Data Protection Notice
The formal notice explaining the legal basis on which your personal data is processed, your rights, and how to exercise them.
This notice does two jobs at once: it discharges our duty to inform under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK), and it provides the information required by Articles 13-14 of the EU General Data Protection Regulation (GDPR).
1. Identity of the controller
| Field | Detail |
|---|---|
| Legal entity | Mekjoy Dijital Bilişim Anonim Şirketi |
| Address | Meclis Mah. Derviş Sk. No: 38 Sancaktepe/İstanbul |
| info@mekjoy.com | |
| Phone | +90 850 840 79 00 |
2. Controller or processor
This distinction is the most important part of this notice; it determines which rights you hold against whom.
| Data | Our role | What it means |
|---|---|---|
| Your account, workspace, invoices, session and support records | Controller | We determine the purpose and the means. You exercise your rights directly against us. |
| Data we pull from your ad accounts and stores | Processor | We process it on your instructions. Where that data contains personal data of third parties, YOU are the controller towards them. |
In practice the second row means: for customer lists, conversion data or order information in your ad account, the duty to inform and the legal basis are your responsibility. We process that data only to provide the service to you, and never outside your instructions.
3. Categories of personal data processed
| Category | Content |
|---|---|
| Identity | First name, last name |
| Contact | Email address, phone number (optional), notification accounts |
| Customer transaction | Subscription, plan, credit movements, invoice and payment records |
| Transaction security | IP address, user agent, session records, password hash, audit log |
| Financial | Billing name, address, tax office and number |
| Professional | Your role within the workspace |
| Visual | Profile photo (if you upload one), images used in creative generation |
| Requests and complaints | Support tickets and the content of correspondence |
4. Purposes and legal bases
| Purpose | KVKK basis | GDPR basis |
|---|---|---|
| Account creation, authentication, delivery of the service | Art. 5/2-c — conclusion and performance of a contract | Art. 6(1)(b) — contract |
| Subscription, invoicing and payment | Art. 5/2-c and 5/2-ç — legal obligation | Art. 6(1)(b) and 6(1)(c) |
| Ad account analysis, reporting, automation | Art. 5/2-c — performance of a contract | Art. 6(1)(b) — contract |
| Service security, abuse prevention, audit logging | Art. 5/2-f — legitimate interest | Art. 6(1)(f) — legitimate interest |
| Product improvement (aggregated and de-identified) | Art. 5/2-f — legitimate interest | Art. 6(1)(f) — legitimate interest |
| Use of non-Turkish providers in AI features | Art. 9 — explicit consent or appropriate safeguards | Art. 44-49 — appropriate safeguards |
| Optional marketing messages | Art. 5/1 — explicit consent | Art. 6(1)(a) — consent |
| Defence of legal claims and disputes | Art. 5/2-e — establishment and protection of a right | Art. 6(1)(f) — legitimate interest |
| Statutory retention obligations | Art. 5/2-ç — legal obligation | Art. 6(1)(c) — legal obligation |
Wherever we rely on legitimate interest we carry out a balancing test, and your right to object to that processing remains reserved.
5. How data is collected
- Directly from you: the sign-up form, entries in the dashboard, support tickets, the billing profile.
- Automatically: technical records generated when you sign in and use the dashboard.
- From third parties: the APIs of the advertising and commerce platforms you authorise, and transaction results from the payment institution.
Collection is entirely electronic, by automated and partly automated means.
6. Transfers
Domestic transfers (KVKK Art. 8)
To our hosting, payment and email infrastructure providers; to competent public authorities where legally required; and to the parties providing us legal advice and audit services.
International transfers (KVKK Art. 9 / GDPR Art. 44-49)
The AI providers (Anthropic, fal.ai, HeyGen, FASHN), file storage (Cloudflare R2) and the ad platforms you connect are located outside Türkiye.
- Where the transfer is to a country covered by an adequacy decision of the Turkish Board, that decision is relied upon.
- Otherwise appropriate safeguards such as standard contractual clauses or binding corporate rules are relied upon.
- Where no appropriate safeguard exists, the transfer takes place only with your explicit consent. You can prevent this transfer entirely by choosing not to use the AI features.
7. Retention and disposal
Personal data is retained for as long as the purpose requires and for the minimum periods prescribed by law. The periods are listed category by category in the table in the Privacy Policy.
When a period expires the data is deleted, destroyed or anonymised. Periodic disposal is carried out at the intervals the legislation prescribes.
8. Your rights under the KVKK (Art. 11)
By applying to the controller you may request to:
- Learn whether your personal data is being processed.
- Request information about it if it has been processed.
- Learn the purpose of processing and whether the data is used in line with that purpose.
- Know the third parties to whom the data has been transferred, in Türkiye or abroad.
- Request correction where the data is incomplete or inaccurate.
- Request erasure or destruction under the conditions of Article 7 of the KVKK.
- Request that correction, erasure and destruction be notified to the third parties to whom the data was transferred.
- Object to a result against you arising from analysis solely by automated systems.
- Claim compensation where you suffer loss because of unlawful processing.
9. Your rights under the GDPR
In addition to the rights above, if you fall within the scope of the GDPR you also have:
- The right of access (Art. 15) — to obtain a copy of your data.
- The right to rectification (Art. 16).
- The right to erasure, the “right to be forgotten” (Art. 17).
- The right to restriction of processing (Art. 18).
- The right to data portability (Art. 20) — to receive your data in a structured, machine-readable format and transmit it to another controller.
- The right to object (Art. 21) — in particular to processing based on legitimate interest and to direct marketing.
- The right not to be subject to automated decision-making (Art. 22).
- The right to withdraw consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing before it.
10. Automated decision-making and profiling
Mentorivo performs automated operations on advertising campaigns: when a rule's condition is met a campaign may be paused or its budget changed.
- These decisions concern campaigns. They are not decisions producing legal effects concerning a natural person or similarly significantly affecting them.
- You define the rules, you can switch them off at any time, and every run is written to the audit log.
- Proposals produced by the agent are not applied until you approve them — human oversight is written into the product's architecture.
The ad platforms' own targeting and optimisation algorithms fall outside this and are subject to those platforms' own privacy notices.
11. How to make a request
You may submit KVKK requests, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, through:
- A signed written petition delivered to Meclis Mah. Derviş Sk. No: 38 Sancaktepe/İstanbul in person or through a notary.
- A request document signed with a secure electronic signature or mobile signature, sent to info@mekjoy.com.
- An email from the address registered in our system to info@mekjoy.com.
Your request must state your name and surname, your signature (for written applications), your Turkish ID number or passport number for foreign nationals, an address for notification, your email and phone if any, and the subject of your request.
Requests are concluded free of charge within 30 days at the latest. Where the operation entails an additional cost, the fee set in the Board's tariff may be charged.
If your request is refused, if you find the answer insufficient, or if you receive no answer within 30 days, you may complain to the Turkish Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the application.
If you fall within the scope of the GDPR, your right to lodge a complaint directly with the data protection authority of your country remains reserved.
12. Changes to this notice
We may update this notice as legislation or our processing activities change. The current version is always published at this address; the version number and effective date appear at the top of the page.