Privacy and Personal Data Protection Policy

Last Updated: 13 October 2026
Data Controller: Paylisher Teknoloji Anonim Şirketi

1. Purpose and Scope

Paylisher Teknoloji Anonim Şirketi ("Paylisher", the "Company" or "we") attaches importance to the confidentiality of personal data, to information security and to processing personal data in accordance with the applicable legislation.

This Privacy and Personal Data Protection Policy (the "Policy") explains for which purposes, by which methods and on which legal grounds personal data may be processed within the scope of the digital analytics, user engagement, advertising measurement, campaign management and AI-supported technology services offered by Paylisher.

This Policy covers the following activities and services:

  • Paylisher's corporate website and communication channels.
  • The Paylisher platform and management panels.
  • Mobile application and website analytics.
  • Paylisher SDK and API integrations.
  • User behavior, session and screen analyses.
  • Advertising measurement and attribution services.
  • Deep links, short links, QR codes and campaign links.
  • User segmentation and behavioral analysis.
  • Push notifications, in-app messaging and other user engagement tools.
  • AI-supported analysis, prediction and reporting features.
  • On-premise, private infrastructure and other contractual deployment models.
  • Corporate customer relations, technical support and commercial communication processes.

Paylisher's principle is to process personal data only for specified, explicit and legitimate purposes, in a manner that is relevant, limited and proportionate to the purpose.

In personal data processing activities, the applicable legislation is taken into account, in particular Law No. 6698 on the Protection of Personal Data ("KVKK").

2. Paylisher's Roles as Data Controller and Data Processor

Paylisher's legal role in personal data processing activities may vary depending on the nature of the service offered and on who determines the purposes and means of the relevant processing activity.

2.1. Paylisher as Data Controller

Paylisher acts as data controller where it determines the purposes and essential means of processing personal data relating to its own activities.

Examples of these activities include the following:

  • Contact and demo requests submitted through the Paylisher website.
  • Contact details of corporate customers and business partners.
  • Sales, contract and customer relationship processes.
  • Management of corporate user accounts on the Paylisher platform.
  • Information security, authorization and the keeping of access records.
  • Handling of support requests and service operations.
  • Fulfilment of legal obligations.
  • Marketing and commercial communication activities, where the necessary legal conditions are met.

In these activities, Paylisher fulfils its obligations as data controller towards data subjects under the KVKK.

2.2. Paylisher as Data Processor

In the technology services it provides to banks, financial institutions, insurance companies, e-commerce businesses and other corporate customers, Paylisher may operate as data processor in line with the customer's instructions.

In this context, the operations carried out through Paylisher technologies may include the following:

  • Measurement of mobile application and website usage.
  • Analysis of user journeys and conversion processes.
  • Evaluation of campaign performance.
  • Creation of user groups.
  • Management of notifications and campaigns.
  • Attribution of advertising sources and conversions.
  • Technical error, performance and application usage analyses.

In such activities, the relevant corporate customer may be the data controller that determines the purposes and legal grounds of the processing.

Where it operates as data processor, Paylisher processes personal data within the framework of the contracts concluded with the relevant customer, the data processing instructions and the applicable legislation.

If you are an end user of a bank, financial institution or other business that uses Paylisher technology, you may first need to refer to that organization's privacy policy and KVKK privacy notice for detailed information on the processing of your personal data.

3. Categories of Personal Data That May Be Processed

The categories of data processed by Paylisher, or that can be processed through Paylisher technologies, may vary according to the modules used, the integrations, the customer's configuration and the purposes of processing.

3.1. Identity and Contact Data

The following data may be processed where necessary for the relevant service:

  • First and last name.
  • Corporate e-mail address.
  • Telephone number.
  • Company and job title information.
  • Corporate account and user information.
  • Information shared in contact or support requests.

The identity information of end users is not required in every case for Paylisher's analytics services to function.

