Data Protection Notice

The data controller under the KVKK is the company operating Merkez Ankara Mall. You can find the data controller's contact details on the Contact page of our website.

Identity and contact data: Name, surname, email address and telephone number.

Visit and technical data: IP address, browser information, page views and session duration records generated when you access our website.

Security data: Image recordings obtained through CCTV systems within the mall.

Contact request data: Messages sent to us through the contact form or by email.

Newsletter subscription data: Your email address and preferences when you subscribe to our e-newsletter.

Your personal data is processed for the following purposes:

• Operating and improving the mall and our digital services

• Ensuring visitor safety and maintaining order within the mall

• Responding to customer requests and complaints

• Sending newsletters and event announcements, subject to your explicit consent

• Fulfilling legal obligations and notifying authorised institutions

• Ensuring business continuity and information security

Your personal data is processed on the following legal grounds under Articles 5 and 6 of the KVKK:

• Processing is directly related to the establishment or performance of a contract (Art. 5/2-c)

• Processing is necessary for the data controller to fulfil a legal obligation (Art. 5/2-ç)

• Processing is necessary for legitimate interests, provided that fundamental rights and freedoms are not harmed (Art. 5/2-f)

• Your explicit consent, solely for newsletter subscriptions and marketing communications (Art. 5/1)

Your personal data may be shared with public institutions where legally required and with our business partners under confidentiality and security obligations for technical infrastructure services.

Your personal data is not shared with third-party individuals or legal entities for commercial purposes without your explicit consent.

Transfers abroad take place only when the conditions under Article 9 of the KVKK are met and the necessary safeguards are in place.

Your personal data is deleted, destroyed or anonymised when the purpose of processing no longer exists or the retention period prescribed by applicable legislation expires.

CCTV recordings are retained for no longer than 30 days, while newsletter subscription data is retained for one year after cancellation.

Under Article 11 of the KVKK, you may apply to the data controller to exercise the following rights:

• Learn whether your personal data is being processed

• Request information if your personal data has been processed

• Learn the purpose of processing and whether the data is used accordingly

• Know the third parties to whom your data is transferred in Türkiye or abroad

• Request correction of incomplete or inaccurate data

• Request deletion or destruction under Article 7 of the KVKK

• Request notification of these actions to third parties to whom the data was transferred

• Object to an outcome against you resulting from analysis exclusively by automated systems

• Claim compensation for damage caused by unlawful processing

To exercise the rights listed above, you may contact us through the channels on our Contact page or submit a written application to the data controller's address.

Your application must be submitted in writing with documents verifying your identity or by another method specified in the KVKK. Applications received by us will be answered within 30 days at the latest.