Personal Data Protection Notice and Privacy Policy

1.Purpose and Scope

This Privacy Notice and Privacy Policy (the “Notice”) has been prepared by Flek Reklam ve Danışmanlık Ltd. Şti. (the “Company”), in its capacity as data controller, pursuant to the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

The purpose of this Notice is to inform visitors of the website at https://flekworks.com (the “Website”) and natural persons who contact the Company by email, submit a project request or apply for a position (each a “Data Subject”) of the purposes and legal grounds for which their personal data is processed, the parties to whom it may be transferred, the method of collection and their rights under KVKK.

2.Data Controller

Under KVKK, the data controller is Flek Reklam ve Danışmanlık Ltd. Şti., whose trade name and contact details are set out above.

3.Personal Data Processed, Purposes and Legal Grounds

The categories of personal data processed by the Company, the purposes of processing and the legal grounds under Article 5(2) of KVKK are set out below:

The Company does not request special categories of personal data (KVKK Art. 6) through the Website. Data Subjects are kindly requested not to include such data in their applications or correspondence; any such data received will be destroyed without being considered.

4.Method of Collection

Personal data is collected by automated means during visits to the Website (requests sent by the browser and server logs) and by partially automated means through information sent by the Data Subject to the Company by email.

Visit statistics are kept on the Company’s own server. For this purpose, the IP address and browser information are used only momentarily, by passing them together with a random key that is specific to that day and replaced daily through a one-way hash function; the IP address is not recorded. As the daily key is deleted within 24 hours, the resulting code can no longer be associated with any person and the remaining records become anonymous statistics. These records are not used for profiling, advertising or marketing purposes.

5.Cookies and Similar Technologies

The Website does not place cookies on visitors’ devices and does not use local storage, pixels, device fingerprinting or similar tracking technologies. Accordingly, no cookie preference notice is displayed on the Website.

A strictly necessary session cookie is used solely when authorised Company personnel sign in to the administration panel, in order to maintain the session. This cookie does not apply to visitors of the Website.

6.Third-Party Content

Video content on the Website is provided through the YouTube service operated by Google Ireland Limited / Google LLC. The video player is not loaded until the Data Subject presses the play button, and no personal data is transmitted to YouTube until then. If the Data Subject plays a video, data relating to their IP address, device and viewing behaviour may be processed by YouTube on servers located abroad under its own privacy policy, and cookies may be used. Google acts as data controller for such processing. For further information, please refer to the Google Privacy Policy.

Links to Instagram, YouTube, Vimeo, LinkedIn and Behance on the Website serve for redirection only; no data is transmitted to these platforms unless the relevant link is clicked. Any activity on these platforms is subject to their respective privacy policies.

7.Transfer of Personal Data

Personal data may be transferred to the following recipient groups, limited to the purposes stated above and subject to the conditions set out in Articles 8 and 9 of KVKK:

1. Suppliers: the hosting service provider established in Türkiye, for the purpose of hosting the Website and email infrastructure and limited to the provision of that service;
2. Authorised public authorities and judicial bodies: within the scope of statutory obligations and to the extent requested;
3. Business partners: within the scope of a project or application, with the Data Subject’s knowledge and limited to the purpose.

The Company does not sell personal data to third parties or share it with advertising networks. The Company does not transfer personal data abroad; processing in connection with the YouTube service described in Section 6 takes place through a connection established directly with the relevant service provider upon the Data Subject playing a video.

8.Retention Periods and Destruction

Personal data is retained for as long as necessary for the purpose for which it is processed and for the periods prescribed by applicable legislation:

1. Visit statistics: the daily key that would allow records to be associated with a person is deleted within 24 hours; anonymised statistical records may be retained without time limit.
2. Server access logs: for the periods required by the hosting provider’s information security practices and applicable legislation, in particular Law No. 5651.
3. Email correspondence and request information: for the duration of the discussion or business relationship and, after its termination, for as long as necessary with regard to potential disputes and legal obligations, and in any event for no longer than 10 (ten) years.
4. Job and collaboration applications: for no longer than 2 (two) years from the conclusion of the application.

Upon expiry of the retention period or where the conditions for processing no longer exist, personal data is deleted, destroyed or anonymised ex officio or upon the Data Subject’s request in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

9.Data Security

Pursuant to Article 12 of KVKK, the Company takes the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent unlawful processing of and unlawful access to personal data and to ensure its safekeeping. These measures include encrypted connections (HTTPS), restriction of access rights, firewalls and the use of up-to-date software.

10.Rights of the Data Subject

Pursuant to Article 11 of KVKK, the Data Subject has the right to apply to the Company to:

1. learn whether their personal data is processed;
2. request information if their personal data has been processed;
3. learn the purpose of processing and whether the data is used in accordance with that purpose;
4. know the third parties in Türkiye or abroad to whom the personal data is transferred;
5. request rectification of incomplete or inaccurate personal data;
6. request deletion or destruction of personal data under the conditions set out in Article 7 of KVKK;
7. request notification of the operations under (e) and (f) to third parties to whom the personal data has been transferred;
8. object to a result against them arising from analysis of the processed data exclusively through automated systems;
9. claim compensation for damage suffered as a result of unlawful processing of personal data.

11.Application Procedure

The Data Subject may submit requests concerning the above rights in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, stating their name, surname, signature (for written applications), Turkish ID number (or, for foreign nationals, nationality and passport or identity number), residential or business address for notification, email address for notification (if any), telephone number and the subject of the request:

1. in writing, in person or through a notary public, to the Company address stated above; or
2. using a secure electronic signature, mobile signature or an email address previously notified to the Company and registered in the Company’s records, to meet@flekworks.com, with “KVKK Information Request” in the subject line.

The Company will conclude the request free of charge as soon as possible depending on its nature and within 30 (thirty) days at the latest. Where the process requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board. If the request is rejected, the response is found insufficient or no response is given in due time, the Data Subject may file a complaint with the Personal Data Protection Board pursuant to Article 14 of KVKK.

12.Amendments and Effective Date

The Company reserves the right to update this Notice in line with changes in legislation or in its data processing activities. The updated Notice enters into force on the date of its publication on the Website; the effective date is stated at the top of the Notice. In the event of any discrepancy between the Turkish and English versions of this Notice, the Turkish version shall prevail.