3.2. Device and Technical Data

Depending on the technology used and the relevant permissions, the following data may be processed:

  • Device type and model.
  • Operating system and version.
  • Application version.
  • Browser type and version.
  • IP address.
  • Device and application session identifiers.
  • Technical identifiers generated by the SDK.
  • Application performance and error logs.
  • Technical information on the network connection.
  • Date and time information of the events.

Advertising identifiers or similar tracking technologies may only be used under the conditions permitted by the relevant legislation and operating system policies.

3.3. Usage and Behavioral Analytics Data

Within the scope of Paylisher's analytics features, the following data may be processed depending on the functions enabled by the customer:

  • Application and website visits.
  • Pages and screens viewed.
  • Transitions between pages and screens.
  • Clicks and user interactions.
  • Session start and end information.
  • In-app events and transaction steps.
  • User journeys.
  • Conversion and abandonment events.
  • Campaign interactions.
  • Frequency of use and session durations.
  • Technical performance and application error data.

This data may be processed for the purposes of improving the product experience, measuring the performance of digital channels and analyzing user behavior.

3.4. Advertising and Campaign Data

Within the scope of advertising measurement, attribution and campaign analytics services, the following data may be processed:

  • Advertising and campaign identifiers.
  • Advertising source and referral channel.
  • Ad click and redirection events.
  • Technical information on campaign links.
  • Deep link and QR code interactions.
  • Application install and first open events.
  • In-app conversion events.
  • Measurement data on campaign performance.
  • Advertising and application events that can be associated under the relevant technical conditions.

Paylisher may help evaluate advertising and campaign performance by using events that can technically be associated. The accuracy and scope of the measurement depend on operating system restrictions, permissions, integration methods and the available data sources.

3.5. Location Data

Paylisher technologies may process location data within the scope of location-based features enabled by the customer.

This data may include information such as:

  • Approximate geographic location.
  • Device location based on user permission.
  • Geofence entry and exit events.

The processing of precise location data is subject to the relevant device permissions, the applicable legal conditions for processing and the responsibilities of the data controller.

3.6. Session Recordings and Screen Interactions

If the customer enables the session analysis or session replay features, certain interactions of users with the application or website may be technically recorded or reconstructed.

Within the scope of these features, the following may be processed:

  • Screen transitions.
  • Click and tap events.
  • Scrolling movements.
  • Interface interactions.
  • Session flows.

To support the protection of sensitive information, Paylisher may offer screen masking, data field hiding and similar technical controls.

To prevent passwords, financial account details, identity numbers and other sensitive data fields from being recorded inadvertently, the relevant fields must be masked appropriately and the integration must be configured securely.

Session recordings must not be used outside the purposes determined by the customer and the applicable legal conditions.

3.7. Data Transferred by the Customer

Corporate customers may transfer data from their own systems to Paylisher via API, SDK or other integration methods.

This data may include information such as:

  • User identifiers created by the customer.
  • Transaction and event information.
  • User segments.
  • Campaign interactions.
  • Custom events transferred from customer systems.

Where Paylisher operates as data processor, the scope in which this data is processed is determined by the relevant customer's instructions and the contracts between the parties.

4. Anonymization and Pseudonymization

In line with the principles of data minimization and the protection of privacy, Paylisher supports the use of technical user and session identifiers instead of direct identity information where this is possible and appropriate for the purposes of processing.

The methods used for this purpose may include the following:

  • Randomly generated session identifiers.
  • In-app user identifiers.
  • Data masking.
  • Pseudonymization.
  • Aggregated reporting.
  • Anonymization.

However, even where a person's name or surname is not directly present, data through which a specific device or user can be indirectly identified may retain its nature as personal data.

For this reason, pseudonymized data is not regarded as anonymous data.

Anonymized data, on the other hand, is accepted as anonymous data only when it has been anonymized in such a way that the data subject cannot be re-identified by reasonable and practicable methods.

5. Purposes of Processing Personal Data

Personal data may be processed for the following purposes, limited to the relevant service and legal conditions:

5.1. Provision of Services

  • Operating the Paylisher platform.
  • Running SDK and API integrations.
  • Managing user accounts and access.
  • Providing technical services to corporate customers.
  • Ensuring system performance and service continuity.

