Privacy Notice
Version: 1.0 · Effective: [belirtilecek]
This notice explains how we process personal data, in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Who we are
Digital Exchange Reklam Hizmetleri A.Ş. ("we", "us") is the data controller.
| Address | [belirtilecek] |
[belirtilecek] |
Digital Checkup is a digital analytics service offered under our Accumulate platform.
2. What we process, and where it comes from
2.1 Panel users (brand representatives using the service)
| Category | Data | Source |
|---|---|---|
| Identity | Full name | Transferred automatically from your Accumulate account (SSO) |
| Contact | Email address | Transferred automatically from your Accumulate account (SSO) |
| Account | Platform role, brand memberships and permissions, interface language, in-app notifications | Accumulate + your use of the service |
| Security | Session identifiers, single-use login tokens, signed session cookie | Automatic, at sign-in |
| Audit | Who-did-what records, including a snapshot of your name/email | Automatic, when actions occur |
We do not create a record about you until you launch the service from Accumulate.
2.2 Third parties (a brand's social media audience)
We analyse comments left on publicly visible posts on our customer's own social media accounts. Because this data is not collected from you directly, this section serves as our Article 14 notice.
| Data | Detail |
|---|---|
| Comment text | The publicly posted comment itself |
| Account display name | Masked on screen (e.g. al***) and permanently deleted from our records after 90 days |
| Like count, timestamp | For statistical assessment only |
How it is collected: automatically, and only from pages any logged-out visitor can reach. We never log in to any account and never circumvent a technical access measure.
Volume: once per week per brand; up to 75 comments per post are reviewed, of which at most 10 are retained.
Google business reviews: reviewer names and photos are never collected — only review text, star rating and date.
2.3 News and competitor analysis
Corporate information is collected from public news sources and company websites. News content may mention individuals; it is presented as published, with a link to the original source.
3. Why we process it
- Providing access to the service, authorisation and session management
- Analysing and scoring a brand's digital assets (website, social media, map profile, advertising presence)
- Assessing customer sentiment and brand perception in aggregate
- Tracking weekly changes and producing reports
- Competitor comparison and industry news monitoring
- Securing the service and preventing unauthorised access
- Accountability and audit logging
- Sending service notifications and report emails
What we do not do: we do not use personal data for advertising, profiling, or sale; we do not share it for third-party marketing. Comment data is not used to train AI models — model training is disabled at our AI provider.
4. Legal bases
| Data / activity | GDPR Art. 6 | KVKK Art. 5 |
|---|---|---|
| Panel user identity, contact and permissions | 1(b) — performance of a contract | 2/c |
| Session security, login tokens | 1(f) — legitimate interests (service security) | 2/f |
| Audit log | 1(f) — legitimate interests (accountability) | 2/f |
| Social media comment content | 1(f) — legitimate interests (providing a brand with aggregated feedback from its own audience) | 2/f |
| Legal obligations | 1(c) | 2/ç |
Our legitimate interests assessment is documented in writing and available in summary on request.
Special category data: a comment may, by its author's own choice, contain information about health, beliefs or political views. We do not seek out, extract or classify such data; the analysis is limited to product and service feedback.
5. Recipients and international transfers
| Category of recipient | Purpose | Region |
|---|---|---|
| Cloud database and authentication provider | Data storage, session management, file storage | European Union |
| Application hosting provider | Delivery of the service | US / global |
| Data collection infrastructure provider | Collection of publicly available data | European Union |
| AI model providers | Text analysis | US |
| Search and news service provider | Visibility measurement, industry news monitoring | US |
| Email and performance measurement services | Notification delivery, page speed measurement | US |
| Our self-hosted rendering server | Screenshots and PDF generation | [belirtilecek] |
Transfers outside Türkiye are made under KVKK Art. 9 on the basis of the standard contract, notified to the Turkish Data Protection Authority. Transfers outside the EEA rely on Standard Contractual Clauses or an applicable adequacy decision.
A current list of sub-processors, including their legal names, is available on request via the contact details in section 7.
6. Retention
| Data | Period |
|---|---|
| Panel user account and permissions | While the account is active in Accumulate |
| Audit log | 3 months (deleted automatically) |
| Session and login security records | 15 minutes – 30 days, depending on type (deleted automatically) |
| Account display names in social comments | 90 days (deleted automatically; comment text is retained) |
| Analysis results, scores, reports | While the brand account is active |
| Archived brand data | Until a permanent deletion decision |
7. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to processing based on our legitimate interests. Under KVKK Art. 11 you have equivalent rights, plus the right to object to a decision produced solely by automated analysis that produces an adverse effect on you.
You may lodge a complaint with your local supervisory authority, or with the Turkish Personal Data Protection Authority (KVKK Kurumu).
Asking us to remove your comment: if you commented on a brand's social media post and want that record removed from our systems, send us the link to the comment. Once verified, we will delete it.
Contact: [belirtilecek] — we respond within 30 days.
8. Cookies
We use strictly necessary cookies only:
| Cookie | Purpose | Duration |
|---|---|---|
dc_launch | Carries the signed launch context | Session |
sb-* (authentication session cookies) | Maintains your session | Session |
No advertising, analytics or third-party tracking cookies are used. Strictly necessary cookies do not require consent.
9. Changes
When this notice changes, the version number and effective date are updated; panel users are notified of material changes.