TürkçeMedyapin

Version 1 · Effective from: 3 November 2026 · Published: 3 November 2026

Personal Data Processing Notice (KVKK Privacy Notice)

This Notice has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, in order to inform you about the personal data processed in connection with the Medyapin® OS digital signage and in-store experience platform and the Medyapin.com website.

Medyapin® and Medyapin.com are registered trademarks of SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ.

1. Data Controller

Your personal data is processed by the following company acting as data controller:

  • Trade name: SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ
  • MERSIS No: [To be completed: MERSIS number]
  • Address: REŞİTPAŞA MAH. DENİZBANK SİTESİ SOK. NO:20 SARIYER İSTANBUL
  • Registered e-mail (KEP): [To be completed: Registered e-mail (KEP) address]
  • E-mail: info@smartlabs.com.tr
  • Telephone: 08502593666
  • VERBIS Registration No: [To be completed: VERBIS registration number]

1.1. Controller and processor roles

With respect to content uploaded to the platform by our customers (images, videos, text, etc.) and personal data of our customers' own employees, visitors or end users processed within the platform, the respective customer is the data controller; SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ processes such data solely on the customer's instructions as a data processor. The terms of this relationship are set out in the Data Processing Agreement. Requests concerning such data should first be directed to the relevant customer (the data controller).

Data of customers using an on-premise deployment is hosted on the customer's own servers and is not accessible to SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ.

2. Categories of Personal Data Processed

This Notice covers our customers' employees who hold platform accounts (dashboard users), our customers' authorized signatories and contact persons, prospective customers who complete the onboarding form, and visitors to our website. Persons viewing or passing by digital screens are not identified.

  • Identity and contact: first name, last name, title/role, e-mail address, telephone number (if provided).
  • Customer transaction: company name, tax office and tax identification number, billing address, subscription, order, payment and invoice records, support requests and correspondence.
  • Transaction security: an irreversible hash of your password — passwords are never stored in plaintext —, session records, multi-factor authentication (MFA) data, IP address, browser/device information (user agent), and audit logs of administrative actions.
  • Legal transaction and consent records: type and version of the legal document accepted, date and time of acceptance, IP address and browser information.
  • Marketing: only where you have given explicit consent and permission for commercial electronic messages, your communication preferences and message interaction data.
  • Device and fleet data: player device identifiers, location/branch mappings, operating status, proof-of-play aggregates and policy-controlled screen screenshots. This data primarily relates to the customer organization; to the extent it can be linked to an individual, it is treated as personal data.

2.1. Sensing features

Vision Edge camera features run on the edge device; no facial identity recognition is performed, and by default no raw video or audio is transferred to the cloud or retained. Only events and aggregate data are sent to the cloud. The Listen (microphone) feature operates on the edge device using audio fingerprinting; raw audio is not retained. Demographic estimation or presence tracking is never enabled by default and could only be considered following separate opt-in consent and legal review.

3. Purposes of Processing

Your personal data is processed for the following purposes:

  1. Creating membership and platform accounts and carrying out authentication and authorization,
  2. Concluding and performing the subscription agreement, providing the service, managing player devices and delivering content playback,
  3. Carrying out invoicing, payment and collection processes,
  4. Conducting information security processes, preventing unauthorized access and misuse, and maintaining audit logs,
  5. Managing customer support, requests and complaints,
  6. Creating evidentiary records of acceptance of legal documents,
  7. Fulfilling obligations arising from legislation (tax, commercial and e-commerce law, etc.) and providing information to competent authorities,
  8. Establishing, exercising and defending rights in legal disputes,
  9. Measuring and improving service quality,
  10. Where you have given explicit consent, sending promotional and marketing messages about our products and services.

Your personal data is processed under Article 5 of the KVKK on the following legal grounds:

  • Expressly provided for by law (Art. 5/2-a): record-keeping and retention obligations under Turkish Commercial Code No. 6102, Tax Procedure Law No. 213 and Law No. 6563 on the Regulation of Electronic Commerce.
  • Conclusion or performance of a contract (Art. 5/2-c): account creation, subscription, service delivery, invoicing and support.
  • Compliance with a legal obligation (Art. 5/2-ç): invoice and commercial book records, requests from competent public authorities, legal-document consent records.
  • Establishment, exercise or protection of a right (Art. 5/2-e): dispute and evidentiary processes, retention of audit logs.
  • Legitimate interest (Art. 5/2-f): ensuring information security, preventing misuse and improving the service, provided that your fundamental rights and freedoms are not harmed.
  • Explicit consent (Art. 5/1): solely for sending marketing commercial electronic messages and processing contact data for that purpose. See the Explicit Consent Text for details.

5. Method of Collection

Your personal data is collected electronically, by partly or fully automated means, through our website, the onboarding form, the Medyapin® OS management dashboard, player applications, e-mail and support channels. For information on cookies and similar technologies, see the Cookie Policy.

