Effective date: [EFFECTIVE DATE]
This policy covers two things that are easy to confuse: the data we handle about our own visitors and customers, and the data we handle on behalf of a customer about the people who visit their website. Our obligations are not the same in both cases, so they are set out separately below.
SpendEvidence™ is a service operated by DİGİENSEO DİJİTAL PAZARLAMA DANIŞMANLIK LİMİTED ŞİRKETİ, a limited liability company established in Türkiye (MERSİS 0295122228600001), registered office Bahçelievler Mah. Prof. Dr. Necmettin Erbakan Cad. Elit İş Merkezi No: 3 İç Kapı No: 210, 54050 Serdivan / Sakarya, Türkiye. “We”, “us” and “our” refer to that company. You can reach us at privacy@spendevidence.com.
We do not see most of your visitors. Verification only runs on a request that arrives carrying a Google Ads click identifier (gclid or gad_source). A request without one is passed straight through — not inspected, not scored, not recorded. Organic search, direct visits, referrals and every other source never enter our systems at all.
For an advertising click that does reach us, we process:
What we do not collect. No name, email address, postal address or telephone number. Nothing typed into a form. No page content and no browsing history. We do not build a profile that follows a person across sites, and we do not combine this data with anything obtained from a third party.
The 90 days is not an arbitrary figure. Google allows an advertiser to request an invalid traffic investigation into the past 60 days of traffic. A record kept for exactly 60 days would leave no margin: a customer who noticed a problem on day 59 would find the earliest days already gone. The extra 30 days close that gap. The record exists so that a customer can answer what such an investigation asks, and it is kept for that window and no longer.
Deletion is automatic. Every record is written with an expiry attached to it and is removed by the storage layer when that expiry passes — it does not depend on anyone remembering to run a clean-up.
When a visitor is asked to complete a challenge, passing it sets a short cookie on the customer’s own domain, so the same visitor is not challenged again on every page. It lasts 6 hours and is marked HttpOnly, Secure andSameSite=Lax.
The cookie holds an expiry time and a keyed hash of that time together with the visitor’s IP address. There is no account identifier, no name and no profile in it; it cannot be read by JavaScript on the page, and it is neither readable nor usable on any other website.
If you run a site that uses SpendEvidence: because this cookie is set on your domain, it belongs in your own cookie notice. We supply the wording during installation.
This section describes a service that is not running as at the effective date above. It is published in advance so that customers and visitors are not asked to accept a change later.
Some customers cannot or do not wish to route their domain through our network. For those, an advertising click will pass through a tracking address on a domain we operate before continuing to the customer’s site. Where that happens we would record the same categories listed above, together with the click parameters Google supplies on the tracking URL.
The visitor is always forwarded to the destination given in the redirection parameter of the tracking URL. We do not hold a click back and we do not send a visitor anywhere else. In this arrangement we can observe and document a click; we cannot prevent it.
Acting as controller, we collect:
Why, and on what basis. To answer an enquiry and to prepare or perform a contract with you; for our legitimate interest in running, measuring and securing our own website; and to meet the invoicing, accounting and tax obligations that apply to us.
How long. Enquiries that do not become customers are kept for 24 months from our last contact with you. Customer records are kept for the life of the contract and afterwards for the period required by Turkish tax and commercial legislation. Website analytics follow the retention configured in the analytics tool.
The current list of sub-processors, and how customers are told when it changes, is in the Data Processing Agreement.
We do not sell personal data. We also do not use our customers’ visitor data for our own marketing — no remarketing audiences, no lookalike audiences, no list uploads. Marketing audiences are built only from visitors to this website and from people who have contacted us directly.
On Cloudflare’s global network. We deliberately do not promise a storage region: Cloudflare does not publish a storage location for the key-value store this service uses, and we will not make a claim we cannot verify. We are established in Türkiye and our personnel access the data from Türkiye.
There is no European Commission adequacy decision covering Türkiye. Transfers of personal data from the European Economic Area and the United Kingdom to us are therefore made under Standard Contractual Clauses, which form part of our Data Processing Agreementand are accepted by a customer when they accept that agreement. A copy is available on request.
We may produce aggregated and anonymised information from the traffic we examine — for example the patterns and network characteristics that separate automated traffic from genuine visitors. This information does not identify anyone and cannot be traced back to an individual visitor or to a customer. We are the controller of it, and we use it to operate, evaluate and improve the service.
As at the effective date above, each customer’s protection runs in isolation and no data derived from one customer’s traffic is applied to another’s. This section states the basis on which that may change; if it does, it will be described here before it happens.
Depending on where you are, you may have the right to ask for a copy of your personal data, to have it corrected or erased, to object to or restrict how it is used, to receive it in a portable form, and to withdraw a consent you have given. These rights come from the GDPR (Articles 15–22) and, in Türkiye, from Article 11 of the KVKK.
If you visited a website protected by SpendEvidence, the operator of that website is the controller. Send your request to them. They will pass it to us and we will help them answer within the time the law allows.
One practical limit, stated plainly. For visitor data we hold no name, account or contact detail — there is nothing in the record that tells us who a person is. To locate a record at all we need the IP address and the approximate time of the visit. If you cannot supply those, we are not able to identify you in our systems, and the law does not require us to collect additional data solely in order to do so.
For data we hold as controller — your enquiry, account or billing record — write to privacy@spendevidence.com and we will answer directly.
You can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu). If you are in the European Economic Area or the United Kingdom, you can also complain to the supervisory authority where you live or work. [EU ARTICLE 27 REPRESENTATIVE — TO BE CONFIRMED]
This website loads Google Tag Manager and the analytics configured through it, which set cookies to measure how the site is used. These are separate from the verification cookie described earlier, which is set on a customer’s domain and not on this one.
Traffic is encrypted in transit. Credentials are held as secrets in the runtime environment and are never written into a record. The verification cookie is protected by a keyed hash rather than a readable value. Access to stored data is limited to the people who need it to run the service.
The service is sold to businesses and is not directed at children. We do not knowingly collect data from a child.
We will post any change here and update the effective date. Where a change affects processing carried out on behalf of a customer, we notify the customer under the Data Processing Agreementrather than relying on this page alone.
DİGİENSEO DİJİTAL PAZARLAMA DANIŞMANLIK LİMİTED ŞİRKETİ
Bahçelievler Mah. Prof. Dr. Necmettin Erbakan Cad. Elit İş Merkezi No: 3 İç Kapı No: 210, 54050 Serdivan / Sakarya, Türkiye
Gümrükönü Tax Office, tax no. 2951222286
privacy@spendevidence.com