5.2. Analysis and Reporting

  • Evaluating mobile and web usage.
  • Analyzing user journeys.
  • Measuring conversion and engagement performance.
  • Evaluating the usage experience of digital products.
  • Producing reports and analyses.

5.3. Advertising Measurement

  • Evaluating campaign performance.
  • Attributing conversions to advertising sources.
  • Measuring deep link and redirection performance.
  • Analyzing invalid or suspicious interactions originating from advertising.
  • Reporting campaign results.

5.4. User Engagement and Campaign Management

Within the scope of the purposes determined by the customer and the applicable legal conditions:

  • Creating user groups.
  • Managing in-app notifications.
  • Running push notification campaigns.
  • Measuring user interactions.
  • Analyzing campaign results.

5.5. Information Security and Technical Operations

  • Preventing unauthorized access.
  • Identifying suspicious activities.
  • Diagnosing errors.
  • Ensuring system security and service continuity.
  • Investigating security incidents.
  • Keeping access and transaction records.

5.6. Commercial and Legal Activities

  • Responding to customer requests.
  • Concluding and performing contracts.
  • Managing technical support and customer relations.
  • Fulfilling obligations arising from legislation.
  • Establishing, exercising and protecting rights.

6. AI-Supported Data Processing

Paylisher may make use of artificial intelligence and machine learning technologies in certain features it offers.

Depending on the features enabled by the customer, these technologies may be used for the following purposes:

  • Analyzing user behavior.
  • Identifying groups with similar usage characteristics.
  • Evaluating user interactions.
  • Predicting usage trends.
  • Analyzing the risk of user churn.
  • Evaluating campaign performance.
  • Interpreting and reporting analytical results.

In AI-supported processing activities, the principles of data minimization, access control and purpose limitation are applied.

The processing of customer data by artificial intelligence systems depends on the technical architecture of the relevant service, the customer's configuration, the contractual terms and the applicable legal grounds.

Paylisher does not have a general authority to use its customers' data for its own independent purposes.

The use of customer data for general-purpose model training, its transfer to third-party artificial intelligence services or its use in Paylisher's independent product development activities cannot be carried out automatically on the basis of the general service permission under this Policy. For such activities, an appropriate legal ground and the necessary contractual arrangements must additionally exist.

7. Methods of Collecting Personal Data

Depending on the nature of the services offered, personal data may be collected by automated or partly automated means and, in the cases provided for by law, by non-automated means.

Data collection channels may include the following:

  • The corporate website and contact forms.
  • Mobile and web SDK integrations.
  • API and server-side integrations.
  • Deep link, short link and QR code systems.
  • Corporate customer management panels.
  • Cookies and similar technologies.
  • E-mail and support channels.
  • Contracts and other corporate communication processes.

Data may be obtained directly from the data subject or, under lawful conditions, from the relevant corporate customers and integration sources.

8. Legal Grounds for Processing Personal Data

The personal data processing activities carried out by Paylisher as data controller may be based on one or more of the conditions set out in Article 5 of the KVKK that are appropriate to the specific processing activity.

These conditions are:

  • The existence of the data subject's explicit consent.
  • Processing of personal data belonging to the parties to a contract being necessary, provided that it is directly related to the conclusion or performance of that contract.
  • Processing being mandatory for the data controller to fulfil its legal obligation.
  • Processing being mandatory for the establishment, exercise or protection of a right.
  • Processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
  • Other processing conditions expressly provided for by law.

Personal data processing activities are not all based on a single legal ground. Each activity is assessed separately, taking its purpose and nature into account.

Where explicit consent is required, the data subject's consent must be obtained freely, in relation to a specific matter and on an informed basis.

In operations where corporate customers are the data controller, determining the appropriate legal ground and informing the data subjects are among the responsibilities of the relevant data controller.

Where special categories of personal data are processed, the special conditions set out in Article 6 of the KVKK and the necessary additional security measures are applied.

9. On-Premise Deployment and Data Hosting

Paylisher may offer corporate customers different technical deployment and hosting models.

