.
• To request deletion or destruction within the conditions set out in Article 7 of KVKK.
• To request that correction/deletion/destruction be communicated to third parties to whom the data has been transferred.
• To object to a result against you arising from analyses made by automated systems.
• To request compensation in case of damage due to unlawful processing.

Pursuant to Article 13 of KVKK, you can submit your request to use the rights above in writing or via registered electronic mail (KEP), secure electronic signature, mobile signature, or the email address previously provided to us and registered in our system.

Your request will be concluded free of charge as soon as possible and within 30 days at the latest, depending on its nature. However, if the operation requires an additional cost, the fee determined by the Personal Data Protection Board may be charged.