Privacy Policy: English Summary for International Reviewers

Binding text. This is an English summary of our Turkish Personal Data Protection Notice (Kişisel Verilerin Korunması Hakkında Aydınlatma Metni, version 2.2) and our Turkish Cookie Policy (Çerez Politikası, version 1.3), prepared under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"). The Turkish texts (notice 2.2, Cookie Policy 1.3) are legally binding. If this summary and the Turkish texts conflict, the Turkish texts prevail. The Turkish texts are at www.adacetinsigorta.com/kvkk and www.adacetinsigorta.com/cerez-politikasi. This summary is published at www.adacetinsigorta.com/en/privacy-policy.

This notice is for information only. It does not ask you for consent. We ask for your permission for analytics and marketing cookies separately, in the cookie banner on our website.

Abdullah Çetin Ada Çetin Sigorta Aracılık Hizmetleri, a sole-proprietor insurance agency in Türkiye ("we", "us").

We are an insurance agency. We obtain quotes from several insurance companies for you, arrange your policy and help you during the policy term. The insurers we represent are Quick Sigorta, Hepiyi Sigorta and Doğa Sigorta.

Insurers process your data as separate data controllers when they issue the policy and handle claims. At the policy stage we also act as a data processor on the insurer's behalf; the insurer's own privacy notice then applies as well.

You can get insurance quotes from inside Claude with our connector. Today the connector is available only for Claude. If we make it available for ChatGPT, we will publish a new version of this notice.

Sign-in and permission page

• To start a quote you sign in with your Google account or your e-mail address. If you sign in with Google, Google sends us your name and e-mail address.
• After sign-in you see a permission screen: "Claude wants to access your Ada Çetin Sigorta Aracılık Hizmetleri account". This is an access permission that lets Claude request quotes on your behalf. It is not consent under KVKK. We record which version of the screen text you approved. You can remove the permission at any time in your Claude settings.
• Sign-in uses one strictly necessary cookie (see §9).

The connector (quotes)

• The connector asks for the data needed for a quote: national ID number or tax number, date of birth, and vehicle or home details.
• If you type these into the connector's form, they come directly to us; Claude does not see them. If you type them into the chat, Claude also sees them and they are processed under Anthropic's terms.
• Our responses to Claude do not contain your national ID number, date of birth, full name, address, phone number or e-mail address. They contain only a masked summary, the insurer's name and the premium.
• We do not use the data we receive through the connector to train artificial intelligence models. How the assistant provider (Anthropic) uses your chat and uploads depends on its own terms (see "What Anthropic does with your data" below).
• If you upload a photo of your vehicle registration to the chat, Claude processes the photo. The vehicle details Claude reads are transferred to the quote form with your confirmation. We do not receive or store the photo itself.
• The first response for each quote shows a link to this notice. We record that the link was shown; we do not ask for your approval.

Payment page

• When you choose a quote, we give you a link to our own payment page. Payment does not happen inside Claude.
• Your card details are encrypted in your browser with the insurer's key and go to the insurer in encrypted form. We cannot see the card in clear text and we do not store it. Your bank performs 3D Secure verification.
• We record the payment result (successful or failed, amount, instalments). To show the payment result in the same tab, the page keeps a temporary token in the browser tab; it is deleted when the tab is closed.

What Anthropic does with your data. You run our connector from your own Claude account. Our responses reach you through the assistant you use. Anthropic (USA), the provider of the assistant, processes this data under its own privacy terms. We do not consider this a transfer made by us. We send the assistant only a masked summary, not personal data.

Our quote page (teklif.adacetinsigorta.com)

You can also get quotes on our own quote page, without an AI assistant. The page runs on our own server at our office in Türkiye (§6). Its traffic comes through Cloudflare (§6).

• Quote: you do not need to sign in to get a quote. We use one strictly necessary cookie that links your quote to this browser (see §9). The form asks for the data needed for a quote: national ID number or tax number, date of birth, and vehicle or home details. The details you enter come directly to us; they do not go to an AI assistant. No analytics or advertising scripts run on this page; Google Analytics and Meta Pixel are not loaded here. Each quote shows a link to this notice; we record that the link was shown and we do not ask for your approval.
• Payment: when you choose a quote, you go to our payment page in the same tab. Payment works as described above: your card details are encrypted in your browser; we cannot see or store your card.