These may include:

  • On-premise deployment in the customer's own data center or servers.
  • Private infrastructure managed by the customer.
  • Other hosting and operating models determined by contract.

9.1. On-Premise Deployments

In on-premise deployments, the data processed in the relevant customer environment may be hosted on the infrastructure determined by the customer.

In this model, the responsibilities for data storage, access authorization, network security, backup and system management are determined according to the relevant contract and the technical allocation of responsibilities.

The use of an on-premise deployment does not mean that personal data will under no circumstances leave the customer's infrastructure or that Paylisher will not access any data.

Where technical support, updates, monitoring, integration or any other data transfer is involved, the scope of these operations is assessed separately.

9.2. Data Segregation and Access Rights

Paylisher adopts the principle that access to customer data is limited to the authorized persons and systems necessary for the provision of the relevant service.

The segregation of customer environments and data access is supported by technical and administrative measures appropriate to the deployment model used.

10. Sharing of Personal Data

Paylisher may transfer personal data to third parties only where necessary for the relevant processing purpose, within the framework of the appropriate legal conditions and security measures.

These recipient groups may include the following:

  • Authorized infrastructure and technology service providers.
  • Sub-processors determined by contract.
  • Technical support and security service providers.
  • Legal, audit and consultancy service providers.
  • Public institutions and competent authorities within the scope of their legal powers.
  • Integration parties authorized by the relevant corporate customer.

Transfers are carried out within the framework of the applicable legislation, confidentiality obligations, the necessary data processing agreements and appropriate technical measures.

Paylisher does not accept selling or renting the customer data it accesses as data processor for independent advertising or data trading purposes as part of its service model.

11. Transfer of Personal Data Abroad

Article 9 of the KVKK and the relevant secondary regulations apply to the personal data transfers carried out by Paylisher.

Where a transfer of personal data abroad is necessary, the legal conditions of the relevant transfer are assessed separately.

To the extent applicable, transfers may be carried out within the framework of:

  • An adequacy decision.
  • Appropriate safeguards.
  • The exceptional transfer cases provided for in the legislation.

Appropriate safeguard methods may include the standard contracts provided for in the legislation and other legal mechanisms.

The fact that a service is hosted on servers in Türkiye does not, in itself, mean that no transfer of data abroad takes place. Operations such as access from abroad, remote support or the use of third-party technologies are also assessed separately.

Information and explanations on the transfer of data abroad are detailed in privacy notices or contractual documents, depending on the nature of the relevant processing activity.

12. Retention and Disposal of Personal Data

Paylisher retains the personal data it processes as data controller for the period necessary for the purpose of processing, or limited to the periods provided for in the applicable legislation.

The following factors are taken into account in determining the retention period:

  • The purpose of processing.
  • The nature of the data.
  • The relevant statutory retention obligations.
  • Contractual obligations.
  • The requirements of legal disputes and the protection of rights.
  • Technical security and operational needs.

In activities carried out as data processor on behalf of a customer, data retention periods may be determined by the data controller's instructions and the relevant contracts.

When the retention period expires or the conditions for processing cease to exist, personal data is erased, destroyed or anonymized in accordance with the applicable legislation.

The disposal of data held in backups and security logs is carried out in line with the technical characteristics of the relevant systems and the retention and disposal processes applied.

13. Personal Data Security

Paylisher's principle is to apply technical and administrative measures appropriate to the risks in order to prevent the unlawful processing of, and unauthorized access to, the personal data processed, and to ensure the protection of the data.

Depending on the infrastructure used and the contractual responsibilities, these measures may include the following:

  • Role-based access authorization.
  • Authentication and account security.
  • Encryption during data transmission.
  • Encrypted storage of data in appropriate systems.
  • Keeping access and security logs.
  • Data masking and data minimization.
  • Segregation of customer environments in terms of access.
  • Security updates and vulnerability management.
  • Monitoring of unauthorized access.
  • Backup and business continuity measures.
  • Staff confidentiality obligations.
  • Security incident response processes.

