Data Protection Notice (KVKK)

Identity of the data controller

Under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data is processed by the following organization acting as data controller:

• Legal name: Moon Workshop Dijital Reklam Ajansı
• Address: Güzeloba Mah. Çağlayangil Cad. Hatice Güleser İş Merkezi No:39 İç Kapı No:104, Muratpaşa / Antalya, Türkiye
• Email: info@moonworkshop.com
• Phone: +90 850 840 48 65
• Website: moonworkshop.com

This notice covers visitors to our website, prospective clients who contact us through the form or other channels, the representatives and employees of our clients, suppliers, and job applicants.

Categories of personal data processed

Category	Example data
Identity data	First name, last name
Contact data	Email address, phone number, address
Customer transaction data	Requests and complaints, proposal and contract details
Financial data	Invoice details, payment records
Transaction security data	IP address, access and session logs, cookie identifiers
Marketing data	Campaign interaction data generated through cookies and pixels
Professional experience data	CV information submitted with a job application

Special categories of personal data are not processed unless you give explicit consent or a statutory ground applies. Please do not enter such data into the form fields on this website.

Purposes of processing

1. Responding to contact requests and running proposal processes.
2. Providing advertising management, software development and consulting services.
3. Establishing, performing and monitoring contractual processes.
4. Handling invoicing, accounting and finance operations.
5. Measuring the performance of the website and advertising campaigns.
6. Maintaining information security and preventing misuse.
7. Fulfilling statutory reporting obligations toward authorized public bodies.
8. Evaluating job applications and running human resources processes.

Collection method and legal grounds

Personal data is collected through the website contact form, email, telephone, WhatsApp, social media channels, contractual documents and cookies, by partly automated or non-automated means.

Processing relies on the following grounds in Article 5 of the KVKK:

• Art. 5/2-a: Expressly provided for by law.
• Art. 5/2-c: Directly related to the conclusion or performance of a contract.
• Art. 5/2-ç: Necessary for the controller to fulfill a legal obligation.
• Art. 5/2-e: Necessary for the establishment, exercise or protection of a right.
• Art. 5/2-f: Legitimate interest, provided it does not harm your fundamental rights and freedoms.
• Art. 5/1: Explicit consent where none of the above applies — for example analytics and marketing cookies, or commercial electronic messages.

Transfer of personal data

Your personal data may be transferred to the following parties in line with Articles 8 and 9 of the KVKK:

• Service providers: hosting, email, accounting software and CRM providers.
• Advertising and measurement platforms: Google Ireland Ltd., Meta Platforms Ireland Ltd., Microsoft Corporation.
• Legal and financial advisors: on request and to the extent necessary.
• Authorized public bodies: within the scope of statutory requests.

Servers of advertising and measurement platforms may be located outside Türkiye. Cross-border transfers are carried out under Article 9 of the KVKK and the standard contractual clauses agreed with those providers.

Retention and destruction

Personal data is retained for as long as necessary for the purpose of processing and for the limitation periods set out in applicable legislation. Once the period expires or the purpose disappears, the data is deleted, destroyed or anonymized.

• Contact inquiries: up to 2 years after the request is closed.
• Contract and client records: 10 years after the agreement ends.
• Invoices and accounting documents: 10 years, as required by tax legislation.
• Job application documents: up to 1 year after the application is concluded.

Your rights as a data subject (KVKK Art. 11)

Under Article 11 of the KVKK you may apply to the data controller and exercise the following rights:

1. Learn whether your personal data is being processed.
2. Request information if it has been processed.
3. Learn the purpose of processing and whether the data is used accordingly.
4. Know the third parties, domestic or abroad, to whom the data has been transferred.
5. Request correction of incomplete or inaccurate data.
6. Request deletion or destruction under the conditions of Article 7 of the KVKK.
7. Request that such corrections and deletions be notified to third parties who received the data.
8. Object to a result reached against you solely through automated analysis.
9. Claim compensation for damage arising from unlawful processing.

How to apply

You can submit requests concerning your rights in line with the Turkish communiqué on applications to data controllers, using either of these channels:

• Email: info@moonworkshop.com, with “KVKK Application” in the subject line.
• Written application: a signed letter sent to Güzeloba Mah. Çağlayangil Cad. Hatice Güleser İş Merkezi No:39 İç Kapı No:104, Muratpaşa / Antalya, Türkiye.

Your application should clearly state your name, contact details and the subject of your request. Applications are concluded free of charge within 30 days at the latest; where the process incurs an additional cost, the fee set by the Authority’s tariff may apply.

If your application is rejected or the response is insufficient, you retain the right to lodge a complaint with the Turkish Data Protection Authority.