KVKK Privacy Notice

Effective date: 06/08/2026 Last updated: 06/08/2026

This is a courtesy translation of the Turkish original. In the event of any discrepancy, the Turkish text prevails.

1. DATA CONTROLLER

1.1. This Privacy Notice has been prepared under Law No. 6698 on the Protection of Personal Data (the “KVKK” or the “Law”) by LIGHTSPIRE REKLAM VE PAZARLAMA TİCARET LİMİTED ŞİRKETİ (the “Company”), acting in the capacity of data controller, registered at MASLAK MAH. AOS 55. SK. 42 MASLAK B BLOK NO: 4 İÇ KAPI NO: 542 SARIYER/İSTANBUL and recorded with the Maslak Tax Office under number 6081763815, in order to inform natural persons whose personal data is processed within the activities carried out under the ceptesite.com brand.

1.2. The Company can be reached by telephone on +90 541 212 17 34 or by e-mail at bilgi@ceptesite.com.

1.3. This notice takes effect together with the User Agreement and the Distance Sales Agreement, and forms an integral part of the Distance Sales Agreement. The term “Company” used in this notice and the term “Service Provider” used in those agreements refer to the same legal entity; “Customer” refers to the natural or legal person entering into a service agreement with the Company.

2. SCOPE

2.1. The Company processes personal data in three separate processes. The first is the visiting of the ceptesite.com website and the cookies used during that visit.

2.2. The second is promotional and sales activity conducted through the contact forms on the website, requests submitted via advertising platforms, and sales conversations.

2.3. The third is the performance of the service, invoicing and the conduct of customer relations in respect of customers who enter into an agreement with the Company.

2.4. The categories of data processed, the purposes of processing and the legal grounds under Article 5 of the Law for each process are explained under separate headings below.

3. WEBSITE VISITS AND COOKIES

3.1. When you visit our website, your IP address, records of the date and time of access, your browser and device information and your operating system information are processed in order to operate the site and ensure its security. This data is processed on the legal ground of compliance with a legal obligation set out in Article 5(2)(ç) of the Law, in respect of the traffic-data retention obligation arising from Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications; and on the legal ground of legitimate interest set out in Article 5(2)(f) of the same paragraph, in respect of operating and securing the site.

3.2. Our site also uses cookies. A cookie is a small text file stored on your device when you visit a website, serving functions such as operating the site, remembering your preferences and measuring visit statistics.

3.3. Strictly necessary cookies, which provide the site’s core functions, session management and security, are used on the legal ground of legitimate interest and are stored for the duration of the session; your consent is not sought for these cookies. All other cookies run solely on the basis of your explicit consent. Preference cookies, which remember your language and appearance settings, are retained for twelve months; the performance and analytics cookies belonging to Google Analytics, used to measure visitor numbers and site traffic, for fourteen months; and the advertising and targeting cookies belonging to Meta Pixel and Google Ads, used for ad delivery, conversion measurement and remarketing, for six months.

3.4. Non-essential cookies do not run unless you give consent through the cookie notice panel presented on your first visit to the site. Analytics only runs if you explicitly accept. You may withdraw the consent you have given at any time, via the Cookie preferences link on that same panel or through your browser settings; withdrawal of consent does not affect the lawfulness of processing carried out up to the moment of withdrawal. You may always delete or block cookies through your browser settings; however, if strictly necessary cookies are blocked, some parts of the site may not function properly.

4. PROMOTION AND SALES PROCESSES

4.1. The Company obtains personal data through the contact and quote request forms on the website, lead forms published on Meta (Facebook and Instagram) platforms, sales conversations conducted by telephone, WhatsApp and e-mail, and publicly available sources such as businesses’ own websites, map listings and social media accounts.

4.2. In this process, contact details such as first and last name, telephone and WhatsApp number, e-mail address and business address are processed, together with the business name, field of activity, the content of the request, conversation notes, quote history and information as to which advertising campaign the request came through.

4.3. This data is processed for the purposes of evaluating your request and contacting you, preparing and presenting a quote, conducting sales and marketing activities, and following up requests and complaints. Processing activities relating to responding to the request and presenting a quote rest on the legal ground of being directly related to the establishment of a contract, set out in Article 5(2)(c) of the Law; conducting sales activities and keeping records rest on the legal ground of legitimate interest set out in Article 5(2)(f).

4.4. Commercial electronic messages for promotional, campaign and informational purposes are sent only to recipients who have given consent, in accordance with Law No. 6563 on the Regulation of Electronic Commerce and on the basis of your explicit consent. Consents are recorded in the Message Management System (İYS). You may withdraw the consent you have given at any time and free of charge, through İYS or by using the opt-out link included in every message. Commercial electronic messages may be sent to tradespeople and merchants without prior consent under that Law; even in that case, a right to opt out is granted and an İYS record is made.

4.5. No audio recording is made during sales and support conversations. Only written conversation notes and e-mail and WhatsApp correspondence records are kept. Should audio recording be introduced in future, this notice will be updated and information will be given at the start of the conversation, before recording.

5. CUSTOMER RELATIONS AND PERFORMANCE OF THE SERVICE

5.1. In respect of customers who enter into an agreement with the Company, the following are processed: identity information such as first name, last name and, where necessary for invoicing, Republic of Türkiye identity number or tax identification number; contact details such as telephone, WhatsApp number, e-mail address, address and billing address; customer transaction information such as agreement, order and package details, revision requests and support correspondence; financial information such as invoice records, payment amount, payment date and transaction reference; and other information such as the premises, product, team and business images the customer submits for publication on the website, together with domain name and hosting account details, social media links and opening hours.

