Privacy Policy

Scope

This Privacy Policy explains how SCL TEKNOLOJİ ARAŞTIRMA VE DANIŞMANLIK ANONİM ŞİRKETİ ("SCL") processes and protects your personal data in connection with the synthetic-consumers.com website (its Turkish and English versions), the forms on this website, the SCL newsletter, SCL's online software platform (SaaS) and orders placed for that platform.

The information that must be provided to you under the Turkish Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, the "KVKK") is set out in the KVKK Privacy Notice section of this page. The privacy notice is provided for information only and you are not asked to approve it; where a form refers to it, you may only be asked to state that you have read and understood it ("I have read and understood"). For processing based on explicit consent, your consent is requested separately from this notice, through a separate statement.

This policy describes processing on pages belonging to third parties, such as iyzico's payment form and Google's booking page, only to the extent that it concerns SCL; any other processing on those pages is governed by the relevant company's own policy. Processing relating to SCL's employees and job applicants is outside the scope of this policy.

KVKK Privacy Notice

This privacy notice has been prepared by SCL as data controller under Article 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ). This section sets out, in order: the data controller; the personal data processed for each activity, the purposes of processing and the legal grounds; the groups of recipients; transfers abroad; the method of collection; and your rights and how to apply. A printable version of the notice: KVKK Privacy Notice (PDF, in Turkish).

Data controller

Registered company name

SCL TEKNOLOJİ ARAŞTIRMA VE DANIŞMANLIK ANONİM ŞİRKETİ

Trading name

Synthetic Consumer Lab (SCL)

MERSİS number

0757108001900001

Trade registry

Istanbul Trade Registry (İstanbul Ticaret Sicili), registration no. 1099510

Registered office address

Akat Mah. Hare Sk. 2. Söltaş Evleri K-8 Blok No: 16 Beşiktaş/İstanbul

Telephone

0212 351 54 65

E-mail

[email protected]

Website

synthetic-consumers.com

Personal data processed, purposes of processing and legal grounds. We process your personal data only for the activities listed below. For each activity, we state separately which data is processed, the purpose, the legal ground under Article 5 of the KVKK, how the data is collected and to whom it is transferred.

When you visit our website

Data processed

IP address, browser and device information, the address of the page visited, the referring page and the time of access. If a connection error occurs, your browser may also send Cloudflare a technical network error report. When unusual traffic or a security threat is detected, Cloudflare may also place a short-lived cookie in your browser, solely for security purposes.

Purpose

Delivering the website to you; keeping the website secure and running without interruption; preventing attacks and misuse.

Legal ground

KVKK Article 5(2)(f): SCL's legitimate interests.

Method of collection

The information your browser sends when you open the website is received by automated means by the Cloudflare infrastructure on which the website is hosted.

Recipients

Cloudflare (hosting and content delivery service).

When fonts are loaded (Google Fonts)

Data processed

IP address, browser information and the address of the page requesting the font.

Purpose

Displaying the fonts on the website correctly.

Legal ground

KVKK Article 5(2)(f): SCL's legitimate interests.

Method of collection

When a page opens, your browser requests the font files directly from Google's servers; this information is passed to Google by automated means at that moment. Google does not place cookies during this request.

Recipients

Google.

Charts on study pages (Plotly)

Data processed

IP address, browser information and the address of the page requesting the charting library.

Purpose

Displaying the interactive charts on study pages.

Legal ground

KVKK Article 5(2)(f): SCL's legitimate interests.

Method of collection

When a study page opens, your browser requests the charting library directly from Plotly's servers (cdn.plot.ly); this information is passed to Plotly by automated means at that moment.

Recipients

Plotly.

Newsletter subscription

Data processed

Your e-mail address; your language preference; the page on which you subscribed; the text of the consent checkbox and the time it was ticked; the subscription status (awaiting confirmation, confirmed, unsubscribed) and the related dates; a random identifier used in the confirmation and unsubscribe links.

Purpose

Creating the subscription through double opt-in, that is, by the owner of the address confirming the link sent to their e-mail; sending the SCL newsletter and announcements by e-mail; proving consent and unsubscription.

Legal ground

For sending the newsletter, the explicit consent you give when subscribing (KVKK Article 5(1)); this consent is also your consent to commercial electronic messages under the Law on the Regulation of Electronic Commerce No. 6563 (Elektronik Ticaretin Düzenlenmesi Hakkında Kanun). For keeping the consent records, KVKK Article 5(2)(ç) and (e).

