LEGAL
Privacy Notice.
How Mars Creative collects, uses and protects personal data under the EU GDPR and UK GDPR: what we process, why, for how long, and your rights.
Last updated:
This notice explains how Mars Creative (“we”, “us”) handles personal data when you visit marscreative.com.tr, contact us or use our website assistant. It is written to meet the transparency requirements of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and it applies to everyone who uses our website, wherever they are. Our notices under Türkiye’s Personal Data Protection Law (KVKK) are available in Turkish: KVKK notice and privacy policy.
1. Who we are
The controller of your personal data is Abdurrahman Tanrıverdi, trading as Mars Creative, a sole proprietorship registered in Türkiye (Esenyurt Tax Office, tax number 60136462592). Registered address: Üçevler Mahallesi 939. Sokak Özyurtlar Kapı No:32B No:50, Esenyurt/İstanbul, Türkiye. Office: Zafer Mh. Haramidere Yolu Cd. No:28 Sembol İstanbul C Blok Kat 25, Esenyurt, İstanbul, Türkiye.
Email: info@marscreative.com.tr
Phone: +90 532 373 20 85
We handle privacy questions and requests ourselves; you can reach the person responsible at the email address above.
2. What we collect, why, and for how long
You do not have to give us personal data, but without contact details we cannot reply to you. We do not sell personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
| Activity | Personal data | Purpose and legal basis | How long we keep it |
|---|---|---|---|
| Contact and quote forms | Name, email address, phone number, company, website, your message, the service or package you chose, the page you sent the form from, where you came from (landing page, referring site, campaign tags, the page you viewed before the form), and the version of our privacy text shown to you. | To reply and prepare the proposal you asked for: steps taken at your request before entering into a contract (Art. 6(1)(b)). Following up a business enquiry: our legitimate interests (Art. 6(1)(f)). | Anonymised automatically 24 months after you send it, unless you become a client (see “Clients” below). |
| Website assistant (AI chat) | The messages you type, and your contact details if you choose to leave them. A random session ID and your last 20 messages are also kept in your own browser. | To answer your questions: our legitimate interests (Art. 6(1)(f)). If you ask us to contact you: steps before a contract (Art. 6(1)(b)). Your messages are sent to our AI provider to generate the replies. Please do not share sensitive information in the chat. | Conversation records on our systems are deleted automatically 90 days after the last message, unless the conversation became an enquiry (then as for forms). The copy in your browser expires 30 days after last use, or you can delete it at any time with the bin icon in the chat window. |
| Analytics (Google Analytics 4) | A random identifier stored in a cookie, the pages you view, device and browser information, and approximate location derived by Google. | To understand how the website is used: your consent (Art. 6(1)(a)). Analytics cookies are set only if you accept them. Before you choose, Google’s tag loads with consent set to “denied”: it sets no cookies and may send Google cookieless signals (such as the page and time) used for aggregate measurement. | Cookies up to 2 years. Event data is kept in Google Analytics for a limited period set in our account. |
| Advertising measurement (Google Ads) | An advertising cookie identifier, the Google ad click ID, and conversion events (for example, that a visit from an ad led to a form being sent, or that an enquiry became a qualified lead or a client). | To measure the results of our ads and to show ads to previous visitors (remarketing): your consent (Art. 6(1)(a)). Advertising cookies and the click ID are kept only if you accept marketing cookies. If your enquiry becomes a qualified lead or a client, we send Google only the click ID, the result and its time — never your name or contact details. | Cookie and click ID 90 days. |
| Visit statistics without cookies (Vercel Web Analytics) | Aggregated page views. No cookies or browser storage are used. | Basic traffic statistics: our legitimate interests (Art. 6(1)(f)). | Aggregated statistics only. |
| Hosting, security and abuse prevention | IP address, browser and device information, the address requested and the time, in server and security logs. IP addresses are also used briefly to limit repeated form and tool requests. | To keep the website secure and available: our legitimate interests (Art. 6(1)(f)). | Short-term, as set by our hosting provider. |
| “Page not found” reports | The address that could not be found and the page that linked to it. | To fix broken links: our legitimate interests (Art. 6(1)(f)). | Until the link is fixed or the report is cleared. |
| Google rank checker tool | The website address and keywords you enter. We do not ask for personal data. | To run the check you request: our legitimate interests (Art. 6(1)(f)). The query is sent to DataForSEO to fetch search results. | Not stored by us after the result is shown. |
| Emails, calls and WhatsApp messages you send us | Your contact details and what you tell us. | To reply: steps before a contract (Art. 6(1)(b)) or our legitimate interests (Art. 6(1)(f)). | Up to 24 months, unless you become a client. |
Clients
If you become a client, we keep contract, project and invoicing records for as long as Turkish commercial and tax law requires (up to 10 years), on the basis of our legal obligations and the contract.