The measures to be applied are determined according to the technical architecture of the relevant system and the risk assessment.

Taking into account that the absolute security of no electronic system can be guaranteed, the aim is to reduce security risks and to make the necessary improvements.

14. Cookies and Similar Tracking Technologies

On the Paylisher website and related digital services, cookies and similar technologies may be used depending on the features in use.

These technologies may be used for the following purposes:

  • Providing the basic functions of the website.
  • Session and security management.
  • Remembering user preferences.
  • Measuring site performance.
  • Analyzing visitor interactions.
  • Marketing activities, where the legal conditions are met.

For cookies other than strictly necessary cookies, explicit consent may need to be obtained depending on the nature of the relevant processing activity.

Cookies that require explicit consent must not be activated before valid consent has been obtained.

Detailed information on cookie types, providers, purposes of use, retention periods and preference management is provided in the separately published Cookie Policy.

Where Paylisher technologies are used in third-party customer applications, the responsibilities for providing information and managing permissions in relation to the relevant cookies and SDK-based tracking operations are assessed according to the allocation of roles between the data controller and the data processor.

15. User Preferences and Marketing Communications

Paylisher may send commercial electronic messages to data subjects about its own products and services.

These messages may carry content such as:

  • Product and service announcements.
  • Event and webinar invitations.
  • Corporate newsletters.
  • Campaign and promotional messages.
  • Satisfaction surveys.

Commercial electronic messages are sent within the framework of the consent, exception and opt-out rules provided for in the applicable legislation.

Where necessary, consent for commercial electronic messages is obtained separately and the relevant records are managed in accordance with the legislation.

Data subjects may change their commercial message preferences by using the opt-out mechanisms provided to them or the rights available through the Message Management System (İYS).

Withdrawal of consent for commercial electronic messages does not automatically end mandatory data processing activities that are based on another legal ground.

16. Automated Analysis and Profiling

Within the scope of the features enabled by the customer, Paylisher technologies may support segmentation, behavioral prediction and automated analysis based on user interactions.

Within the scope of these operations:

  • Users may be grouped according to similar usage characteristics.
  • Conversion and engagement trends may be analyzed.
  • Predictions may be generated about user experience and campaign performance.
  • Certain behavior patterns may be reported.

The scope and legal basis of these activities and the obligation to inform data subjects are assessed according to the specific processing activity and the purposes determined by the data controller.

Under the KVKK, data subjects have the right to object to analyses carried out exclusively by automated systems that lead to a result against them.

17. Special Categories of Personal Data

Paylisher's general analytics services do not have to be designed in a way that requires the collection of special categories of personal data.

However, the processing of special categories of personal data may arise within the scope of integrations carried out by the customer or special use cases.

Such operations may only be carried out if the appropriate processing conditions under Article 6 of the KVKK and adequate security measures are in place.

Customers must configure their integrations so as to prevent unnecessary sensitive information from being transferred through SDK events and custom data fields.

18. Rights of the Data Subject

Under Article 11 of the KVKK (Law No. 6698), data subjects have the following rights, subject to the statutory conditions and exceptions:

  1. To learn whether their personal data is processed.
  2. To request information if their personal data has been processed.
  3. To learn the purpose of the processing of personal data and whether it is used in accordance with that purpose.
  4. To know the third parties to whom personal data is transferred, in Türkiye or abroad.
  5. To request the rectification of personal data if it has been processed incompletely or inaccurately.
  6. To request the erasure or destruction of personal data within the framework of the conditions provided for in Article 7 of the KVKK.
  7. To request that rectification, erasure or destruction operations be notified to the third parties to whom the personal data has been transferred.
  8. To object to a result arising against the person through the analysis of the processed data exclusively by automated systems.
  9. To claim compensation for damage suffered due to the unlawful processing of personal data.

How to Apply

Applications concerning the processing activities for which Paylisher is the data controller may be made within the scope of Article 13 of the KVKK and the relevant application procedures.

Applications may be made in writing in accordance with the legislation or by other methods determined by the Personal Data Protection Board.

