Privacy Policy.
Privacy And Cookie Policy
Last updated: 26 October 2026. This policy applies under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Who Is Responsible For Your Data
The data controller for this website is Brandefense Bilişim Danışmanlık Sanayi ve Ticaret Anonim Şirketi, Üniversiteler, 1605 Cd. Cyberpark Vakıf Binası Kat: -1 No: B25, 06800 Çankaya, Ankara, Türkiye. Our group company Brandefense Inc. (300 Delaware Ave. Ste 210 #328, Wilmington, DE, USA) is not a controller of the data collected through this website.
Contact for privacy questions and rights requests: info@brandefense.io. We have not appointed a data protection officer or an EU representative; all requests go to this address.
2. What Data We Collect And Why
| Purpose | Data | Legal basis (GDPR / KVKK) |
|---|---|---|
| Answer demo, contact and report requests | Name, business email, company, country, message | Steps at your request before a contract (GDPR Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)). KVKK Art. 5(2)(c) and (f). |
| Marketing emails (news, product updates, events) | Name, email, company, interests | Your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)). Optional and separate from any request. You can withdraw at any time, and every email has an unsubscribe link. |
| Website analytics and measurement | Pages viewed, device and browser data, approximate location, cookie identifiers, IP address | Consent for non-essential cookies and similar technologies (GDPR Art. 6(1)(a); ePrivacy rules). |
| Advertising measurement | Cookie identifiers, pages viewed, conversion events | Consent (GDPR Art. 6(1)(a)). |
| Security and keeping the site working | IP address, request logs | Legitimate interest (Art. 6(1)(f)); KVKK Art. 5(2)(f). |
| Domain check and other free tools | Domain you enter, email, company | Steps at your request; consent for any marketing. |
| Legal obligations and claims | Records needed by law | Legal obligation (Art. 6(1)(c)); KVKK Art. 5(2)(a), (e). |
Requesting a demo or a report does not require you to agree to marketing emails.
3. Tools And Providers We Use (Processors And Recipients)
- Google Tag Manager - loads the other tags on the site (Google).
- Google Analytics 4 - website analytics (Google). Loaded only after you agree to analytics cookies.
- HubSpot - forms, contact records, email marketing and CRM (HubSpot, Inc. and its EU entity).
- Google Ads - advertising measurement and conversion tracking (Google). It runs only after you agree to advertising cookies.
- LinkedIn Insight Tag - advertising measurement and conversion tracking (LinkedIn). It runs only after you agree to advertising cookies.
- Microsoft Clarity - website analytics, such as heatmaps and session replays that help us see how pages are used (Microsoft). It runs only after you agree to analytics cookies.
- OpenAI advertising pixel - advertising measurement (OpenAI). It runs only after you agree to advertising cookies.
- Efilli - consent management platform that shows the cookie banner and stores your cookie choices.
- Website hosting, email and security providers that process data on our behalf under written agreements.
We do not sell personal data. We may share data with professional advisers, with authorities when the law requires it, and with group companies. If we add or remove a tool, we update this list.
4. Cookies And Similar Technologies
When you first visit, the Efilli consent banner lets you accept or refuse non-essential cookies. Strictly necessary cookies (for example storing your consent choice and keeping the site secure) are always on. Analytics, advertising and marketing cookies are set only after you agree. You can change your choice at any time through the Cookie Settings link in the page footer or in your browser settings.
| Category | Provider | Purpose | Lifetime |
|---|---|---|---|
| Strictly necessary | Brandefense, Efilli | Consent record, security, basic site function | Session, or up to the period the provider sets for the consent record |
| Analytics | Google (Tag Manager, GA4) | Count visits and understand page use | Analytics data is kept for 14 months in GA4; the cookies themselves expire as Google sets them |
| Analytics | Microsoft (Clarity) | Show how visitors use pages (heatmaps, session replays). Cookies: _clck, _clsk, CLID, ANONCHK, MR, MUID, SM | As set by Microsoft; the session cookie _clsk is short-lived |
| Advertising | Google (Ads) | Measure ad conversions. Cookies: _gcl_au, _gcl_aw, and Google advertising cookies such as IDE | _gcl_au and _gcl_aw: 90 days; IDE: 13 to 24 months depending on region |
| Advertising | LinkedIn (Insight Tag) | Measure ad conversions and understand ad audiences. Cookies: li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory, li_fat_id | From 24 hours (lidc) to 1 year (bcookie); li_sugr 90 days; UserMatchHistory, AnalyticsSyncHistory and li_fat_id 30 days |
| Advertising | OpenAI | Measure the results of our ads | As set by the provider |
| Forms and CRM | HubSpot | Link a form submission to a visit; contact records | As set by HubSpot, usually up to about 13 months |
Cookie names and exact lifetimes are set by each provider and can change. Your browser shows the cookies currently stored.
5. International Transfers
Some providers above are based outside the EU, EEA and Türkiye, including in the United States. Where we transfer personal data abroad, we rely on the safeguards the law allows: an adequacy decision where one exists, otherwise standard contractual clauses or the provider's own transfer safeguards. For KVKK Art. 9, we transfer data abroad on the basis of your explicit consent or the appropriate safeguards the Law provides, and we give notice to the Authority where the Law requires it. You can ask us for information about the safeguards we use.
6. How Long We Keep Data
- Demo and contact requests, and the related lead record: as long as our business relationship or conversation lasts, plus the legal limitation period that applies to possible claims.
- Marketing subscribers: until you withdraw consent. We then keep a minimal suppression record so we do not email you again.
- Analytics data in GA4: 14 months. Advertising data: as long as the provider keeps it under its own settings.
- Server and security logs: kept only as long as needed for security and troubleshooting, normally for a short period.
- Records we must keep by law: for the period the law requires.
7. Your Rights
Under the GDPR you can ask for access, correction, deletion, restriction and portability. You can object to processing based on legitimate interest, and withdraw consent at any time. Under KVKK Art. 11 you can ask whether your data is processed, request information, learn the purpose, learn the third parties it is shared with, ask for correction or deletion, ask for notice to those third parties, object to results produced solely by automated analysis, and claim compensation for damage. To use these rights write to info@brandefense.io. We answer within one month (GDPR) or 30 days (KVKK). You may also complain to your local data protection authority or to the Turkish Personal Data Protection Authority (KVKK).
8. Security And Children
We use technical and organizational measures to protect data, such as access controls, encryption in transit and limiting access to staff who need it. The site is for business users and is not directed to children.
9. Changes And Contact
We will post changes on this page with a new date. Questions: info@brandefense.io, Brandefense, Cyberpark, Ankara, Türkiye.