Legal

Privacy Policy & GDPR / KVKK Notice

Last updated: October 6, 2026

Introduction

Lein Digital takes the protection of your personal data seriously. This policy explains what personal data we collect when you visit our website, use our services or contact us, why we process it, who we share it with and what rights you have. We act as the data controller under Türkiye’s Law No. 6698 on the Protection of Personal Data (“KVKK”) and, where it applies to you, the EU General Data Protection Regulation (“GDPR”).

1. Identity of the Data Controller

This notice is provided under Article 10 of the KVKK and Articles 13 and 14 of the GDPR. The data controller is:

Name:: Lein Digital
Address (Etiler office):: Akat Mah. Nispetiye Cad. Kervan Apt. No: 37 D: 8, 34335 Beşiktaş/İstanbul, Türkiye
Address (Ataşehir office):: Küçükbakkalköy Mah. Nergiz Sk. No: 12/24, 34750 Ataşehir/İstanbul, Türkiye
Phone:: +90 530 219 30 72
Email:: mail@leindigital.com
Web:: leindigital.com

2. Personal Data We Collect

Depending on the nature of the services we provide, the following categories of personal data may be processed:

Identity data: First and last name.
Contact data: Email address, phone number, company name.
Request and transaction data: The service type, budget range and company size you select in the contact form, your preferred call time, your message and your declaration in the consent checkbox; notes from proposal and meeting processes, and contract contents.
Form submission data: The address of the page from which you submit the form, the parameters of the campaign link that brought you to the site (UTM), your browser’s user-agent and the time of submission. On the English pages, UTM parameters are saved on your device for the duration of your browser session only if you have consented to analytics or marketing cookies; otherwise they are held only in the memory of the open page and are lost when you close or reload it. They are sent to us only when you submit the form.
Newsletter data: The email address you subscribe with, the subscription date and the subscription status.
Online usage data: IP address, browser information, device type, pages visited, session duration, on-site interactions (clicks, scrolling), cookie identifiers.
Marketing data: Ad interactions, conversions and remarketing lists.

Fields marked “required” in the contact form are needed for us to respond to your request; if you do not provide them, we cannot prepare a proposal. Optional fields help us tailor our reply.

3. Purposes of Processing

Your personal data is processed for the following purposes, within the scope of Articles 5 and 6 of the KVKK:

Handling service requests and proposal processes.
Prioritizing requests from the contact form with a rule-based automatic score and notifying the Lein Digital team internally.
Establishing and performing the contractual relationship.
Client communication, support and reporting.
Recording your newsletter subscription and sending the newsletter.
Measuring site performance and improving the user experience.
Digital marketing, retargeting and evaluating advertising performance (only if you have given your explicit consent).
Keeping the site secure and preventing abuse of forms (spam).
Fulfilling legal obligations and handling legal proceedings.

The priority score is calculated with fixed rules such as budget range, service type, company size, use of a corporate email address and how thoroughly the form is completed. The score only helps our team decide the order in which to handle requests; no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you is made on the basis of this score. You can object to this assessment at any time under Article 11 of the KVKK or, where the GDPR applies, Article 21 of the GDPR.

Your personal data is collected directly from you through the contact and newsletter forms, email, phone, WhatsApp and meetings, and automatically through cookies and similar technologies on the site. The legal grounds we rely on for these purposes are:

Steps taken at your request before entering into a contract, and performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)): Service requests and proposal processes, the contractual relationship, client communication, support and reporting. Where you contact us on behalf of a company, we process your contact details on the basis of our legitimate interest in responding to that company and managing the business relationship (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
Legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)): Prioritizing requests and notifying our team, keeping the site secure and preventing spam.
Legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)) and the establishment, exercise or defense of legal claims (KVKK Art. 5(2)(e); GDPR Art. 6(1)(f)): Fulfilling legal obligations and handling legal proceedings.
Explicit consent (KVKK Art. 5(1)); consent (GDPR Art. 6(1)(a)): Measurement with analytics and marketing cookies, digital marketing and retargeting, and the newsletter subscription. For cookies and similar technologies that are not strictly necessary, consent is also required under the ePrivacy rules (Article 5(3) of Directive 2002/58/EC, as implemented in your country).

4. Recipients of Personal Data

Within the scope of Articles 8 and 9 of the KVKK, your personal data may be transferred only to the following parties, limited to specific purposes and legal grounds:

Cloud infrastructure provider: Amazon Web Services (AWS). The site runs in AWS’s Europe (Frankfurt) Region (eu-central-1), where contact form and newsletter records are also stored in Amazon DynamoDB; pages are delivered through Amazon CloudFront’s global network.
Google LLC (Google Ireland Ltd.): For Google Analytics 4 (site usage measurement), Google Ads (ad conversion measurement and remarketing) and Google Tag Manager (tag management); cookies from these services are used only with your consent.
Meta Platforms, Inc.: For Meta Pixel and ad measurement services; measurement events are sent only with your marketing consent.
WhatsApp (Meta): If you message us on WhatsApp, your phone number, profile name and messages are processed by WhatsApp under its own terms and privacy policy, and reach the Lein Digital team through WhatsApp.
Microsoft (Clarity): For on-site behavior analytics (heatmaps and session recordings built from interactions such as clicks and scrolling); Clarity cookies are used only with your analytics consent.
YouTube (Google LLC): For playing videos on the site. The video player (youtube-nocookie.com) loads only when you click the play button; before that, only the video’s thumbnail image is shown from YouTube’s servers.
Telegram: For internally notifying the Lein Digital team of requests from the contact form. The notification contains the information you submit in the form, the priority score, the page the form was sent from and the campaign parameters; your IP address and browser information are not included.
Competent public authorities: Where required by law or in response to a lawful request.

