1. General Information

At Crealab, we value your privacy and the protection of your personal data.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, use our contact forms, contact us by email, phone, or other communication channels, or otherwise interact with us digitally.

We aim to process personal data in accordance with applicable legislation, particularly the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

2. What Personal Data May We Collect?

The following personal data may be processed in connection with your use of our website and your communications with us.

Information You Provide Directly to Us

When you contact us or use forms available on our website, you may provide information such as:

• your first and last name,
• email address,
• telephone number,
• company or brand information,
• information relating to your service, project, or collaboration request,
• other information contained in messages or documents you choose to send us.

We recommend that you provide only the information necessary for us to evaluate and respond to your request.

Information Collected Automatically

When you use our website, certain technical information may be collected automatically depending on the technologies we use and your cookie preferences. This may include:

• IP address,
• browser type,
• device type,
• operating system,
• pages visited,
• time spent on the website,
• traffic and referral sources,
• interactions with the website and its content.

This information may be collected through cookies, pixels, analytics tools, and similar technologies.

For more detailed information about these technologies and how you can manage your cookie preferences, please review our Cookie Notice.

3. For What Purposes Do We Use Your Personal Data?

Your personal data may be processed for the following purposes:

• responding to questions, requests, and messages you send to us,
• providing information about services you request,
• evaluating quotation and project requests,
• establishing and managing business or service relationships with you,
• managing client and business relationships,
• ensuring the security and technical operation of our website,
• analyzing website usage and performance,
• improving the user experience,
• measuring the performance of advertising and marketing activities where your explicit consent is required,
• complying with legal obligations,
• preventing or managing legal disputes and protecting our rights.

Your personal data is processed in a manner that is relevant, limited, and proportionate to the purposes for which it is collected.

4. Legal Bases for Processing Your Personal Data

Depending on the relevant processing activity, your personal data may be processed on the basis of one or more of the personal data processing conditions set out under Article 5 of the KVKK.

Accordingly, your personal data may be processed without your explicit consent where:

• processing is directly related to the establishment or performance of a contract,
• processing is necessary for the data controller to comply with a legal obligation,
• processing is necessary for the establishment, exercise, or protection of a right, or
• processing is necessary for the legitimate interests of the data controller, provided that such processing does not prejudice your fundamental rights and freedoms.

Where none of the other personal data processing conditions provided under the KVKK apply, your personal data will be processed on the basis of your explicit consent.

Where a processing activity is based on your explicit consent, you may withdraw your consent at any time.

5. With Whom May We Share Your Personal Data?

We do not sell your personal data to third parties for commercial purposes.

However, where necessary for the purposes described above and in accordance with applicable legislation, your personal data may be shared with the following categories of recipients:

• IT, hosting, and technical infrastructure service providers,
• communication and business software service providers,
• analytics and measurement service providers,
• advertising and marketing service providers where explicit consent or another valid legal basis is available,
• our legal, financial, or professional advisors,
• public authorities and institutions legally authorized to receive such data,
• authorized persons and authorities where necessary to comply with legal obligations or protect our rights.

Any transfer of personal data is limited to what is necessary for the relevant purpose.

6. International Transfers of Personal Data

Some digital services, hosting infrastructure, analytics tools, communication services, or technology services we use may be provided by service providers located outside Türkiye. As a result, personal data may be transferred abroad.

Where such transfers take place, they are carried out in accordance with Article 9 of the KVKK and the applicable legislation governing international transfers of personal data, including the conditions and appropriate safeguards required under such legislation.

7. Cookies and Similar Technologies

Our website may use cookies and similar technologies to enable essential website functions, remember user preferences, analyze website usage and performance, improve the user experience, and, where permitted, measure advertising activities.

You can manage your preferences regarding non-essential cookies through the cookie preference panel available on our website.

For more detailed information about the cookies we use, their purposes, and how you can change your preferences, please review our Cookie Policy.

8. How Long Do We Retain Your Personal Data?

We retain your personal data only for as long as necessary for the purposes for which it is processed and within any retention periods required under applicable legislation.

When determining the appropriate retention period, we may consider:

• the purpose for which the data is processed,
• whether a business or service relationship is ongoing,
• legal obligations,
• applicable limitation periods,
• potential legal disputes, and
• relevant legislation.

Where the reasons requiring the processing of personal data cease to exist and there is no other legal obligation requiring its retention, the data will be deleted, destroyed, or anonymized in accordance with applicable legislation.

9. Security of Personal Data

We take appropriate technical and organizational measures designed to prevent the unlawful processing of and unauthorized access to personal data and to ensure that personal data is stored securely.

These measures may include restricting access permissions, using secure technical infrastructure, and implementing appropriate organizational safeguards.

However, no method of data transmission over the internet or electronic storage can provide absolute security.

10. Your Rights as a Data Subject

Under Article 11 of the Turkish Personal Data Protection Law No. 6698, you have the right to:

• learn whether your personal data is being processed,
• request information if your personal data has been processed,
• learn the purpose of the processing of your personal data and whether it is being used in accordance with that purpose,
• know the third parties to whom your personal data has been transferred in Türkiye or abroad,
• request the correction of your personal data if it has been processed incompletely or inaccurately,
• request the deletion or destruction of your personal data under the conditions set out in the KVKK,
• request that correction, deletion, or destruction operations be communicated to third parties to whom your personal data has been transferred,
• object to a result arising against you through the analysis of processed data exclusively by automated systems, and
• request compensation for damages where you suffer loss as a result of the unlawful processing of your personal data.

You may submit requests relating to these rights to the Data Controller.

11. Third-Party Websites and Services

Our website may contain links to third-party websites, social media platforms, or other digital services.

The personal data processing practices, content, and privacy policies of third-party websites or services are not under Crealab’s control.

We therefore recommend reviewing the relevant service provider’s privacy policy before using a third-party service or providing personal data through such service.

12. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time due to changes in our website, the technologies we use, the services we provide, or applicable legislation.

Where this Privacy Policy is updated, the revised version will be published on our website and the “Last updated” date below will be amended accordingly.

Where a change in the purposes or methods of personal data processing requires additional notification under applicable data protection legislation, the relevant information will be provided in accordance with legal requirements.

13. Contact

If you have any questions about this Privacy Policy or the processing of your personal data, you may contact us using the details below:

Data Controller: Zeynep Sarsılmaz

Email: hello@crealabagency.com

Address: Soğanyemez Mah. Cumhuriyet Meydanı No:7 D:503, 10300, Edremit/BALIKESİR, Türkiye

Last updated: October 25, 2026