Recipients and retention periods are the same as for the connector (§5, §6, §8).

In each channel we ask only for the part of this list that the task needs.

We do not ask for health data and do not record it in our systems. For supplementary health insurance, the insurer collects health information in its own system; the insurer's notice applies to that process.

We do not ask for your consent for quotes or policies. We ask for your permission for analytics and marketing measurement on our website separately, in the cookie banner (§9). We do not send marketing messages; if we do in the future, we will send them only if you give separate, optional permission. We ourselves do not carry out profiling. The insurer sets the quote price; we do not make automated decisions about you. We do not sell personal data. We do not use your data to train artificial intelligence models; the AI assistant provider's own terms are separate (§2).

For quotes and policies, insurers query sources such as the Insurance Information and Monitoring Centre (SBM), TRAMER and the Identity Sharing System under their own obligations. The insurer is the data controller for those queries.

Our quote, customer and sign-in systems run on our own server at our office in Türkiye. Our website runs on a server in Germany. There are no forms on our website (www.adacetinsigorta.com) that ask for personal data. The quote form is in the connector and on our separate quote page (teklif.adacetinsigorta.com; §2). If you give permission on our website, Google Analytics and Meta Pixel data goes to recipients abroad (table below).

The following recipients process your data abroad:

Cloudflare, Hostinger and Google (e-mail) process your data on our behalf. We do not give Umami data to third parties. Analytics and marketing data goes to Google and Meta only if you gave the relevant permission on our website. Meta may also use this data for its own purposes under its own terms (for example, ad delivery and measurement). That use is Meta's responsibility and is subject to Meta's privacy policy.

Two further cases are not transfers made by us, but we list them for your information:

• AI assistant (Claude): see §2, "What Anthropic does with your data".
• WhatsApp: if you write to us on WhatsApp, your message passes through WhatsApp's (Meta) infrastructure. Message content is end-to-end encrypted. Your use of WhatsApp is subject to WhatsApp's own terms.

• From you: in person at our office, by phone, WhatsApp and e-mail (non-automated); on the connector, the quote page, the sign-in and permission page and the payment page (automated).
• From insurers' systems: identity verification result, quote and policy details (automated).
• From your Google account: if you sign in with Google, Google sends us your name and e-mail address.
• From your device in online channels: IP address, browser information, strictly necessary cookies and browser storage; on our website, only with your permission, analytics and marketing cookies (automated; §9).
• When someone requests a quote for another person (e.g. a family member's vehicle): from the person making the request. We ask that person to inform the other person about this notice.

We keep your data for as long as the purpose requires and the law prescribes. When the period ends we delete, destroy or anonymise it.

You can also delete the cookies in your browser at any time.

We use three categories of cookies.

On the quote page, the sign-in and permission page, the connector and the payment page we use only strictly necessary cookies and browser storage.

Cookie banner. When you first visit our website, you see a banner. The "Kabul et" (Accept), "Reddet" (Reject) and "Ayarla" (Settings) buttons are equal. With "Ayarla" you choose categories; the Analytics and Marketing switches are off at the start. If you do not give permission, the Google Analytics and Meta Pixel code is never loaded and no request goes to Google or Meta.

Changing your choice. The website footer and the end of the Cookie Policy page have a "Çerez ayarları" (Cookie settings) link. When you withdraw permission, the cookies of that category that our website set are deleted and the page reloads once. After that, no request goes to Google or Meta. You can delete Meta's cookies on its own domain (e.g. fr) in your browser or in your Meta account. We remember your choice for 180 days; a rejection is remembered for the same period. We show the banner again when this period ends, when the Cookie Policy version changes or when we add a new cookie category.

Cloudflare security cookies may also be set on the quote page, the sign-in and permission page and the payment page under the same condition. No analytics or marketing cookies are set on the quote page. Some browsers (e.g. Safari) shorten the Google Analytics cookie lifetimes automatically. In Google Analytics, Google signals and ad personalisation are off; no advertising cookie is set.

