Personal Data Protection and Processing Notice
Last updated: 18 August 2026
1. Data Controller
Acting as data controller under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), Milagros Bilişim ve Dijital Pazarlama A.Ş. ("Oxalis" or the "Company") is committed to protecting the personal data of visitors to our website, prospective partners who contact us, and participants in our online meetings.
- Email: admin@oxaliscreative.com
- Web: oxaliscreative.com
2. Personal Data We Process and How We Collect It
2.1. Website form data
Through the contact and quote forms on our site we collect, based entirely on your own submission: full name, email address, phone number, company name, project summary and estimated budget range.
2.2. Cookie and site usage data
We use Google Analytics 4 and Meta Pixel/CAPI cookie technologies. These collect IP address, device and browser information, pages visited and on-site behaviour logs. Non-essential cookies run only with your consent, which you may change at any time.
2.3. Online meeting data
In online (video/audio) meetings with you we process: full name, email address, meeting date and duration, attendance record, and a written transcript of what you say during the meeting together with a summary generated from that transcript. Details of the AI-assisted notetaker we use are set out in section 4 below.
2.4. Commercial relationship data
For clients, we process identity, contact, tax and payment information in order to manage contracts and invoicing.
3. Purposes of Processing and Legal Grounds
| Purpose | Legal ground (KVKK art. 5) |
|---|---|
| Evaluating quote and project requests and contacting you | Directly related to the establishment or performance of a contract (art. 5/2-c) |
| Delivering the services you request (digital marketing, social media management, web development, creative production, AI integration) | Performance of a contract (art. 5/2-c) |
| Holding online meetings and keeping meeting notes | Legitimate interest (art. 5/2-f) |
| Transcribing and summarising the meeting using an AI assistant | Explicit consent (art. 5/1) |
| Processing of data by service providers located abroad | Explicit consent (art. 9) |
| Measuring marketing and advertising performance, improving site experience | Explicit consent (art. 5/1) |
| Invoicing, accounting and statutory retention | Expressly provided by law and legal obligation (art. 5/2-a, 5/2-ç) |
4. AI-Assisted Meeting Notetaker
In our online meetings we use an AI-assisted meeting notetaker (Sana AI — provider: Sana Labs AB, Sweden; part of the Workday group) so that we can understand the discussion accurately and reliably follow up on what we commit to.
What the assistant does
- Joins the meeting as a separate participant and is visible in the participant list.
- Transcribes the conversation in real time.
- Produces a short meeting summary and action list from the transcript.
What the assistant does not do
- It does not archive audio or video; no meeting recording is retained.
- Your data is not used to train AI models.
- It does not make automated decisions, scoring or profiling about you.
- Transcripts and summaries are not shared with or sold to third parties.
Your right to object
Use of the assistant is entirely optional and based on your explicit consent. You are informed and asked for consent at the start of every meeting. If you decline, or change your mind during the meeting, the assistant is switched off immediately and the meeting continues without any restriction. Your choice has no effect whatsoever on the service or offer we provide.
5. Recipients of Personal Data
| Recipient group | Purpose of transfer | Data transferred |
|---|---|---|
| Meeting assistant provider (Sana Labs AB and its sub-processors) | Transcription and summarisation | Meeting data (2.3) |
| Video conferencing provider | Holding the meeting | Name, email, connection data |
| Cloud hosting, email and infrastructure providers | Operating our website and business systems | Form and contact data |
| Analytics and advertising platforms (Google, Meta) | Measurement and ad performance | Cookie and usage data (2.2) |
| Accountants and legal advisors | Meeting statutory obligations | Commercial relationship data (2.4) |
| Authorised public authorities | Statutory information requests | Data within the scope of the request |
Oxalis never sells your personal data, never transfers it to data brokers, and does not disclose it to third parties for purposes other than those listed above.
6. International Transfers
The meeting assistant, video conferencing, cloud hosting and analytics services we use operate on servers located outside Türkiye. The data described in 2.2 and 2.3 is therefore transferred abroad so that those services can function.
According to our providers' public documentation, data may be processed on servers in Sweden, Ireland, Germany, France, Belgium, the United States and Japan, among others.
As the Turkish Personal Data Protection Board has issued no adequacy decision for these countries, these transfers are carried out on the basis of your explicit consent under article 9 of the KVKK. Your consent to the use of the meeting assistant therefore also covers the processing of that data abroad. If you do not give explicit consent, the assistant is not used.
You may withdraw your consent at any time. Withdrawal does not affect processing lawfully carried out before that point.
7. Retention Periods
| Data | Retention period |
|---|---|
| Meeting audio and video | Not retained |
| Meeting transcript and summary | Maximum 30 days from the meeting, then deleted |
| Form and quote request data | 2 years from resolution of the request |
| Commercial and invoicing data | Statutory period under applicable legislation (10 years) |
| Cookie and analytics data | Per the relevant platform's retention policy and cookie lifetime |
Once these periods expire, data is deleted, destroyed or anonymised.
8. Data Security
To prevent unlawful processing of and access to your personal data and to ensure its safekeeping, we apply appropriate technical and administrative measures, including access authorisation, encryption in transit and at rest, data processing agreements with our providers, and periodic access reviews.
9. Your Rights (KVKK art. 11)
As a data subject you may apply to Oxalis to:
- Learn whether your personal data is being processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used in line with that purpose,
- Know the third parties to whom it is transferred domestically or abroad,
- Request correction if it is incomplete or inaccurate,
- Request erasure or destruction under the conditions set out in the law,
- Request that correction, erasure and destruction be notified to third parties to whom the data was transferred,
- Object to an adverse outcome arising from analysis carried out solely by automated systems,
- Claim compensation for damage suffered due to unlawful processing.
10. How to Apply
You may submit requests concerning your rights in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- From the email address already registered in our systems, or by secure electronic signature or mobile signature: admin@oxaliscreative.com
- By signed written petition sent to our registered office through a notary or by registered post; you may request our current service address at admin@oxaliscreative.com.
Your application is concluded free of charge as soon as possible and in any case within 30 days. Where the process incurs a cost, a fee set by the Board's tariff may be charged.
11. Changes to This Notice
This notice may be updated in line with changes to our services or to applicable legislation. The current version is always published on this page and the date at the top is updated accordingly.