3. Who receives your data
We use the service providers below. They process personal data on our instructions and only for the services they provide to us. We may also disclose data to public authorities where the law requires it, and to our professional advisers (for example, accountants) where needed for client work.
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Vercel Inc. | Website hosting, content delivery and cookieless visit statistics. | United States and global network |
| Supabase Inc. | Database for our content management system, where enquiries are stored. | European Union (Frankfurt) |
| Resend | Delivering enquiry notification emails to our team. | United States |
| Meta Platforms (WhatsApp Business Platform) | Instant notification of new enquiries to our team, and messages you send us on WhatsApp. | European Union and United States |
| Anthropic, PBC | The AI model that writes the website assistant’s replies. | United States |
| Google Analytics and Google Ads, loaded through the Google tag (gtag.js) with Google Consent Mode, which applies your cookie choices. | European Union and United States | |
| DataForSEO OÜ | Search results for the rank checker tool. | European Union (Estonia) |
4. International transfers
We are established in Türkiye, which does not have an adequacy decision from the European Commission or the United Kingdom. When you send us data, it is received and processed by us in Türkiye. Some of the providers above also process data in the United States or other countries outside the UK and the European Economic Area. Where they do, we rely on the safeguards they make available for such transfers, such as certification under the EU–U.S. Data Privacy Framework (and its UK Extension) or the European Commission’s Standard Contractual Clauses. You can ask us for details of the safeguard used by a particular provider.
5. Cookies and similar technologies
We use one essential cookie to remember your choice. Analytics and marketing cookies are set only if you agree to them. Before you choose, Google’s tag loads with consent set to “denied”: it sets no cookies and may send Google cookieless signals (such as the page and time) used for aggregate measurement. Where you came from (landing page, campaign tags) is kept in the browser tab during your visit and reaches us only with a form you send; the Google ad click ID is kept only with marketing consent. The assistant records (kept in your browser storage) are created only if you use the assistant.
| Name | Provider | Purpose | Duration | When |
|---|---|---|---|---|
| mc-consent | Mars Creative (first party) | Remembers your cookie choice and when you made it. | 180 days | When you make a choice (essential) |
| _ga, _ga_<ID> | Google Analytics | Counts visits and page use as statistics by giving your browser a random ID. | Up to 2 years | Only with analytics consent |
| _gcl_au | Google Ads | Measures conversions from Google ads and builds remarketing audiences. Google’s ad domains (such as doubleclick.net) may set their own cookies. | 90 days | Only with marketing consent |
| mc_gclid (browser storage) | Mars Creative (first party) | Keeps the click ID of a Google ad you clicked, so a form you send later can be matched to that ad. | 90 days | Only with marketing consent |
| mc_attr (browser storage) | Mars Creative (first party) | Keeps where you came from and the page you viewed before the form; sent to us only with a form you submit. | Until you close the tab | During your visit |
| mars-assistant-sid (browser storage) | Mars Creative (first party) | Recognises your chat session with the website assistant. Created with your first message. | 30 days after last use | Only if you use the assistant |
| mars-assistant-hist (browser storage) | Mars Creative (first party) | Keeps your last 20 messages on your device so you can continue the conversation. | 30 days after last use | Only if you use the assistant |
You can review or change your choice at any time with the
Cookie settings link at the bottom of every page.
When you withdraw consent for a category, its tools stop running and the related cookies on our domain
(such as _ga and _gcl_au) are deleted from your device. If you clear
cookies in your browser, your choice is cleared too and we ask again on your next visit.
6. Your rights
Under the GDPR and the UK GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected and incomplete data completed;
- have your data erased in the cases set out in the law;
- restrict how we use your data;
- receive data you gave us in a portable format (data portability);
- object at any time to processing based on our legitimate interests, and to any direct marketing;
- withdraw your consent at any time, without affecting processing carried out before the withdrawal;
- lodge a complaint with a supervisory authority: in the EU or EEA, the data protection authority of the country where you live, work or where the issue occurred (list of authorities); in the UK, the Information Commissioner’s Office.
To use these rights, email info@marscreative.com.tr. It is free of charge. We reply within one month; for complex requests we may extend this by up to two further months and will tell you why. We may ask you to confirm your identity before acting on a request. You can also contact us first if you have a concern; we would like the chance to resolve it.
7. Security
The website is served over HTTPS only. Access to enquiries and conversation records is limited to the people at Mars Creative who need it to do their work, and we use established providers with their own security programmes. No method of transmission over the internet is completely secure, but we review our measures when our services change.
8. Children
Our services are for businesses. The website is not directed at children, and we do not knowingly collect personal data from anyone under 16.
9. When we process data for our clients
When we build or run websites, online shops, campaigns or AI assistants for clients, the client decides how its own customers’ personal data is used, and we process that data on the client’s behalf under a written data processing agreement (Article 28 GDPR). This notice covers only our own website and the enquiries we receive.
10. Changes to this notice
We update this notice when the way we process personal data changes. The date at the top of this page shows the current version.