Privacy notice on the processing of personal data
Version 2 · effective 5 Oct 2026, 19:35
DRAFT — this text has not yet been through legal review.
Text prior to lawyer approval. The information in square brackets will be completed in the legal review.
Data controller
This disclosure explains, under art. 10 of Law No. 6698 on the Protection of Personal Data (KVKK), how your personal data is processed on the promotion and sign-up site of the AcenteKit platform (the main site). Data controller: [name, address and contact details of the data controller]. Our service is directed at travel agencies in Türkiye. For data belonging to an agency's customers on agency sites and panels, the data controller is the agency concerned; the platform acts there as data processor.
Which data we process and for what purpose
Sign-up (pre-registration and account opening)
First name, surname, agency name, email, telephone, requested subdomain, selected plan, the versions of the contracts you accepted and the time of acceptance, and your commercial message preference. Purpose: verifying your email address, opening the subscription and your panel, and concluding and performing the contract. Legal basis: conclusion and performance of a contract (KVKK art. 5/2-c). If sign-up is completed, the data is kept as the record of your account for the duration of the subscription and for the period required by legislation. The personal data of pre-registrations that are not completed and are abandoned is anonymised 30 days after the last action.
Demo request and contact form
Full name, company, email, telephone, city, the plan you are interested in and your message. Purpose: answering your request, meeting with you and presenting our product; meeting notes are kept by our sales team. Legal basis: pre-contractual discussion for a contract to be concluded at your request and legitimate interest (KVKK art. 5/2-c, 5/2-f). Anonymised 24 months after our last meeting.
Payment
The subscription payment is taken on the page of the payment service provider Stripe; your card details do not reach us and are not stored in our system. From Stripe we receive only the customer and subscription identifier, the payment status and the invoice amount. Legal basis: performance of a contract (KVKK art. 5/2-c) and an obligation arising from tax legislation (KVKK art. 5/2-ç).
Email messages
Verification, welcome, password-setting and account-related notifications are transactional messages and are sent for the performance of the contract. Campaign and announcement emails are sent only if you gave commercial message consent; the time of consent is the moment you verify your email address, and you can withdraw consent from the link in every message.
The site's own traffic measurement
The page opened, time, device class, language, the domain name of the referring site, and the type of campaign tags with a shortened campaign name; your IP address and browser identifier are not stored, and nothing is written to your device. Purpose: measuring the operation of the site and visit channels in aggregate. Legal basis: legitimate interest (KVKK art. 5/2-f). Raw records 90 days, daily summaries 25 months. You can object with the "Don't measure this browser" link in the footer.
Cookies, measurement and advertising
Google Analytics, Google Ads and Meta cookies and the advertising click identifier; details are in the cookie policy. These cookies are on by default until you make a choice; when you say "Decline", processing for these purposes stops, advertising tags are not loaded and the relevant cookies on this site's domains are deleted. Legal basis: [legal basis for measurement and advertising cookies: to be determined in the legal review].
Server logs
Time, domain name, the path of the requested page (with the query part and long keys hidden), result code and response time; IP address, browser identifier and referring address are not written. Purpose: information security and fixing faults. Legal basis: legitimate interest (KVKK art. 5/2-f). Retention: 14 days.
Transfers
To enable us to provide the service, your personal data may be transferred to the following groups of recipients: hosting and server service provider, email delivery service provider, payment service provider (Stripe), measurement and advertising providers (Google, Meta) if you have not said "Decline", and authorised public bodies and institutions (where legally required). Some of these providers are located abroad; the basis for the transfer abroad: [transfer basis under KVKK art. 9: to be determined in the legal review]. Server location: [server location].
Your rights
Under KVKK art. 11, you have the right to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of processing and whether it is used in line with that purpose, to know the third parties to whom it is transferred, to request correction if it is incomplete or inaccurate, to request erasure or destruction if the conditions are met, to request that these actions be notified to the persons to whom the data was transferred, to object to a result against you arising from analysis exclusively by automated systems, and to claim compensation if you suffer damage from unlawful processing. If you are visiting from the European Union, your rights under GDPR art. 15–22 are also reserved.
You can send your applications through the "Contact us" form on the site or to [application email]; we reply within 30 days at the latest. Your right to complain to the Personal Data Protection Board is reserved.