6. Transfers of Personal Data

6.1. Domestic transfers

Your personal data may be transferred, limited to the purposes above and in accordance with Article 8 of the KVKK, to the following recipients:

  • iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico) for card payments. Full card numbers are not stored by SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ; only a token provided by the payment institution is kept.
  • Persons or firms providing accounting and financial advisory services,
  • Legal advisers and independent auditors,
  • Upon request, legally authorized public institutions and judicial authorities.

6.2. Cross-border transfers

Cross-border transfers are carried out in accordance with Article 9 of the KVKK as amended by Law No. 7499 and in force since 1 June 2024. Accordingly, data is transferred primarily to countries covered by an adequacy decision; in the absence of an adequacy decision, subject to one of the appropriate safeguards (execution of the standard contract announced by the Board and notification to the Board within 5 business days of signature, binding corporate rules, or a written undertaking with Board authorization); and, where neither is possible, on the basis of one of the incidental transfer exceptions listed in Article 9/6.

The processing operations currently involving cross-border transfers are:

  • Model Studio: Product images uploaded by customers for Vision model training are processed on Google Cloud (Vertex AI and Cloud Storage) in the europe-west4 (Netherlands) region. As a rule these images should not contain personal data; where they do, the transfer is subject to the safeguards above.
  • Hosting and cloud infrastructure: The default data region is the European Union. [To be specified before publication: hosting provider and data-center location]
  • Transactional e-mail delivery: [To be specified before publication: e-mail service provider and processing location]
  • [To be specified before publication: the Article 9 safeguard relied on for each transfer (standard contract, etc.) and the date of notification to the Board]

7. Retention Periods

Your personal data is retained for as long as necessary for the purpose for which it is processed and for the periods prescribed by applicable legislation; at the end of that period it is erased, destroyed or anonymized. The main default periods are:

  • Account data: for the duration of the subscription and thereafter for the statutory limitation periods,
  • Commercial books, invoices and documents: 10 years under Article 82 of Turkish Commercial Code No. 6102 (which also covers the retention period under Article 253 of Tax Procedure Law No. 213),
  • Audit logs: approximately 7 years (2555 days),
  • Proof-of-play records: for the contractual period, by default approximately 7 years,
  • Raw telemetry: 30 days,
  • Screen screenshots: 90 days,
  • Raw camera footage and audio: not retained (0 days),
  • Legal-document consent records: for the duration of the relationship and the limitation periods,
  • Marketing permissions: until withdrawn; the withdrawal record is kept for the period required by law.

Customer organizations can erase (anonymize) users and export organization data from Settings → Privacy and KVKK in the management dashboard.

8. Your Rights

Under Article 11 of the KVKK, by applying to the data controller you have the right to:

  1. Learn whether your personal data is processed,
  2. Request information if your personal data has been processed,
  3. Learn the purpose of processing and whether the data is used in line with that purpose,
  4. Know the third parties in Turkey or abroad to whom your personal data is transferred,
  5. Request rectification if your personal data is incomplete or inaccurate,
  6. Request erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
  7. Request that rectification, erasure or destruction be notified to third parties to whom your personal data has been transferred,
  8. Object to a result to your detriment arising from the analysis of processed data exclusively through automated systems,
  9. Claim compensation for damages if you suffer loss due to unlawful processing of your personal data.

9. How to Apply

You may submit requests concerning your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

  • in writing (with a wet-ink signed petition) to REŞİTPAŞA MAH. DENİZBANK SİTESİ SOK. NO:20 SARIYER İSTANBUL,
  • via registered electronic mail (KEP) to [To be completed: Registered e-mail (KEP) address],
  • signed with a secure electronic signature or mobile signature to info@smartlabs.com.tr,
  • from an e-mail address you have previously notified to us and which is registered in our systems, to info@smartlabs.com.tr.

Your application must include your name and surname, (for Turkish citizens) your Turkish ID number or (for foreign nationals) your nationality and passport/ID number, your address for notifications, your e-mail address or telephone number for notification (if any), and the subject of your request.

Your application will be concluded free of charge as soon as possible depending on the nature of the request and at the latest within 30 days. If the action requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board. If your application is rejected, the response is found insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the KVKK within 30 days of learning of the response and in any event within 60 days of the application date.

10. VERBIS

SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ is registered with the Data Controllers' Registry (VERBIS) under number [To be completed: VERBIS registration number]. [To be confirmed before publication: VERBIS registration obligation and status]

11. Other Documents and Updates

For broader information on personal data processing, see the Privacy Policy; for service terms, see the Terms of Service. This Notice may be updated in versioned form; the current version is always published on this page.

KVKK Privacy Notice — Medyapin