Privacy Policy

This Privacy Policy explains how personal data is collected, used, protected and shared in connection with the Medyapin® OS digital signage and in-store experience platform, the Medyapin.com website, the cloud management dashboard and the player applications (the "Service") provided by SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ (the "Company", "we").

Medyapin® and Medyapin.com are registered trademarks of SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ.

The statutory notice under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) is set out in the KVKK Privacy Notice. In the event of any inconsistency between this Policy and that Notice, the Notice prevails on matters governed by the KVKK.

1. Scope and Our Roles

This Policy covers our customers' employees who hold platform accounts, customer signatories and contact persons, prospective customers who complete the onboarding form, and visitors to our website.

• As data controller: SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ is responsible for data processed in account, billing, security, support and marketing processes.
• As data processor: For content uploaded to the platform by our customers and data relating to the customer's own users processed within the platform, the customer is the data controller; we process such data only on the customer's instructions and under the Data Processing Agreement.
• On-premise deployment: Data of customers who deploy on their own infrastructure is hosted on the customer's own servers and is not accessible to us.

Persons viewing or passing by digital screens are not identified.

2. Information We Collect

2.1. Website and onboarding form

• Name, surname, e-mail address, company name, tax office and tax identification number, and billing address you provide in the onboarding form,
• The type and version of legal documents you accept, the time of acceptance, IP address and browser information,
• Your language, theme and cookie preferences (see the Cookie Policy).

2.2. Management dashboard (cloud application)

• Account data: e-mail address, role and permission assignments, interface language,
• Authentication data: an irreversible hash of your password, session records, multi-factor authentication (MFA) data,
• Security records: IP address, browser information and audit logs of administrative actions,
• Subscription, invoice and payment records,
• Support correspondence.

2.3. Player devices

• Device identifiers, platform and version information, operating status and telemetry,
• Proof-of-play aggregates,
• Screen screenshots controlled by customer policy.

2.4. Customer content

Images, videos and other content uploaded by our customers are stored and played on the customer's behalf. Where such content contains personal data, the customer is responsible for its lawfulness.

3. Privacy-First Sensing

Medyapin® OS sensing features are designed privacy-first:

• Vision Edge camera features run on the edge device; no facial identity recognition is performed.
• By default no raw video or audio is transferred to the cloud or retained; only events and aggregate data are sent to the cloud.
• The Listen (microphone) feature operates on the edge device using audio fingerprinting; raw audio is not retained.
• Demographic estimation or presence tracking is never enabled by default and may only be enabled following separate opt-in consent and legal review.
• Product images uploaded to Model Studio for Vision model training should not depict people.

Customers using sensing features are responsible for fulfilling the applicable notice and information obligations at their own premises.

4. How We Use Information

• Providing the Service, managing accounts and authentication,
• Subscription, invoicing and payment processes,
• Information security, misuse prevention and auditing,
• Responding to support requests,
• Complying with legal obligations and protecting our rights,
• Improving the Service,
• Marketing messages only where you have given permission (see the Explicit Consent Text).

The legal grounds for each purpose are explained in detail in the KVKK Privacy Notice. We do not sell your personal data.

5. How We Protect Your Data

• Encryption in transit with TLS on all connections,
• Storage of passwords using strong one-way hashing algorithms; no plaintext passwords are kept,
• Support for multi-factor authentication (MFA),
• Role-based access control (RBAC) and the principle of least privilege,
• Tenant isolation enforced server-side on every query,
• Tamper-evident audit logs of administrative actions,
• Encryption at rest of sensitive configuration data such as secret keys and credentials,
• No storage of card data by us; payments are taken through a licensed payment institution.

No system is entirely risk-free. In the event of a personal data breach, notifications are made to the Personal Data Protection Board and, where required, to the data subjects concerned, in accordance with Article 12 of the KVKK.

6. Sub-processors and Service Providers

We use the following service providers to deliver the Service:

• Google Cloud (Google LLC / Google Cloud EMEA Ltd.): Vision model training under Model Studio (Vertex AI, Cloud Storage), europe-west4 (Netherlands) region,
• iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico): card payment processing,
• Hosting and cloud infrastructure provider: [To be specified before publication: hosting provider and data-center location]
• Transactional e-mail provider: [To be specified before publication: e-mail service provider and processing location]

We enter into contracts with our service providers that include confidentiality and data security obligations. Changes to the sub-processor list are notified to customers in the manner set out in the Data Processing Agreement.

7. International Transfers

Our default data region is the European Union. Cross-border transfers are made under Article 9 of the KVKK, as amended by Law No. 7499, on the basis of an adequacy decision, appropriate safeguards (standard contract with notification to the Board, binding corporate rules, written undertaking) or incidental transfer exceptions. Details are set out in the KVKK Privacy Notice.

8. Retention

We keep data only for as long as necessary and for statutory retention periods. Default periods: audit logs approximately 7 years, proof-of-play records for the contractual period (approximately 7 years), raw telemetry 30 days, screenshots 90 days, raw camera and audio recordings 0 days (not retained); account data for the duration of the subscription and statutory periods; commercial books and invoices 10 years. Customer organizations can configure certain retention periods according to their own policies.

9. Your Rights

Your rights under Article 11 of the KVKK and how to exercise them are explained in the KVKK Privacy Notice. Customer administrators can erase (anonymize) users and export organization data (portability) from Settings → Privacy and KVKK.

9.1. Data subjects in the European Union

Where the EU General Data Protection Regulation (GDPR) applies, information is provided under Article 13 GDPR, and under Articles 15–22 you may exercise your rights of access, rectification, erasure, restriction of processing, data portability and objection, rely on the right not to be subject to automated decision-making, and lodge a complaint with the competent supervisory authority. Where processing is based on consent, you may withdraw your consent at any time. [To be assessed before publication: whether an EU representative is required under Article 27 GDPR]

10. Children's Privacy

The Service is intended for business users and is not directed at persons under 18. We do not knowingly collect personal data of persons under 18.

11. Changes to This Policy

This Policy is updated in versioned form, and the publication date of each version is recorded. In the case of material changes, you may be asked to re-accept the current text the next time you log in.

12. Contact

For privacy-related questions:

• Trade name: SMARTLABS MEDYA TEKNOLOJİLERİ ANONİM ŞİRKETİ
• Address: REŞİTPAŞA MAH. DENİZBANK SİTESİ SOK. NO:20 SARIYER İSTANBUL
• KEP: [To be completed: Registered e-mail (KEP) address]
• E-mail: info@smartlabs.com.tr
• Telephone: 08502593666

For service terms, see the Terms of Service.