Privacy Notice
This notice explains how we process your personal data when you visit adzento.com, submit a form on our site or the form that opens inside our Facebook and Instagram ads (Meta instant form), or email us. It is provided under Article 13 of the EU General Data Protection Regulation (GDPR), the UK GDPR and Article 10 of Türkiye’s Personal Data Protection Law No. 6698 (KVKK).
1. Who we are
| Item | Details |
|---|---|
| Controller | Alperen Şen (Adzento) |
| Address | Geçit Mah. 6. Gümüş Sk. No: 6 İç Kapı No: 14, Osmangazi / Bursa |
| info@adzento.com | |
| Phone | +90 224 334 04 55 |
| Data protection officer | Not appointed, as not required under GDPR Article 37 for our processing |
2. Personal data we process
| Category | Data | When |
|---|---|---|
| Identity | Full name | When you submit the quote, free audit or contact form, or the Meta instant form |
| Contact | Email address, phone number (optional on website forms, required on the Meta instant form) | When you submit a form or email us |
| Business | Company name (optional), website address (required in the audit form and the Meta instant form), target country (audit form only), what your website is used for (selling products, offering services, presenting a company, or a blog or personal site, Meta instant form only) | When you submit a form (fields vary by form) |
| Request content | Your message (contact form), the form type and page language | When you submit a form or email us |
| Request source | For forms on our site, the page you submitted the form on and the campaign details in the link that brought you to the site (UTM parameters, i.e. source, medium, campaign, ad name and term). For the Meta instant form, our request tracking sheet records only that the request came through it | When you submit a form on our site (except requests sent from the EU, the EEA and the UK) or the Meta instant form |
| Ad page view count | The page opened, time of opening, campaign tags in the page address (UTM), whether you came from a Google ad, country | When you open a page our ads lead to (except visits from the EU, the EEA and the UK) |
| Form and cookie choice count | That a field of the form on an ad page was used for the first time and the form type, your first choice in the cookie banner (accept, reject or custom), the page opened, time, campaign tags in the page address (UTM), whether you came from a Google ad, country | When you start using the form or make a choice in the cookie banner on a page our ads lead to (except visits from the EU, the EEA and the UK and browsers that send a GPC signal) |
| Technical and security | IP address, browser and device data, request time, bot check result | When you visit the site or submit a form on our site |
| Analytics and advertising (consent only) | Cookie identifiers, page views and interactions, ad click identifiers | Only if you accept analytics or advertising cookies |
Please do not include special category data (such as health, religion or ethnic origin) in your message. We do not need it.
In the Meta instant form, the name and email fields may be prefilled with details from your Meta account. These details and your other answers reach us when you choose to submit the form.
After server-side validation, submissions from forms on our site are forwarded as an email to our business inbox and saved to a request tracking sheet (Google Sheets) that only we can access. If such a request passes the bot check, you receive an automatic “we received your request” email. Requests that do not pass the check are not automatically rejected, they are flagged and reviewed manually.
Together with a form submitted on our site, we save the address of the page you submitted it on and the campaign details in the link that brought you to the site (UTM parameters). This is read only from the page address at the moment you submit, without cookies or browser storage. Ad click identifiers are not saved. If you arrive from a Google ad, only that fact is saved, not the click identifier. Request source details are not saved for requests sent from the EU, the EEA or the United Kingdom.
A request you send through the Meta instant form remains stored in Meta’s systems. We download it from Meta’s ad management tools and add it manually to the same request tracking sheet. We delete the downloaded file from our device right after adding it to the sheet. These requests do not pass through our server, Cloudflare or Brevo, so no automatic “we received your request” email is sent. The last screen of the form confirms that your request was received, and any correspondence about it takes place by email. We may call the phone number you give in the Meta instant form, only about your request. As the request source, the sheet records only that the request came through the Meta instant form. Meta’s record and the file we download may also show which ad and ad set the request came from. This is not added to the sheet. We see how many requests each ad brings in from the aggregate figures in Meta’s ad reports.
On the pages our ads lead to, we count each page view on our server. For the page view count, nothing is stored on your device and this count runs no code on your device. Only the page opened, the time it was opened, the campaign tags in the page address (UTM), whether you came from a Google ad and the country of the connection are recorded. Visits from the EU, the EEA and the United Kingdom are not counted. Your IP address, browser details, cookies or any identifier are not recorded, and records are not linked to each other. To filter out automated software, we look at the standard information your browser sends with every request only at that moment and do not store it.
