Last updated: 9 October 2026
At ZTY Digital, we place importance on protecting personal data, maintaining its security, and ensuring transparency in our processing activities.
Under Turkish Personal Data Protection Law No. 6698 (“KVKK”), the data controller is
Ilgın Öztay.
This Personal Data Protection Notice explains the purposes, legal grounds, and possible recipients of personal data collected through ztydigital.com, the Free Analysis form, Strategy Consultation applications, contact forms, and other communication channels through which you interact with us.
What personal data do we process?
Depending on your application and the communication channel you use, we may process the following information:
- Full name
- Email address
- Phone or WhatsApp number, if provided
- Company, business, or brand name
- Website address
- Industry and business sector
- Requested services, business objectives, and challenges
- Information voluntarily provided in application forms
- Application date, source, and status
- Consultation requests, appointment details, and communication records
- CRM follow-up notes related to the evaluation of your application
- Marketing communication permissions, withdrawal preferences, and related records
- Limited technical records necessary for website and form security
Why do we process your personal data?
Your personal data may be processed to the extent necessary for the following purposes:
- Receiving and evaluating Free Analysis and Strategy Consultation applications
- Reviewing your business needs and potential cooperation opportunities
- Contacting you regarding your application
- Scheduling and conducting consultations and appointments
- Providing requested information, service details, and proposals
- Managing prospective client relationships and application statuses through CRM systems
- Maintaining consultation notes and subsequent communication activities
- Sending service-related communications directly connected to your request
- Sending commercial marketing communications where the necessary permissions have been obtained
- Maintaining website security, preventing misuse, and complying with legal obligations
Submitting an application does not automatically mean that you agree to receive marketing emails. Where required, permission for commercial electronic communications is requested separately and remains optional.
Legal grounds for processing personal data
Your personal data may be collected electronically through website forms, email correspondence, consultations initiated by you, and appointment scheduling systems.
Depending on the processing activity, we may rely on the following legal grounds under Article 5 of the KVKK:
- Processing necessary for the establishment or performance of a contract
- Processing necessary for compliance with the data controller’s legal obligations
- Processing necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed
- Explicit consent where required for the relevant processing activity
Each processing activity is assessed according to its specific purpose and legal basis. Where explicit consent is required, it is requested separately.
With whom may personal data be shared?
Where necessary for the stated purposes, personal data may be shared with the following categories of recipients:
- Website hosting and technical infrastructure providers
- Form, CRM, and application management service providers
- Email delivery and communication infrastructure providers
- Online calendar and video conferencing providers, where used
- Authorized technical support providers involved in service operations
- Public authorities legally entitled to receive such information
We do not sell personal data to third parties for independent advertising or marketing purposes.
Depending on the infrastructure of the service providers used, personal data may be transferred outside Türkiye. Such transfers must comply with Article 9 of the KVKK and the applicable legal safeguards.
Application follow-up and marketing preferences
Communications necessary to evaluate your application are distinguished from commercial marketing communications.
- Marketing permission is optional.
- You may request a consultation or analysis without providing marketing permission.
- Where the necessary permissions exist, a limited number of follow-up emails about our services and consultation opportunities may be sent.
- Consent, withdrawal, and communication preference records may be maintained.
- You may withdraw your marketing communication permission.
- Applicable legislation and Turkish Message Management System (İYS) obligations are taken into account.
Your marketing opt-out preference is handled separately from legally necessary transactional communications relating to your application.
Data retention and security
Personal data is retained for as long as necessary for the purposes for which it is processed, subject to applicable legal retention obligations.
Retention and disposal periods for application records, communication histories, and consent records are determined according to the relevant data category, processing purpose, and legal obligations.
Appropriate technical and organizational security measures are implemented to protect personal data against unlawful processing and unauthorized access.
When the processing purpose ends and no other legal basis requires retention, personal data is deleted, destroyed, or anonymized in accordance with applicable legislation.
Your rights under the KVKK
Subject to the applicable legal requirements, Article 11 of the KVKK provides the following rights:
- To learn whether your personal data is being processed
- To request information if your personal data has been processed
- To learn the purposes of processing and whether the data is used accordingly
- To learn the third parties to whom your personal data has been transferred
- To request correction of incomplete or inaccurate personal data
- To request deletion or destruction under the applicable legal conditions
- To request notification of relevant corrections or deletions to third parties
- To object to adverse outcomes resulting exclusively from automated analysis
- To claim compensation for damages arising from unlawful processing
Requests and contact information
You may submit requests concerning your personal data to the data controller in accordance with the KVKK and applicable application procedures. Requests are assessed within the procedures and time limits established by applicable legislation.