Method of collection

Electronically, through the newsletter form on the website and the confirmation link sent to your e-mail.

Recipients

Cloudflare (storing the records); Brevo (sending the confirmation e-mail and the newsletter); Google (where the newsletter is sent from SCL's corporate e-mail account).

You can unsubscribe at any time using the link included in every newsletter, on the synthetic-consumers.com/abonelikten-cik page, or by sending an e-mail to [email protected]. Withdrawing your consent does not affect the lawfulness of processing carried out before it was withdrawn.

Unsubscribing and the opt-out list

Data processed

The e-mail address that you enter on the unsubscribe page, that is identified through the link in an e-mail, or from which you send us an e-mail asking to unsubscribe; your language preference; and the time of unsubscribing.

Purpose

Stopping the newsletter and keeping an opt-out record so that the newsletter is not sent to that address again. An address entered on the unsubscribe page is added to the opt-out list even if it was never subscribed through our website.

Legal ground

KVKK Article 5(2)(ç): the obligation to comply with opt-out requests under Article 8 of Law No. 6563; KVKK Article 5(2)(f): SCL's legitimate interests.

Method of collection

Electronically, through the unsubscribe page, the link in e-mails, or an unsubscribe request you send to [email protected].

Recipients

Cloudflare (storing the records); Google (SCL's corporate e-mail service, for unsubscribe requests sent by e-mail).

Early access requests

Data processed

Full name, work e-mail address, company name and telephone number (the last two are optional), language preference and the time of the request.

Purpose

Responding to your request, scheduling the introductory meeting and giving you access when the platform becomes available.

Legal ground

KVKK Article 5(2)(c): the processing is directly related to a contract to be concluded at your request; if you make the request on behalf of a company, KVKK Article 5(2)(f): SCL's legitimate interests.

Method of collection

Electronically, through the early access form on the website. Your request is recorded and two e-mails are sent via Brevo: a notification containing the details of your request to SCL's corporate e-mail account, and an e-mail to you confirming that your request has been received.

Recipients

Cloudflare (storing the records); Brevo (sending the e-mails); Google (SCL's corporate e-mail service).

The information you submit through the early access form is not used to send you newsletters or promotional e-mails unless you give separate consent.

Meeting scheduling (Google Calendar)

Data processed

The meeting time you choose and the information you enter on Google's booking page (such as your full name and e-mail address).

Purpose

Scheduling and holding the introductory meeting.

Legal ground

KVKK Article 5(2)(c): the processing is directly related to a contract to be concluded at your request; if you make the request on behalf of a company, KVKK Article 5(2)(f): SCL's legitimate interests.

Method of collection

Electronically, through the booking page provided by Google and displayed in a frame (iframe) on our page after you submit the early access form. The appointment you create is saved in SCL's Google Calendar.

Recipients

Google.

If you prefer not to use the booking page, you can also send your meeting request by e-mail to [email protected].

E-mail correspondence

Data processed

Your e-mail address, your name, your signature details and any other information you share in your message, together with our replies to you.

Purpose

Responding to your questions, requests and complaints; keeping a record of the correspondence.

Legal ground

KVKK Article 5(2)(c) where the correspondence relates to a contract or an order; KVKK Article 5(2)(f) for other correspondence; KVKK Article 5(2)(a) and (ç) for keeping commercial correspondence.

Method of collection

Electronically, through e-mails you send to [email protected] or to SCL employees.

Recipients

Google (SCL's corporate e-mail service).

Platform account and use of the platform

Data processed

Full name, e-mail address and, if any, your company name; account login details; Person-Question credit balance and records of credits added and used; records kept for account and transaction security (such as IP address and login time); your support requests.

Purpose

Opening and managing the account; providing the platform service; adding credits and monitoring their use; providing support; keeping the account secure and preventing misuse.

Legal ground

KVKK Article 5(2)(c): the conclusion and performance of the contract; KVKK Article 5(2)(f) for account security, for preventing misuse and for persons who use the platform on behalf of a company; KVKK Article 5(2)(ç) for statutory record-keeping obligations.

Method of collection

Electronically, through the information you provide when opening an account and using the platform, and the records the platform generates automatically.