On the same pages we also count, in aggregate, whether visitors start filling in the form and which choice they make in the cookie banner. For this, a small script on the page sends a single notification to our server at two moments. The first is when you first tap, move with the keyboard to, or start typing in any field of the form, the second is when you select “Accept”, “Reject” or save your preferences in the cookie banner. Each notification is sent at most once per page view. It contains only the type of event (form start or cookie choice), the form type or your cookie choice (accept, reject, custom) and the page opened. As with the page view count, we take the campaign tags (UTM) and whether you came from a Google ad from the page address. Apart from these, only the time and the country of the connection are recorded. Information you type into forms, your IP address, browser details and any identifier are not recorded. The script does not write cookies or any other record to your device and does not read any record in cookies or browser storage. It only checks the counting signal that comes with the page and your GPC setting. Records are not linked to each other or to entries in our request tracking sheet. Because it uses no cookies and does not identify you, this count runs regardless of your cookie choice. For visits from the EU, the EEA and the United Kingdom the script sends no notification and our server records nothing. If your browser sends a Global Privacy Control (GPC) signal, no notification is sent. To filter out abuse, we look at the standard information that arrives with the notification only at that moment and do not store it.
On pages with a form, the bot check is done with Cloudflare Turnstile. Turnstile runs in your browser and, for the check, your IP address, TLS fingerprint and browser details (User-Agent) together with our site key and domain are sent to Cloudflare. When you submit a form, your IP address and the single-use verification token are also sent to Cloudflare to complete the check. We do not store this data. Only the result of the check (passed or not passed) is saved with your request and kept for as long as the request record. Cloudflare processes this data on our behalf for the bot check and as a data controller to improve its bot detection (Cloudflare Turnstile Privacy Addendum (opens in a new tab)). Form submissions are also counted on our server with only the form type and the check result. No information about the sender is part of this count.
Our form service does not keep request logs. Cloudflare’s infrastructure may keep technical records for security purposes. Error records are kept for up to 3 days.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR Art. 6(1)) | KVKK Art. 5 |
|---|---|---|---|
| Reviewing your quote or free audit request, preparing the audit and proposal, contacting you | Identity, contact, business, request content | Steps prior to entering into a contract (b) | 5/2-c (including requests made on behalf of a company) |
| Answering questions sent through the contact form or by email | Identity, contact, request content | Legitimate interest (f) in responding to people who contact us | 5/2-f |
| Sending an automatic confirmation email | Name, email | Steps prior to a contract (b) and legitimate interest (f) | 5/2-c, 5/2-f |
| Tracking requests in a sheet (status and contact notes) | Identity, contact, business, request content, request source | Steps prior to a contract (b) and legitimate interest (f) in following up on requests reliably | 5/2-c, 5/2-f |
| Receiving from Meta the audit request you send through the Meta instant form, adding it to our request tracking sheet with a note that it came through the Meta instant form, responding to it and counting in aggregate how many suitable requests the Meta instant form brings | Identity, contact, business, request source (Meta instant form label only) | Steps prior to entering into a contract (b). Legitimate interest (f) in following up on requests reliably and in measuring the overall result of the Meta instant form | 5/2-c, 5/2-f |
| Measuring which page and ad campaign a request came from, to manage our advertising and content | Request source | Not applied for forms on our site. Request source details are not saved for requests sent from the EU, the EEA or the UK through forms on our site. For the Meta instant form, ad-level counts come from Meta’s aggregate reports, not from the request record, and the channel label in our sheet relies on the basis in the row above | 5/2-f |
| Counting, in aggregate, how often and from which campaign the pages our ads lead to are opened, to manage our ad budget | Ad page view count | Not applied. Visits from the EU, the EEA and the UK are not counted | 5/2-f |
| Counting, in aggregate, how many visits start using the form on our ad pages and how cookie banner choices are distributed, to improve our pages and ads | Form and cookie choice count | Not applied. For visits from the EU, the EEA and the UK no notification is sent and nothing is recorded | 5/2-f |
| Protecting forms against spam and abuse, keeping the site secure | Technical and security | Legitimate interest (f) in preventing misuse of our services | 5/2-f |
| Remembering your cookie choice and being able to demonstrate consent | Consent record | Legitimate interest (f) | 5/2-f |
| Measuring site usage statistically | Analytics | Consent (a) | 5/1 (explicit consent) |
| Measuring ad performance, personalizing ads and showing remarketing ads to site visitors | Advertising | Consent (a) | 5/1 (explicit consent) |
| Complying with obligations under Turkish law (for example lawful requests from authorities, keeping commercial records) | Relevant data | Legitimate interest (f) in complying with the law we are subject to. Legal obligation (c) where the obligation arises from EU or member state law | 5/2-ç |
| Establishing, exercising or defending legal claims | Relevant data | Legitimate interest (f) | 5/2-e |
The page view, form and cookie choice counts contain no information that identifies you, keep no record on your device and are used only for totals. You can stop the form and cookie choice count by turning on the Global Privacy Control (GPC) signal in a browser that supports it or with an extension.