5.2. Data within this scope is processed on the legal ground of the establishment and performance of a contract set out in Article 5(2)(c) of the Law, for the purposes of performing the website setup service, providing guidance and support in domain name and hosting processes, and meeting revision, maintenance and support requests; on the legal ground of compliance with a legal obligation set out in Article 5(2)(ç), for invoicing and the retention of books and records; on the legal ground of the establishment, exercise or protection of a right set out in Article 5(2)(e), for asserting and defending legal claims in a possible dispute; and on the legal ground of legitimate interest set out in Article 5(2)(f), for measuring customer satisfaction and presenting completed work as a reference.

5.3. Where material submitted by the Customer for publication on the website contains personal data belonging to third parties, such as employee photographs, customer reviews or reference information, the Customer is the data controller in respect of the collection and publication of that data. The Customer undertakes that it has provided the necessary notice to the relevant persons and has secured the legal ground on which the processing rests. The Company acts as a data processor in respect of that data.

6. TRANSFER OF PERSONAL DATA

6.1. Your personal data may be transferred, limited to the purposes explained above, to: hosting and server service providers for the purpose of hosting the site and the data; domain name registrars in the course of domain registration and renewal; payment institutions and banks for the purpose of collecting payment; accounting and financial advisory service providers for invoicing and the keeping of statutory records; e-mail and customer management system infrastructure providers for correspondence and the conduct of customer relations; advertising platforms such as Meta and Google within the scope of advertising and measurement activities, where your explicit consent exists; the Message Management System (İYS) for the purpose of recording commercial electronic message consents; legal, audit and advisory service providers for the conduct of legal processes; and authorised public institutions and organisations in order to meet requests for information and documents arising from legislation.

6.2. Some of the hosting, e-mail, analytics and advertising service providers used may have servers located abroad. In such cases, the transfer is carried out within the framework of Article 9 of the Law: on the basis of an adequacy decision for transfers to countries in respect of which such a decision exists, and otherwise on whichever of the standard contract, binding corporate rules or explicit consent grounds is appropriate. Where a standard contract is signed, it is notified to the Personal Data Protection Authority within the period prescribed by legislation.

7. METHOD OF COLLECTING PERSONAL DATA

7.1. Your personal data is collected by partly automated and non-automated means, through the forms on the website, lead forms on advertising platforms, telephone, WhatsApp and e-mail correspondence, face-to-face meetings, contract and invoice documents, and cookies.

8. RETENTION PERIOD FOR PERSONAL DATA

8.1. Your personal data is retained for the periods required by the purpose of processing and prescribed by the relevant legislation. Within this framework: traffic and log records for two years under Law No. 5651; contract and customer records for ten years from the end of the relationship, having regard to the general limitation period under the Turkish Code of Obligations; invoice and accounting records for ten years under the Turkish Commercial Code and the Tax Procedure Law; records relating to distance contracts for three years under the Distance Contracts Regulation; request and quote records that did not result in a contract for two years from last contact; commercial electronic message consent records for three years from withdrawal of consent; cookie consent and refusal records for three years; and cookies for the periods stated by type in section three.

8.2. Where the retention period expires or the conditions for processing cease to exist, personal data is deleted, destroyed or anonymised.

9. RIGHTS OF THE DATA SUBJECT

9.1. Under Article 11 of the Law, everyone has the right to apply to the Company and, in respect of themselves: to learn whether their personal data is being processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in accordance with that purpose; to know the third parties to whom the data is transferred, whether in Türkiye or abroad; to request rectification where the data has been processed incompletely or inaccurately; to request erasure or destruction of the data within the conditions of Article 7 of the Law; to request that rectification, erasure and destruction operations be notified to third parties to whom the data has been transferred; to object to an adverse outcome arising from the analysis of the processed data exclusively by automated systems; and to claim compensation for damage suffered as a result of unlawful processing of personal data.

9.2. Applications concerning these rights may be submitted, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by wet-signed petition to MASLAK MAH. AOS 55. SK. 42 MASLAK B BLOK NO: 4 İÇ KAPI NO: 542 SARIYER/İSTANBUL, or to bilgi@ceptesite.com from the e-mail address registered in the Company’s systems. The application must state the applicant’s first and last name; the identity number for citizens of the Republic of Türkiye, or nationality and passport number for foreign nationals; an address for service; the e-mail address and telephone number for notification, if any; and the subject of the request.

9.3. Applications are concluded free of charge as soon as possible according to their nature, and in any event within thirty days of the application reaching the Company. Where the process additionally requires a cost, the fee in the tariff determined by the Personal Data Protection Board may be charged. Where the application is rejected, the response is found insufficient, or no response is given within the period, a complaint may be lodged with the Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the date of application.

10. DATA SECURITY

10.1. The Company takes the necessary technical and administrative measures to provide an appropriate level of security, in order to prevent the unlawful processing of and unlawful access to personal data, and to ensure the safekeeping of the data. These measures include access authorisation, strong authentication, encryption in the transmission and storage of data, regular backups, confidentiality undertakings obtained from employees, and data processing agreements concluded with service providers.

11. CHANGES

11.1. This Privacy Notice may be updated in line with changes in legislation and developments in business processes. The current text is published at ceptesite.com and its effective date is shown at the beginning of the text.