Recipients

The platform's software development, maintenance, hosting and infrastructure service providers; the e-mail delivery service provider.

Study content and AI models

Data processed

The study content you create or upload on the platform (survey questions, research designs, target audience definitions, product and concept descriptions, images and files), the synthetic responses and reports generated from it, and any personal data you add to that content.

Purpose

Generating synthetic participants' answers, analysing the results and presenting them to you.

Legal ground

KVKK Article 5(2)(c): the performance of the contract (for the personal data of the person using the platform).

Method of collection

Electronically, through the content you enter or upload on the platform.

Recipients

The AI model providers used to generate the synthetic responses, and the platform's software development, maintenance and hosting service providers. These providers' servers may be located abroad.

Synthetic participants are not real people; their answers are the output of AI models. Unless it is necessary for the study, please do not add personal data relating to yourself or others to study content, in particular special categories of personal data such as health, religious or biometric data. If you add personal data relating to other people to study content, the user who adds the data is responsible for informing those people and for having a legal ground for that data under Article 5 of the KVKK; SCL processes such data only in order to provide the service to you.

Orders, payment and invoicing

Data processed

For an Individual Buyer: full name, Turkish identity number (T.C. kimlik numarası), billing address, e-mail address and telephone number; for a Corporate Buyer: trade name, tax identification number, tax office and billing address, together with the full name, e-mail address and telephone number of the person placing the order. In addition: customer number; order details (package, number of Person-Questions, amount, date); records of the texts confirmed during the order (time of confirmation, IP address, version of the text); the outcome of the payment and the transaction reference; and invoice, refund and chargeback records (including records of the use of the disputed credits, which may be submitted to the card-issuing bank through iyzico in a chargeback). For payments made by Corporate Buyers by bank transfer (havale or EFT), also the name or trade name of the sender and their bank and IBAN details.

Purpose

Receiving and performing the order; collecting payment through iyzico or, for Corporate Buyers, by bank transfer (havale or EFT); issuing the invoice and sending it by e-mail; meeting accounting and tax obligations; keeping the records required under the Distance Contracts Regulation (Mesafeli Sözleşmeler Yönetmeliği); handling refunds, chargebacks and disputes; preventing payment fraud.

Legal ground

KVKK Article 5(2)(c): the conclusion and performance of the contract; KVKK Article 5(2)(a) and (ç) for obligations arising from tax, commercial and consumer legislation; KVKK Article 5(2)(e) for refunds, chargebacks and disputes; KVKK Article 5(2)(f) for fraud prevention and for persons acting on behalf of a Corporate Buyer.

Method of collection

Electronically, through the order and payment pages; the outcome of the payment is reported by iyzico. For payments made by bank transfer (havale or EFT), the sender's details are obtained from SCL's bank account transactions.

Recipients

iyzico; for payments made by bank transfer (havale or EFT), the banks SCL works with; the e-invoice and e-archive invoice service provider; the accountant (mali müşavir); the Revenue Administration (Gelir İdaresi Başkanlığı) and other competent public authorities.

The card number, expiry date and security code (CVV/CVC) are entered directly on iyzico's payment form; SCL does not see, receive or store this information. Details are given in the "Payment security" section of this page.

Groups of recipients to whom personal data is transferred and purposes of transfer

Your personal data is transferred only to the extent necessary for the activity concerned and on the legal grounds stated above for each activity. Transfers abroad are explained separately below. SCL does not sell or rent out personal data.

Transfer of personal data abroad

The servers of Cloudflare, Google, Brevo and Plotly, and those of the hosting and AI model providers used on the platform, are or may be located outside Türkiye. When these services are used, the personal data stated for each activity is transferred, limited to the purpose of that activity, to the countries where these providers are located (mainly the USA and European Union countries, and also other countries where the providers' servers are located).

To obtain information about your data transferred abroad and about the countries and providers to which it is transferred, you can apply to SCL through the channels set out below.

Method of collecting personal data and legal grounds

Your personal data is collected by automated means when you visit the website and use the platform; electronically, when you provide it through forms, the order and payment pages, the booking page and e-mail; and by non-automated means in the case of written applications you send by post. The outcome of payments is obtained from iyzico, the sender details of payments made by bank transfer (havale or EFT) from SCL's bank account transactions, and appointment details through Google Calendar.

