Skip to content
OXXI Digital — Digital Performance Agency

Privacy Notice (KVKK)

Saray Dijital Medya Hizmetleri — Website Privacy Notice under Personal Data Protection Law No. 6698

Last updated: 29 September 2026

1. Data Controller

Under Personal Data Protection Law No. 6698 (“KVKK” or the “Law”), your personal data is processed, in the capacity of data controller, by

Betül Saray – Saray Dijital Medya Hizmetleri
(“Saray Dijital”).

OXXI Digital is a brand/trade name used by Saray Dijital. Saray Dijital is the data controller with respect to personal data.

2. Purpose and Scope of this Notice

This Privacy Notice has been prepared to inform you about the collection and processing of your personal data through the website and digital channels operated by Saray Dijital.

This notice covers persons visiting our website; persons filling in the contact, quote, meeting, demo and similar forms on our website; persons requesting information or quotes about digital marketing services; existing and potential customers; business partners and suppliers; and persons contacting Saray Dijital through social media and other digital channels.

Your personal data is processed lawfully and in good faith, for specific, explicit and legitimate purposes, and in a manner that is relevant, limited and proportionate to the purposes for which it is processed.

3. Personal Data Processed

When you contact Saray Dijital through the website or digital channels, the following categories of personal data may be processed, depending on the nature of the relevant transaction and request:

Identity Information

  • First name
  • Last name

Contact Information

  • Phone number
  • Email address
  • Your communication preferences

Customer and Transaction Information

  • Company name or title
  • Your role/position
  • Website or business information
  • Advertising budget information
  • Services you request
  • Your service and quote requests
  • Messages and explanations you provide in forms or during communication
  • Information relating to meeting and quote processes

Digital Marketing and Source Information

  • Advertising and campaign source information
  • UTM and similar campaign parameters
  • Referring page and form source information
  • Online identifiers

Transaction Security Information

  • IP address
  • Website access date and time information
  • Log records
  • Technical connection and security records
  • Technical records created to ensure the security of the website

4. Method of Collecting Personal Data

Your personal data may be collected through

  • the forms on the https://www.oxxidigital.com website,
  • contact and quote requests,
  • email,
  • phone calls,
  • social media accounts and social media communication channels,
  • lead forms created through digital advertising platforms,
  • online meetings and calls,
  • customer or potential customer communication processes,
  • the technology and communication services used

in electronic or physical environments, by fully or partially automated methods, or by non-automated methods provided that they form part of a data recording system.

5. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

  • Evaluating your information, quote, demo, meeting and consultancy requests,
  • Contacting you regarding your request,
  • Providing information about digital marketing services,
  • Preparing services and offers suited to your needs,
  • Carrying out potential customer processes,
  • Managing existing customer relationships,
  • Managing customer and service processes,
  • Carrying out contract processes,
  • Carrying out sales and marketing processes,
  • Improving service quality and customer experience,
  • Managing request and communication records,
  • Carrying out information security processes,
  • Ensuring the security and technical continuity of the website,
  • Preventing misuse, fraud, unauthorised access and security breaches,
  • Fulfilling obligations arising from legislation,
  • Responding to legal requests from authorised persons, institutions and organisations,
  • Monitoring legal proceedings and disputes,
  • Carrying out accounting, invoicing and financial processes,
  • Carrying out advertising and marketing activities,
  • Carrying out personalised advertising and marketing activities where explicit consent is required.

6. Legal Grounds for Processing Personal Data

Your personal data is processed within the scope of the data processing conditions set out in Article 5 of the Law, on the legal grounds that

  • it is directly related to and necessary for the establishment or performance of a contract,
  • it is mandatory for the data controller to fulfil its legal obligations,
  • data processing is mandatory for the establishment, exercise or protection of a right,
  • data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,
  • it is expressly provided for by law,
  • you have given your explicit consent, where required.

7. Transfer of Personal Data

In line with the purposes of processing and in accordance with the conditions set out in the Law, your personal data may be transferred to the following recipients or groups of recipients:

  • Technology, software, hosting, cloud and infrastructure service providers: to store data securely, operate the technical infrastructure and ensure the continuity of the website,
  • CRM, communication and digital marketing service providers: to carry out customer and potential customer processes and to conduct communication and marketing activities,
  • Advertising and social media platforms: to carry out advertising and marketing activities,
  • Financial advisers, accounting, legal and consultancy service providers: to carry out financial, legal and consultancy processes,
  • Courier and communication service providers: to carry out communication and delivery processes,
  • Authorised public institutions and organisations, and judicial and administrative authorities: to fulfil legal obligations and carry out legal proceedings

Such transfers are made in accordance with the conditions set out in Articles 8 and 9 of the Law.

8. Retention Period of Personal Data

Your personal data is retained for as long as necessary for the purpose requiring its processing, taking into account the retention periods and statutes of limitation set out in the relevant legislation.

In determining the retention period, commercial and contractual relationships, accounting and tax legislation, the Turkish Commercial Code, the Turkish Code of Obligations, Law No. 5651 and related legislation, statutes of limitation for legal disputes and information security requirements are taken into account.

Where the purpose of processing no longer exists and there is no other legal ground requiring the data to be retained, your personal data is deleted, destroyed or anonymised in accordance with the relevant legislation.

9. Website and Cookies

Detailed information on the cookies and similar technologies used on our website is available in our Cookie Policy.

10. Security of Personal Data

Saray Dijital takes technical and administrative measures appropriate to the nature of the data processed and the risks involved, in order to prevent your personal data from being unlawfully processed or accessed, lost, or used by unauthorised persons.

11. Rights of the Data Subject

Under Article 11 of the Law, you have the right to

  • learn whether your personal data is being processed,
  • request information about it if it has been processed,
  • learn the purpose of processing and whether it is used in accordance with that purpose,
  • know the third parties in Türkiye or abroad to whom it has been transferred,
  • request its correction if it has been processed incompletely or inaccurately,
  • request its deletion or destruction within the framework of the conditions set out in the Law,
  • request that correction, deletion or destruction be notified to the third parties to whom it has been transferred,
  • object to a result against you arising from analysis exclusively through automated systems,
  • claim compensation if you suffer damage as a result of unlawful processing.

12. How to Apply

You may exercise your rights under Article 11 of the Law, within the scope of the Communiqué on the Procedures and Principles of Application to the Data Controller, through the following channels:

Your applications are concluded as soon as possible, depending on the nature of the request, and within 30 days at the latest. If the procedure requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

13. Entry into Force and Updates

This Privacy Notice may be updated in line with changes in legislation, decisions of the Personal Data Protection Board or our personal data processing activities.

The current version is valid from the date it is published on our website.

Data Controller: Betül Saray – Saray Dijital Medya Hizmetleri
Website: https://www.oxxidigital.com
Email: info@saraydijital.com.tr
KEP: betul.saray@hs01.kep.tr
Phone: +90 850 302 03 91