We do not send marketing emails or newsletters. If we ever wish to, we will ask for your separate prior consent.
Required fields. The required fields in forms on our site (name, email and, depending on the form, website or message) are needed to respond to your request. In the Meta instant form, the same applies to name, email, website and the question about what your website is used for. If you do not provide them, we cannot respond. There is no statutory obligation to provide data.
Automated decision-making. We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you.
4. Recipients
We do not sell your personal data. We share it only with the following service providers, and only for the purposes above.
| Recipient | Location | Service | Data |
|---|---|---|---|
| Cloudflare, Inc. | USA (global network) | Hosting, form delivery, bot protection (Turnstile), inbound email routing, ad page view, form and cookie choice counting (Workers Analytics Engine) | Technical data, form content, request source, emails, count records |
| Sendinblue SAS (Brevo) | France (EU) | Transactional email delivery | Form content, request source, name, email |
| Google (Google LLC / Google Ireland Limited) | USA / Ireland | Email inbox service and request tracking sheet (Google Sheets and Apps Script). With your consent only, Google Analytics, Google Tag Manager and Google Ads | Form content, request source and emails. Analytics and ad data with consent |
| Meta Platforms Ireland Limited and Meta Platforms, Inc. | Ireland and USA | The Meta instant form inside our ads. Via the Meta Pixel and only if you allow advertising cookies, ad measurement, personalization and remarketing | Information you send through the Meta instant form (name, email, website, what your website is used for). This information is stored in Meta’s systems and reaches us from there. If you allow advertising cookies, via the Meta Pixel, IP address, browser and device information, visited and referring page, event name and type, cookie identifiers. Information typed into forms on our site is not sent to Meta |
| Anthropic, PBC | USA | AI-assisted tool we use to prepare free audits, proposals and email drafts (Claude) | The website address to be audited, the public pages of your website, Search Console data if you give us access, and business details related to your request (what your website is used for, target country, your message). For proposals and email drafts, your company name, your name and the content of our correspondence. For free audits, the name, email and phone number you give in the form are not entered into this tool |
Some of these providers process data on our behalf. For advertising and analytics services, the relevant providers may also process data for their own purposes, in which case their own privacy policies also apply. Your activity on Facebook and Instagram, including filling in the Meta instant form, is also subject to Meta’s own privacy policy (opens in a new tab).
We may also disclose data to competent public authorities where required by law.
5. Data flow and international transfers
When you submit a form on our site, your data first passes through Cloudflare’s server network, then is delivered via Brevo (France) as an email and reaches the controller’s inbox, managed from Türkiye, through Cloudflare email routing and the email inbox service (Google). The same data, with the request source and the bot check result, is also saved to our request tracking sheet in Google Sheets. When you submit the Meta instant form, your information is stored in Meta’s systems (Meta Platforms Ireland Limited and Meta Platforms, Inc.). We download the request from Meta’s ad management tools and add it manually to the request tracking sheet in Google Sheets. This path does not pass through Cloudflare or Brevo. When we prepare a free audit, a proposal or an email draft, we enter your website address, the public pages of your website and the details of your request into an AI-assisted tool (Anthropic, PBC, USA). Anthropic processes this data on our behalf. For free audits, the name, email and phone number you give in the form are not entered into this tool. The European Commission has not adopted an adequacy decision for Türkiye.
