Privacy Policy

Effective Date: September 28, 2026

Kurgu Digital Agency (“Kurgu Digital”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit kurgudigital.com, contact us, request information about our services, or otherwise interact with us.

This Policy has been prepared with consideration of applicable data protection legislation, including the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the European Union General Data Protection Regulation (“GDPR”).

1. Data Controller

For the purposes of applicable data protection legislation, the data controller is:

Kurgu Digital Agency
Mahmutbey Avenue, Sakarya Cikmazi Street
Gul Business Center No: 1, Floor: 4, Offices: 43-44
34188 Bahcelievler / Istanbul / Turkey

E-mail: support@kurgudigital.com

2. Information We May Collect

Depending on how you interact with our website and services, we may collect the following categories of personal information:

Information You Provide to Us

When you contact us by e-mail, telephone, WhatsApp or another communication channel, we may collect information such as:

Your consent
The necessity of processing in order to take steps at your request before entering into a contract
Performance of a contract
Compliance with a legal obligation
Establishment, exercise or protection of legal claims
Our legitimate interests in operating, securing and improving our business and services, provided that such interests do not override your fundamental rights and freedoms
Other legal grounds permitted under applicable data protection legislation

Please do not provide sensitive personal information unless it is necessary for your request.

Technical and Usage Information

When you visit our website, certain technical information may be automatically collected by our servers or service providers, including:

IP address
Browser type and version
Device type
Operating system
Date and time of access
Pages visited
Referring website or source
Technical log and security information
Approximate geographic information derived from an IP address

This information may be used for website operation, security, troubleshooting, analytics and performance improvement.

3. How We Use Personal Data

We may process personal data for the following purposes:

Responding to enquiries and contact requests
Preparing quotations and service proposals
Communicating with prospective and existing customers
Providing web design, e-commerce, SEO, digital advertising and related services
Establishing and managing business relationships
Providing customer support
Managing contractual and commercial processes
Maintaining the security and technical operation of our website
Detecting and preventing fraud, misuse or security incidents
Improving our website, services and user experience
Complying with accounting, tax, administrative and other legal obligations
Establishing, exercising or protecting legal rights
Sending marketing or promotional communications where permitted by law and, where required, after obtaining consent

Personal data will not be used for purposes incompatible with those for which it was originally collected unless permitted by applicable law.

4. Legal Bases for Processing

Depending on the circumstances and applicable legislation, we may process personal data on one or more of the following legal bases:

Your consent
The necessity of processing in order to take steps at your request before entering into a contract
Performance of a contract
Compliance with a legal obligation
Establishment, exercise or protection of legal claims
Our legitimate interests in operating, securing and improving our business and services, provided that such interests do not override your fundamental rights and freedoms
Other legal grounds permitted under applicable data protection legislation

Where processing is based on consent, you may withdraw your consent at any time, without affecting processing lawfully carried out before withdrawal.

5. Cookies and Similar Technologies

Our website may use cookies and similar technologies required for website functionality, security, performance, analytics or user preferences.

Some cookies may be necessary for the website to function correctly, while other cookies may be used only with your consent where required by applicable law.

You can manage or delete cookies through your browser settings. Disabling certain cookies may affect some features or functionality of the website.

Further information regarding cookies and similar technologies may be provided in our separate Cookie Policy.

6. Third-Party Services

Our website may contain integrations, links or embedded content provided by third parties.

These may include services such as:

Google Maps

Our contact pages may use Google Maps to display the locations of our offices. When Google Maps content is loaded, Google may receive technical information such as your IP address, device information and browser information.

Google processes such data according to its own privacy policies and terms.

Our website may contain links allowing visitors to contact us through WhatsApp.

If you choose to use WhatsApp, information you provide through that service may also be processed by WhatsApp and its affiliated companies according to their own privacy policies.

Social Media and External Platforms

Our website may contain links to social media platforms, external websites or other third-party services.

When you visit those services, their own privacy policies and terms will apply. Kurgu Digital Agency does not control the privacy practices of independent third-party websites or platforms.