The legal grounds stated for each activity are the following grounds listed in Article 5 of the KVKK:

• Article 5(1): your explicit consent (for sending the newsletter only);
• Article 5(2)(a): it is expressly provided for by law;
• Article 5(2)(c): processing the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract;
• Article 5(2)(ç): it is necessary for SCL to comply with a legal obligation;
• Article 5(2)(e): processing is necessary for the establishment, exercise or protection of a right;
• Article 5(2)(f): processing is necessary for SCL's legitimate interests, provided that it does not harm your fundamental rights and freedoms.

Your explicit consent is not requested for processing whose legal ground is one of the grounds listed in the second paragraph of Article 5 of the KVKK. SCL does not request special categories of personal data (KVKK Article 6) for its activities.

Your rights under Article 11 of the KVKK

Under Article 11 of the KVKK, you have the right to:

• learn whether your personal data is processed;
• if it has been processed, request information about it;
• learn the purpose of the processing and whether the data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom your data is transferred;
• request that it be corrected if it is incomplete or inaccurate;
• request that it be erased or destroyed under the conditions set out in Article 7 of the KVKK;
• request that the correction, erasure or destruction be notified to the third parties to whom your data has been transferred;
• object to an outcome to your detriment arising from the analysis of the processed data exclusively by automated systems;
• claim compensation for any damage you suffer because your personal data has been processed unlawfully.

Where processing is based on your explicit consent (the newsletter), you can withdraw your consent at any time.

How to apply

You can submit requests relating to your rights to SCL in Turkish, in accordance with the Communiqué on the Procedures and Principles of Applications to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), by one of the following means:

• by a signed petition, delivered in person or sent by post to: Akat Mah. Hare Sk. 2. Söltaş Evleri K-8 Blok No: 16 Beşiktaş/İstanbul;
• by e-mail to [email protected] from the e-mail address you have previously notified to SCL and that is held in SCL's records;
• signed with a secure electronic signature or mobile signature, to [email protected].

Your application must include your name and surname; your signature, if the application is made in writing; your Turkish identity number if you are a citizen of the Republic of Türkiye or, if you are a foreign national, your nationality and your passport number or identity number, if any; your residential or business address for service of notices; your e-mail address and telephone number for notifications, if any; and the subject of your request. You may attach information and documents relating to your request. SCL may ask for additional information to establish whether the applicant is the data subject.

SCL will conclude your application free of charge as soon as possible, depending on the nature of the request, and within 30 (thirty) days at the latest. If the action entails an additional cost, only the fee laid down in the Communiqué on the Procedures and Principles of Applications to the Data Controller may be charged. The response will be sent to you in writing or electronically.

If your application is rejected, you find the response insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 (thirty) days of learning of the response and in any event within 60 (sixty) days of the date of your application (kvkk.gov.tr).

Payment security

Card payments on the platform are taken through the infrastructure of iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. ("iyzico"). Payment can be made with Visa- or Mastercard-branded credit and debit cards.

• The card number, expiry date and security code (CVV/CVC) are entered directly on iyzico's secure payment form. SCL does not see, receive or store this information.
• Card details are processed on iyzico's PCI-DSS Level 1 certified infrastructure, under iyzico's responsibility.
• To enable the payment, SCL sends iyzico the buyer's full name or trade name, e-mail address, telephone number, Turkish identity number or tax identification number, billing address (including city and country), customer number at SCL, and the order contents and amount; and, where they are sent for fraud prevention purposes, also the buyer's IP address and the dates on which the buyer's account was opened and last logged into (KVKK Article 5(2)(c), (ç) and (f)).
• iyzico notifies SCL of the outcome of the payment (approval or rejection) and the transaction reference. SCL uses this information to keep track of the order, the invoice and any refunds or chargebacks.
• iyzico also processes this data under its own responsibility, within the scope of its own legal obligations relating to payment transactions. Information about this processing is available in iyzico's privacy policy (iyzico.com).