- Brevo. Processes data within the EU (France).
- Google LLC (USA). Transfers rely on the EU-U.S. Data Privacy Framework adequacy decision (Google LLC is on the framework’s participant list).
- Cloudflare, Meta and Anthropic (USA). Transfers rely on the providers’ standard contractual clauses and terms of service.
- Under KVKK. Transfers from Türkiye, including form and contact data and the request tracking sheet, information sent through the Meta instant form (stored on Meta’s servers abroad and reaching us from there), the website address, website pages and request details entered into the AI-assisted tool for audits, proposals and correspondence, ad page view, form and cookie choice count records and data collected through analytics and advertising cookies (Google Analytics, Google Ads, Meta), are made under Article 9 of KVKK on the basis of the relevant providers’ standard contractual terms and terms of service.
You can request information about these safeguards at info@adzento.com.
6. Retention
| Data | Period |
|---|---|
| Quote, audit and contact requests that do not lead to a contract | 12 months after our last exchange |
| Entries in the request tracking sheet (Google Sheets) | 12 months from the form date. Entries for requests that lead to a contract are kept for the same period as contract correspondence, and their request source details are deleted after 12 months |
| Meta’s record of a request sent through the Meta instant form | The period Meta sets. We do not set this period. Once the request is added to our request tracking sheet, the period above applies to that entry. The file we download from Meta is deleted right after it is added to the sheet |
| Ad page view, form and cookie choice count records (Cloudflare) | 3 months. After that only daily and monthly totals are kept, which cannot be linked to a person |
| Correspondence relating to a signed contract | Term of the contract plus 10 years (Turkish Commercial Code Art. 82, Turkish Code of Obligations Art. 146) |
| Error records of the form delivery service | Up to 3 days |
| Cookie consent record | 182 days |
| Analytics data (Google Analytics) | 14 months |
When the period ends, data is deleted, destroyed or anonymized. Expired entries in the request tracking sheet are deleted every night. On the first day of each month the sheet is moved to a new file. The old file, together with earlier versions that still contain deleted entries, is moved to Google Drive trash, and Google deletes it permanently after 30 days. Technical records held by providers are subject to the periods in their agreements.
7. Your rights
Under the GDPR and UK GDPR you have the right to
- access your data (Art. 15),
- have inaccurate data corrected (Art. 16),
- have your data erased (Art. 17),
- restrict processing (Art. 18),
- data portability (Art. 20),
- object to processing based on legitimate interests (Art. 21),
- withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal. You can change cookie consent with the “Cookie preferences” button at the bottom of every page.
To exercise your GDPR rights, email info@adzento.com in English or Turkish. We respond within one month and may ask you to verify your identity.
If you are in Türkiye, you also have the rights listed in Article 11 of KVKK, set out in our Turkish KVKK Aydınlatma Metni. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, KVKK applications must be made in Turkish. We respond within 30 days.
Right to complain. You may lodge a complaint with the supervisory authority in the EU member state where you live, work or where the alleged infringement took place (GDPR Art. 77). In the UK, this is the Information Commissioner’s Office (ICO). In Türkiye, under Article 14 of KVKK, you may complain to the Personal Data Protection Board within 30 days of learning of our response and in any case within 60 days of your application, if your application is rejected, you find the response insufficient or we do not respond in time.
8. Cookies
Apart from strictly necessary cookies, no cookies are set without your consent. See our Cookie Policy for details. Counting page views, form starts and cookie choices on our ad pages does not use cookies and is described in section 2.
9. Security
The site runs over HTTPS only. Data from forms on our site is validated server-side and automated submissions are filtered with Cloudflare Turnstile. Requests that do not pass the check are not automatically rejected, they are flagged and reviewed manually. Entries from forms on our site are added to our request tracking sheet only through our server, authenticated with a secret key. We add requests from the Meta instant form to the sheet manually. Only we can view and edit the sheet.
10. Children
Our services are aimed at businesses. We do not knowingly collect personal data from anyone under 18.
11. Changes
We update this notice when our processing or the law changes. The current version is always on this page.
Last updated: 31.10.2026