7. Sharing of Personal Data

We do not sell personal data.

Personal data may, where necessary and legally permitted, be shared with:

Hosting and infrastructure providers
IT and cybersecurity service providers
E-mail and communication service providers
Analytics and technical service providers
Professional advisers, accountants and legal advisers
Business partners involved in providing requested services
Authorized public institutions and regulatory authorities
Courts, law enforcement authorities or administrative bodies where legally required

Service providers processing personal data on our behalf are expected to process such information only for authorized purposes and to implement appropriate safeguards.

8. International Data Transfers

Kurgu Digital Agency operates internationally and maintains business contacts or representation in different countries.

Some of our service providers or technology partners may also process information outside Turkey or outside the country in which you are located.

Where personal data is transferred internationally, we take reasonable steps to ensure that such transfers are carried out in accordance with applicable data protection legislation and, where required, appropriate safeguards are used.

Such safeguards may include contractual arrangements, standard contractual clauses, adequacy mechanisms, explicit consent where legally appropriate, or another lawful international transfer mechanism.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy and for any additional period required by applicable legal, tax, accounting or regulatory requirements.

The appropriate retention period may depend on:

The nature and purpose of the information
The duration of our business relationship
Legal or contractual requirements
Statutory limitation periods
Security and dispute-resolution requirements

When personal data is no longer required, it may be deleted, destroyed or anonymized in accordance with applicable legal requirements.

10. Data Security

We implement reasonable technical and organizational measures designed to protect personal data against:

Unauthorized access
Unlawful processing
Accidental loss
Alteration
Disclosure
Destruction

However, no website, electronic communication or internet-based storage system can be guaranteed to be completely secure.

11. Your Rights Under Turkish Data Protection Law

If the Turkish Personal Data Protection Law No. 6698 applies to the processing of your personal data, you may have rights including the right to:

Learn whether your personal data is being processed
Request information about the processing of your personal data
Learn the purpose of processing and whether the data is being used in accordance with that purpose
Learn the third parties to whom your personal data has been transferred
Request correction of incomplete or inaccurate personal data
Request deletion or destruction of personal data where the applicable legal requirements are met
Request notification of correction, deletion or destruction to third parties to whom the data has been transferred where applicable
Object to certain results arising from the analysis of your personal data through automated systems
Claim compensation where you suffer damage as a result of unlawful processing, subject to applicable law

Requests regarding your personal data may be submitted using the contact details provided in this Privacy Policy.

12. Rights of Individuals in the European Economic Area

Where the GDPR applies, you may have the right to:

Access your personal data
Correct inaccurate or incomplete information
Request deletion of your personal data
Restrict certain processing activities
Object to processing based on legitimate interests
Object to direct marketing
Receive certain personal data in a portable format
Withdraw consent where processing is based on consent
Lodge a complaint with the competent data protection supervisory authority

These rights may be subject to limitations or exemptions under applicable law.

13. Automated Decision-Making

We do not currently use the personal data collected through this website to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals.

If this changes, appropriate information will be provided as required by applicable law.

14. Children's Privacy

Our website and services are primarily intended for businesses and adult users.

We do not knowingly collect personal data from children through this website for marketing or commercial purposes.

If we become aware that personal data relating to a child has been collected inappropriately, we will take reasonable steps to delete or otherwise handle the information in accordance with applicable law.

15. External Links

Our website may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices, security or content of external websites. We recommend reviewing the privacy policy of each external service before providing personal information.

16. Marketing Communications

Where permitted by applicable law, we may use contact information to communicate with existing or prospective customers about our services.

Where consent is legally required for electronic marketing communications, such communications will be sent only after the necessary consent has been obtained.

You may request to stop receiving marketing communications at any time.

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, technology, business practices or applicable legal requirements.

The latest version will be published on this page together with its effective date.

We recommend reviewing this Privacy Policy periodically.

18. Contact Us

For questions regarding this Privacy Policy, the processing of your personal data or the exercise of your privacy rights, you may contact: