This notice explains how we process the personal data of people who visit our website at loyetta.com (the "Site") and use the forms and tools on the Site. It is issued under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, for visitors from the European Union, also provides the information required by the General Data Protection Regulation ("GDPR") to the extent it applies.
1. Data Controller
The data controller is KROPPA REKLAM YAZILIM VE TEKNOLOJİ HİZMETLERİ ANONİM ŞİRKETİ ("Kroppa", "we"). Loyetta is a product of Kroppa.
| Company name | KROPPA REKLAM YAZILIM VE TEKNOLOJİ HİZMETLERİ ANONİM ŞİRKETİ |
|---|---|
| Address | İçerenköy Mah. Topçu İbrahim Sk. Quick Tower No:8/10, Ataşehir / İstanbul, Türkiye |
| MERSIS No. (central registration number) | 0590132444300001 |
| Trade registry No. | 107383-5 |
| Registered e-mail (KEP) | [email protected] |
| [email protected] | |
| Phone | +90 216 580 96 96 |
The Amsterdam and Seattle offices shown on the Site are operated by separate companies. Kroppa is the data controller for all personal data collected through the Site.
2. Personal Data We Process
| Category | Data | Collected through |
|---|---|---|
| Identity | Full name | Demo request form, contact form |
| Contact details | Business e-mail address, phone number | Demo request form, contact form, ROI calculator, Loyalty programme assessment |
| Professional information | Your role; type and stage of your loyalty programme | Demo request form |
| Request details | Subject and message in the contact form | Contact form |
| Business information | Business figures you enter in our tools (e.g. business model, annual revenue, gross margin, number of points of sale) and your assessment answers | ROI calculator, Loyalty programme assessment |
| Marketing | The campaign that brought you to the Site (UTM parameters, Google Ads click ID, landing page) — only if you accepted cookies | Demo request and contact forms |
| Security data | IP address, browser and device information, time of visit, reCAPTCHA verification data | Automatically while you use the Site |
| Online identifiers | Identifiers and usage data obtained through cookies and similar technologies | The Site; see our Cookie Policy |
We do not ask for special categories of personal data (such as health or beliefs); please do not include such information in free-text fields.
3. How We Collect Data
We collect personal data directly from you through the forms and tools on the Site, and while you use the Site through cookies and similar technologies, electronically and by partly or fully automated means.
4. Purposes and Legal Bases
| Purpose | Legal basis (KVKK) | GDPR |
|---|---|---|
| Receiving, assessing and answering your demo and contact requests; pre-contractual discussions and proposals | Necessary for entering into or performing a contract (Art. 5(2)(c)); legitimate interest (Art. 5(2)(f)) | Art. 6(1)(b), Art. 6(1)(f) |
| Calculating and presenting the results of the ROI calculator and the Loyalty programme assessment | Necessary for entering into or performing a contract (Art. 5(2)(c)) | Art. 6(1)(b) |
| Sending commercial electronic messages about our products and services | Explicit consent (Art. 5(1)) and your approval under Law No. 6563 | Art. 6(1)(a) |
| Keeping the Site secure, preventing form abuse and spam, detecting errors | Legitimate interest (Art. 5(2)(f)); legal obligation (Art. 5(2)(ç)) | Art. 6(1)(f), Art. 6(1)(c) |
| Remembering settings the Site needs to work, such as your language and region | Necessary for entering into or performing a contract (Art. 5(2)(c)); legitimate interest (Art. 5(2)(f)) | Art. 6(1)(f) |
| Analysing Site usage and measuring the performance of our ad campaigns (analytics and advertising cookies, campaign source) | Explicit consent (Art. 5(1)) | Art. 6(1)(a) |
| Complying with legal obligations and answering requests from competent authorities | Expressly provided by law; legal obligation (Art. 5(2)(a), (ç)) | Art. 6(1)(c) |
| Establishing, exercising and defending our legal rights in disputes | Establishment, exercise or protection of a right (Art. 5(2)(e)) | Art. 6(1)(f) |
Where we rely on legitimate interest, our interest is to answer your requests quickly and accurately and to operate the Site securely. Where we rely on consent, you may withdraw it at any time; this does not affect the lawfulness of processing before withdrawal.
5. Recipients
We do not sell your personal data. Data collected through the Site is not shared with the separate companies that operate our offices abroad. Your data may be disclosed, only for the purposes above and within the conditions of Articles 8 and 9 KVKK, to the following recipients:
| Recipient | Purpose | Location |
|---|---|---|
| DigitalOcean (hosting) | Running the Site on servers | Frankfurt, Germany |
| Cloudflare (content delivery and security) | Delivering the Site quickly and securely | Global network |
| Google (Tag Manager, Analytics, Ads, reCAPTCHA, YouTube) | Tag management; with your consent, analytics and ad measurement; form security; video playback (only when you start a video) | USA and other countries |
| Meta Platforms (Meta Pixel) | Ad measurement, with your consent | USA and other countries |
| OpenAI (ad measurement pixel) | Ad measurement, with your consent | USA |
| Competent public authorities and courts | Compliance with legal obligations | Türkiye |
| Our legal and financial advisers | Protection of rights (under confidentiality obligations) | Türkiye |
6. International Transfers
Some of the service providers above process data outside Türkiye, so your personal data is transferred abroad. These transfers rely on the mechanisms set out in Article 9 KVKK (for example standard contracts notified to the Turkish Personal Data Protection Authority). Transfers for analytics and advertising only take place if you have given your consent in the cookie settings.
For visitors from the European Economic Area, your data is processed by Kroppa in Türkiye. Transfers by our service providers to third countries rely on the safeguards in Chapter V GDPR, such as adequacy decisions or the European Commission’s standard contractual clauses.
7. Retention
| Data | Retention period |
|---|---|
| Demo and contact requests | 2 years after the request is closed. If the request leads to a customer relationship, for the duration of that relationship and thereafter for the statutory limitation periods. |
| ROI calculator and Loyalty programme assessment data | 2 years after the result is generated |
| Consent to commercial electronic messages | Until you withdraw it; consent records are kept for 3 years after the consent ends |
| Security logs | Up to 2 years |
| Cookies and browser storage | As stated in our Cookie Policy |
When the retention period ends or the reason for processing no longer exists, your data is deleted, destroyed or anonymised.
8. Your Rights under KVKK
Under Article 11 KVKK you have the right to:
- learn whether your personal data is processed;
- request information about the processing;
- learn the purpose of processing and whether data is used in line with that purpose;
- know the third parties to whom your data is disclosed in Türkiye or abroad;
- request correction of incomplete or inaccurate data;
- request erasure or destruction of your data under the conditions of Article 7 KVKK;
- request that correction, erasure or destruction be notified to third parties to whom the data was disclosed;
- object to a result against you arising exclusively from automated analysis of your data;
- claim compensation for damage caused by unlawful processing.
You may also withdraw your consent at any time: for cookies, use the Cookie Preferences link at the bottom of each page; for commercial messages, use the unsubscribe link in the message or write to [email protected].
9. Your Rights under the GDPR
If the GDPR applies to you, you have the right to access your data, to have it rectified or erased, to restrict processing, to data portability, to object to processing based on legitimate interest and to withdraw your consent. You may also lodge a complaint with the data protection supervisory authority in your country.
10. How to Submit a Request
You can send us your request in one of the following ways, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- In writing, with your wet signature, to: İçerenköy Mah. Topçu İbrahim Sk. Quick Tower No:8/10, Ataşehir / İstanbul, Türkiye (please mark the envelope "Personal Data Information Request")
- By registered electronic mail (KEP) to: [email protected]
- From the e-mail address you previously gave us and that is registered in our systems, to: [email protected]
You can use the ready-made form on our Data Subject Request page. We will answer your request free of charge within 30 days at the latest, depending on its nature; if the request involves additional cost, the fee set by the Turkish Personal Data Protection Board may be charged. We may ask for additional information to verify your identity.
If your request is rejected, you find our answer insufficient or we do not answer in time, you may lodge a complaint with the Turkish Personal Data Protection Board.
11. Children
The Site is intended for business professionals. We do not knowingly collect personal data from anyone under 18.
12. Changes
We may update this notice to reflect changes in our processing activities or in the law. The current version is always published on this page; the date at the top shows the latest update.