Information security

Under Article 12 of the KVKK, SCL takes technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of personal data and unlawful access to it, and to ensure that it is safeguarded. Our main measures are:

• The website and forms are served only over an encrypted connection (HTTPS); the information you enter in forms is transmitted in encrypted form.
• Card details never reach SCL's systems; payment is made on iyzico's secure payment form.
• Forms ask only for the information needed for the purpose; fields such as company name and telephone number are optional.
• For sign-ups made through the newsletter form on the website, an e-mail address is not added to the mailing list until its owner confirms the link sent to that e-mail address. A hidden check field is used in forms to filter out automated (bot) submissions. The newsletter form is limited so as to prevent confirmation e-mails from being sent to the same address repeatedly within a short period.
• Access to personal data is restricted to people who need it for their work and to the lowest level of authorisation necessary.
• Development and test environments are logically separated from the live environment; test records are kept separate from real records.
• Service access keys and passwords are kept confidential and are not included in the source code.
• The website runs on the hosting service provider's infrastructure, which provides protection against network-level attacks.
• Security and privacy practices are taken into account when selecting service providers; security requirements are observed in developing and maintaining the software.
• Security incidents are detected and recorded, and the necessary measures are taken to prevent them from recurring.

If processed personal data is obtained by others by unlawful means, SCL will notify the data subjects and the Personal Data Protection Board of this as soon as possible, in accordance with Article 12 of the KVKK.

Retention periods

We keep your personal data for as long as necessary for the purpose for which it is processed and for the retention periods laid down in the relevant legislation. At the end of these periods, the data is erased, destroyed or anonymised in accordance with Article 7 of the KVKK and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data (Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hale Getirilmesi Hakkında Yönetmelik). Where data is kept for more than one purpose, the longest period applies.

Cookies

A cookie is a small text file that a website you visit, or a service running on that website, places in your browser. The current position on our website is as follows:

• SCL's own cookies: SCL does not place any cookies of its own on the public pages of the synthetic-consumers.com website and does not use your browser's local storage (such as localStorage and sessionStorage). When you sign in to the platform, strictly necessary cookies or similar technologies may be used solely to keep your session open and your account secure; they are not used for analytics or advertising.
• Cloudflare security cookies: When Cloudflare, which hosts the website, detects unusual traffic or a security threat, it may place its own strictly necessary cookies (for example __cf_bm) under this domain, solely for security purposes and for a short time.
• Analytics and advertising cookies: The website does not currently use any cookies or tracking tools for analytics or advertising purposes. If we wish to use such a tool in the future, it will not be activated without your explicit consent; you will be given the option to refuse consent and to withdraw consent you have given, and this policy will be updated in advance.
• Google Fonts: Google does not place cookies when the fonts are loaded; however, your IP address and browser information are passed to Google.
• Plotly: The charting library used for the interactive charts on study pages is loaded from Plotly's servers (cdn.plot.ly); in the process, your IP address and browser information are passed to Plotly.
• Google Calendar booking page: The booking page that opens after you submit the early access form is provided by Google and displayed in a frame (iframe) on our page. When it loads, Google may place its own cookies (for example NID) under the google.com domain; their purpose and duration are set by Google and governed by Google's policy. If you prefer not to use the booking page, you can send your meeting request by e-mail to [email protected].

The LinkedIn and YouTube links on the website are links only; content from these platforms is not embedded in our pages. When you click these links, the relevant platform's own policy applies.

You can delete or block cookies in your browser settings.

Children's personal data

SCL's website and platform are intended for adult users and businesses; they are not designed for persons under the age of 18. If you are under 18, please do not send us personal data through the forms or the platform. If we learn that we are processing personal data relating to a person under 18, we will delete that data, subject to statutory retention obligations.

Changes to this policy

We update this policy, and the privacy notice it contains, when our personal data processing activities, our service providers or the legislation change. The current text is always published on this page, and the "Last updated" date at the top of the page changes. Before processing your personal data for a new purpose not stated in this text, we will inform you separately about that purpose; if the new processing requires your explicit consent, we will ask for your consent separately.

Version of this text: Version 1.0, 7 October 2026.

Contact

If you have any questions about this policy or your personal data, you can contact us as follows:

• E-mail: [email protected]
• Telephone: 0212 351 54 65
• Address: SCL Teknoloji Araştırma ve Danışmanlık A.Ş., Akat Mah. Hare Sk. 2. Söltaş Evleri K-8 Blok No: 16 Beşiktaş/İstanbul

You can submit applications under Article 11 of the KVKK through the channels set out in the KVKK Privacy Notice section.