Amazon Web Services, Google, Meta (including WhatsApp), Microsoft and Telegram process personal data outside Türkiye; transfers to these providers qualify as transfers abroad. These transfers are carried out in accordance with Article 9 of the KVKK, relying on appropriate safeguards or, where required, on your explicit consent.

5. Your Rights Under the KVKK and the GDPR

Under Article 11 of the KVKK, as a data subject you have the right to:

Learn whether your personal data is being processed.
Request information about the processing, if your data has been processed.
Learn the purpose of the processing and whether your data is used in line with that purpose.
Know the third parties in Türkiye or abroad to whom your data is transferred.
Request rectification if your data is incomplete or inaccurate.
Request erasure or destruction of your data under the conditions set out in Article 7 of the KVKK.
Request that the third parties to whom your data has been transferred be notified of any rectification, erasure or destruction.
Object to an outcome against you that arises from the analysis of your data exclusively by automated systems.
Claim compensation for damages if you suffer harm because of unlawful processing.

If the GDPR applies to you (for example, because you are in the EU or EEA), you also have the right to:

Access your personal data and receive a copy of it (Art. 15).
Have inaccurate data rectified (Art. 16).
Have your data erased (Art. 17).
Restrict our processing of your data (Art. 18).
Receive the data you provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller, where we process it by automated means on the basis of your consent or a contract (Art. 20).
Object at any time to processing based on our legitimate interests, including the priority score described in Section 3 (Art. 21).
Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).

To exercise your rights, email us at mail@leindigital.com, preferably from the email address you used to contact us, or send a signed written request to our postal address in Section 1. We may ask for information to verify your identity. We will respond free of charge and without undue delay, and in any event within 30 days of receiving your request, or within one month of receipt where the GDPR applies, if that is shorter.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA member state where you live, work or where the alleged infringement took place (GDPR Art. 77). If the KVKK applies and your request is rejected, you find our response insufficient or we do not respond in time, you can file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning of our response, and in any case within 60 days of your application (KVKK Art. 14).

6. Cookie Policy

We use cookies and similar browser storage technologies on our site to improve your experience, measure site performance and show relevant ads. They fall into three categories:

Strictly necessary cookies: Required for the site’s core functions, such as remembering your cookie choice; they cannot be turned off.
Analytics cookies: Measure site usage statistics with Google Analytics 4, and on-site interactions such as clicks and scrolling with Microsoft Clarity. Used only with your consent.
Marketing cookies: Google Ads and Meta Pixel, used to measure ad conversions and for remarketing. Used only with your consent.

Unless you give consent, analytics and marketing cookies are not set. On the English pages of our site, no analytics or marketing tag loads before you consent, so no measurement or advertising request is sent to Google, Meta or Microsoft. Google tags load only after you consent to analytics or marketing cookies and, through Google Consent Mode v2, follow each choice separately: analytics cookies are used only with your analytics consent, and advertising cookies only with your marketing consent. Google Tag Manager and Meta Pixel load only with your marketing consent, and Microsoft Clarity only with your analytics consent.

On the Turkish-language pages, Google tags (with Google Consent Mode v2) may send limited measurement data without using cookies before you consent; Microsoft Clarity does not load at all without your analytics consent; and Meta Pixel does not send measurement events without your marketing consent.

On the English pages, the cookie banner appears before any analytics or marketing tag runs. It presents “Necessary only” and “Accept all” with equal weight; under “Manage preferences”, the analytics and marketing options stay off until you turn them on, and you can choose them separately. You can change or withdraw your choice at any time with the button below or the “Cookie Preferences” link in the footer of every English page. When you withdraw your consent on an English page, we delete the analytics and marketing cookies stored for our domain (such as _ga, _gid, _gcl_au, _fbp and _clck) from your browser and the related tags no longer load. Cookies that providers set on their own domains can be deleted in your browser settings. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Retention and Security

Your personal data is kept for as long as the purpose of processing requires, taking into account the minimum periods set by the relevant legislation. Contact form records are kept while your request is being evaluated and, if a business relationship is established, for its duration; contract and billing records are kept for the period required by the relevant legislation. Your newsletter record is kept as long as your subscription continues; if you unsubscribe, your email address is kept only to make sure we do not send to you again. Cookies remain on your device for the period set by the relevant provider or until you delete them in your browser. At the end of the period, the data is deleted, destroyed or anonymized. Administrative and technical measures (access control, encryption, security updates, backups) are in place to keep the data secure.

8. Contact

For any questions, comments or requests about our privacy policy or your personal data, you can contact us:

Email:: mail@leindigital.com
Contact form:: leindigital.com/en/contact