We explain clearly how we process your data.

This Privacy Policy explains how your personal data is processed when you visit medeacreative.com or contact us about advertising, brand communications, design, social media, digital marketing or digital projects. It also covers the LinkedIn connection in the MEDEA Agency OS platform.

In connection with this website, your personal data is processed by MEDEA REKLAMCILIK ANONİM ŞİRKETİ, the operator of the Medea Creative brand, acting as data controller.

When you visit the website, we may process your IP address, the date and time of access, browser or device information, and security and server logs.

When you contact us as a prospective or existing client, supplier or business partner, we may process your name, position, business contact details and message, together with any brand, campaign, brief, proposal or project information you choose to share. Where we provide digital marketing services, this may also include account authorisations, campaign objectives, performance data and reporting information.

Please do not share special categories of personal data that are not necessary for advertising or creative production.

We may process your personal data for the following purposes under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”):

• to operate and secure the website — our legitimate interests under Article 5(2)(f) of the KVKK;
• to assess enquiries relating to advertising, brand communications, design, social media and digital marketing, and to manage brief, proposal and contract processes — steps necessary to enter into or perform a contract under Article 5(2)(c);
• to manage client, supplier and business-partner relationships, and to plan, produce and deliver projects — our legitimate interests under Article 5(2)(f);
• to plan, manage, measure and report on digital advertising and social media campaigns — performance of a contract under Article 5(2)(c), and the legitimate interests of the relevant parties under Article 5(2)(f);
• to comply with legal obligations — Article 5(2)(ç);
• to establish, exercise or protect legal rights — Article 5(2)(e).

Personal data is processed only where relevant, limited and proportionate to these purposes.

We collect data automatically through server logs, or through electronic channels such as email and telephone. We do not sell your personal data.

To select the website language automatically for your country, an approximate country code is derived from your IP address. Where this lookup is performed through Country.is, the service receives the IP address with the network request and returns the IP address and country code. The website reads only the country code and keeps it temporarily for the open browser session; Medea Creative does not permanently store your IP address for this purpose.

Only where necessary, your data may be shared with or transferred to service providers that host and technically operate the website; project suppliers such as print, production, media and software providers where required to produce the work you request; professional advisers; or competent public authorities where required by law. Any such sharing is limited to the relevant purpose and the data strictly required for it.

When we carry out digital marketing work on behalf of our clients, we may act as a data processor within the purposes and instructions determined by the client. Activities carried out on social media, advertising and measurement platforms are governed by our agreement with the relevant client, the platform’s privacy terms and applicable data-protection rules.

This website does not use analytics or marketing cookies. We may use an essential language-preference cookie and browser storage to remember your choice and prevent IP-based routing from changing your selected language. These technologies are not used for advertising or user profiling.

Third-party links on this website are governed by the privacy terms of the relevant services.

We retain personal data only for as long as required by the purpose for which it was processed and by applicable legislation. At the end of that period, it is deleted, destroyed or anonymised.

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and unlawful processing.

Under Article 11 of the KVKK, you have the right to learn whether your personal data is being processed; request information where it has been processed; learn the purpose of processing and whether it is being used in accordance with that purpose; know the third parties to whom it has been transferred; request the correction of incomplete or inaccurate data; request its deletion or destruction where the relevant conditions are met; request that these actions be notified to third parties to whom the data has been transferred; object to a result arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

You may submit a request with the subject line “KVKK Request” to info@medeacreative.com, or by post to Hamidiye Mah. Selçuklu Cad., Block B, Floor 6, Kâğıthane / Istanbul. Requests will be concluded as soon as possible and no later than 30 days, depending on their nature.

We may update this policy when our data-processing activities or applicable legislation change. The current version will always be published on this page.

This English version is provided for convenience. If there is any inconsistency between the Turkish and English versions, the Turkish version will prevail.

Scope and responsible organization

MEDEA Agency OS is operated by MEDEA REKLAMCILIK ANONİM ŞİRKETİ under the Medea Creative brand. It is a platform for managing the agency's client, brief, content-planning, approval and social-media workflows. This section explains the processing associated with the LinkedIn connection in the platform at portal.medeacreative.com and supplements our corporate privacy policy.

Our company acts as controller for the administration of its own user and integration accounts. Our role in activities performed on behalf of clients depends on the relevant service, client agreement and instructions.

Connection and information that may be processed

A LinkedIn connection is established when the relevant real user grants permission through LinkedIn's authorization interface. MEDEA Agency OS does not request or receive the user's LinkedIn password. Access depends on the permissions LinkedIn grants to the application, the user's authorization and their role on the relevant company Page.

Within the authorized scope, we may process:

• The connecting user's LinkedIn identifier, name and email address, where provided by LinkedIn;
• The agency account information used to associate the connection with the agency user;
• An access token, a refresh token where provided, and token-validity information;
• Identifiers, names, vanity names, logo references, administrative roles and authorization status for company Pages the user is authorized to manage;
• The association between a company Page and its client record, and information about updates to that association.

This information is used to establish the connection, discover authorized company Pages and associate them with the appropriate client workflow. Associating a company Page with a client record is not intended to create sales leads or enriched personal profiles from LinkedIn member profile information.

Planned features

Publishing approved content to LinkedIn company Pages and reporting Page/post performance are planned development features. This notice does not mean that these features are currently available.

They will be offered only after the necessary platform access, user authorizations and technical controls have been completed. If enabled, approved post text and media, post identifiers and publication status returned by LinkedIn, and aggregate Page/post performance metrics may be processed for the relevant authorized client workflow. The purpose is to manage authorized company Pages and assess content performance, not to profile individuals. This notice will be updated if the scope changes.

Use, access and security

Access to the LinkedIn integration is restricted to users authorized for this function within the platform. Access and refresh tokens are stored encrypted on the server. LinkedIn operations are performed through official APIs within the permissions provided by the platform.

Data obtained from LinkedIn is not sold. The integration is not intended for trading personal data, prospect generation, advertising audience creation, recruitment profiling or public redistribution of a LinkedIn social feed. Technical transfers associated with the integration may involve LinkedIn and technical providers required to operate the service; the transfer disclosures in our corporate privacy policy also apply.

Retention, revocation and deletion requests

Retention of LinkedIn data takes account of the processing purpose, applicable law and the data-specific retention and deletion rules of the relevant LinkedIn API product. There is no single unlimited retention period applicable to all LinkedIn data categories.

You can revoke the application's permission through the relevant LinkedIn account settings. Revoking access on LinkedIn and deleting records previously stored in MEDEA Agency OS are separate actions; revocation does not mean that stored records have automatically been deleted.

To request termination of a LinkedIn connection or deletion of associated data in MEDEA Agency OS, email info@medeacreative.com with the subject “MEDEA Agency OS - LinkedIn Data Request”. Identify the relevant account or company Page; do not send passwords or access tokens. Necessary and proportionate identity or authority checks may be requested to prevent unauthorized deletion. Requests are reviewed and addressed under applicable law and platform obligations. This notice does not imply that an automatic deletion button or automated deletion process is available in the application.

Postal contact: MEDEA REKLAMCILIK ANONİM ŞİRKETİ, Hamidiye Mah. Selçuklu Cad., Block B, Floor 6, Kağıthane / Istanbul, Türkiye.

LinkedIn's processing within its own services is separately explained in the LinkedIn Privacy Policy.