Paylisher, in its capacity as data controller, concludes duly made applications addressed to it as soon as possible, depending on the nature of the request, and within thirty days at the latest.

Where Paylisher operates in the capacity of data processor, applications may need to be directed to the relevant data controller. Paylisher provides the necessary support to the relevant data controller within the framework of its contractual and legal obligations.

19. Data Security Incidents

Paylisher's principle is to establish the organizational and technical arrangements necessary for detecting and assessing incidents that may affect the security of personal data and for carrying out the appropriate response processes.

In the event of a personal data breach, the necessary investigations are carried out and the relevant notification obligations are fulfilled in accordance with the applicable legislation.

Where Paylisher is the data processor, the notification and cooperation processes determined in the contract are applied so that the relevant data controller can fulfil its obligations.

20. Third-Party Services and Links

The Paylisher website or services may contain links to third-party websites, applications, advertising networks or external services.

The independent personal data processing activities carried out by these third parties are subject to those parties' own privacy policies and legal obligations.

The data processing activities of the third-party service providers used by Paylisher, on the other hand, are assessed within the framework of Paylisher's legal role, the relevant contracts and the applicable legislation.

21. Children's Personal Data

Paylisher services are essentially technology infrastructures intended for corporate customers.

Paylisher's own website and corporate account services are not directly aimed at children.

Where Paylisher technologies are used in corporate customers' services aimed at children, personal data processing activities are assessed separately according to the nature of the specific service, the relevant legislation and the legal conditions determined by the data controller.

22. Updates to the Policy

Paylisher may update this Policy in line with technological developments, changes in the scope of services or legal obligations.

The updated text is published on the Paylisher website together with its effective date or date of last update.

For changes that additionally require notification or explicit consent under the relevant legislation, the necessary processes are carried out.

23. Contact

For requests relating to this Policy or the protection of personal data, you can contact Paylisher using the contact details at the bottom of the page.

Requests relating to the protection of personal data and information security are assessed within the scope of the applicable legislation and the relevant application procedures.

24. Google User Data (Required for OAuth Verification)

When you connect your Google Account or Google Ads account to Paylisher, our Services may access certain Google user data only after your explicit authorization through Google OAuth. We do not access or store Google user data without your consent.

24.1 Types of Google User Data We Access

With your authorization, Paylisher may access the following Google Ads data:

  • Google Ads Account Information: Customer ID, account name, time zone, currency
  • Advertising Configuration Data: Campaigns, ad groups, ads, keywords, budgets, targeting settings
  • Performance & Reporting Data: Impressions, clicks, cost, conversions, revenues, ROI, CTR, CPA, CPI, ROAS

We DO NOT access:

  • Gmail content
  • Google Drive files
  • Calendar, Contacts or any unrelated Workspace data
  • Sensitive personal data not required for advertising analytics

24.2 How We Use Google User Data

Google user data is used exclusively for:

  • Displaying Google Ads performance dashboards inside Paylisher
  • Campaign comparison, optimization, and analytics
  • Attribution modeling and conversion insights
  • Helping users monitor and improve ad efficiency

We do not sell, rent, or reuse Google user data for any marketing or unrelated purposes.

24.3 Sharing of Google Data

Google user data may only be shared with:

  • Secure infrastructure and hosting providers (acting as data processors)
  • Authorities if required by applicable law

We never share Google user data with third parties for independent use.

24.4 Storage & Retention

Google user data is stored securely using encrypted infrastructure. Data is retained only as long as necessary to provide our services or comply with legal obligations. Users may request data deletion at any time.

24.5 User Control & Revocation

You may revoke Paylisher’s access to your Google account at any time through:

https://myaccount.google.com/permissions

Upon revocation, we immediately stop receiving new Google data, and you may also request deletion of previously stored data via [email protected].

24.6 Google API Compliance

Our use of Google user data complies with:

25. Meta Platform Data

Our Services may collect or process limited data through Meta Marketing APIs. All usage complies with Meta Platform Terms & Developer Policies. Only data permitted by you is accessed.