Cookieless measurement on our website:

Strictly necessary cookies and browser storage are needed to provide the service you request (sign-in, payment, secure delivery of our pages) and to remember your choice. They do not require explicit consent (legal basis: KVKK Art. 5(2)(c) and (f)). Analytics and marketing cookies are based on your explicit consent (KVKK Art. 5(1)); refusing or withdrawing it does not limit your use of the website. Data processed through cookies goes abroad: through Cloudflare cookies to Cloudflare (USA), through analytics cookies to Google LLC (USA), through marketing cookies to Meta Platforms Ireland Ltd. (Ireland) and Meta Platforms, Inc. (USA) (§6). You can delete or block cookies in your browser settings. If you block the sign-in cookie, you cannot sign in. If you delete the adaweb-consent cookie, the banner appears again.

You may ask us to:

• tell you whether your data is processed,
• give you information about the processing,
• tell you the purpose of processing and whether data is used for that purpose,
• tell you the third parties in Türkiye or abroad to whom data is transferred,
• correct incomplete or inaccurate data,
• delete or destroy data under KVKK Art. 7,
• notify third parties to whom data was transferred of a correction or deletion,
• object to a result against you arising solely from automated analysis,
• compensate damage caused by unlawful processing.

Your controls: you can remove Claude's access at any time in your Claude settings (§2). You can withdraw your explicit consent for analytics and marketing cookies at any time, without a formal request, with the "Çerez ayarları" (Cookie settings) link on our website (§9). You can exercise the rights above by contacting us (§11).

Requests are made in Turkish, by one of these methods:

• In writing: to the address in §1, by hand or post, with a wet signature. Write "Kişisel Verilerin Korunması Kanunu Kapsamında Bilgi Talebi" on the envelope.
• By registered e-mail (KEP): abdullah.cetin.54@hs01.kep.tr
• With a secure electronic signature or mobile signature: kvkk@adacetinsigorta.com
• From the e-mail address you previously gave us and that is in our records: kvkk@adacetinsigorta.com

If your e-mail address is not in our records, use the written, KEP, secure electronic signature or mobile signature method.

Your request includes your name, surname, signature (for written requests), Turkish ID number (for foreigners: nationality and passport number), address for notifications, e-mail and phone if any, and your request. We reply within 30 days at the latest, free of charge. If a written reply exceeds ten pages, a per-page fee set by the Personal Data Protection Board may be charged. If you find our reply insufficient or do not receive it in time, you may complain to the Personal Data Protection Board (KVKK Art. 14).

Google Analytics and Meta Pixel data are linked to a random ID in your browser; we cannot match this ID to your name. For requests about this data, the fastest way is to withdraw your permission in "Çerez ayarları" and delete your browser's cookies.

You can call us for information on weekdays 09:00–17:00. A phone call does not replace a formal request.

• Office: we enter your details into our quote system and customer record system. Both run on our own server at our office in Türkiye. For quotes and policies we may ask for your vehicle registration, ID document, driving licence, previous policy or address document; we enter the needed fields and also keep a photo or scan of the document, to ensure accuracy and to prove the transaction (legal basis: Art. 5(2)(c) and (ç); retention: §8). Card payments at the office use the same encrypted method as the payment page. We do not ask anyone for a signature or "I have read" approval.
• Phone, WhatsApp, e-mail: we note phone details in your quote and customer record; we do not record phone calls. We use the standard WhatsApp app; messages are end-to-end encrypted and we do not back them up to iCloud or Google Drive; we do not initiate sending ID numbers or policy documents over WhatsApp, but we send them if you ask. Google provides our e-mail service (§6).
• Website (www.adacetinsigorta.com; our quote page is described in §2), regardless of your permission: there are no forms that ask for personal data; the compulsory insurance wizard and the glossary search box do not ask for personal data. The server keeps no visitor access log; only security logs (e.g. blocked connections) contain the IP address, for up to 30 days. Cloudflare processes your IP address and browser information to tell attacks apart. Umami (on our own server in Germany) and Cloudflare Web Analytics measure visits without cookies (§6); both remove the query part of the page address, and Umami does not count you if "Do Not Track" is on in your browser. With these two tools we do not identify you and we do not track you across sites. Purpose: measuring and improving how the website is used; legal basis: Art. 5(2)(f). If you arrive at an address that does not exist on our website, we record only the path of that address, the domain of the site you came from, how many times it was seen and when it was first and last seen, to fix broken links (legal basis: Art. 5(2)(f), legitimate interest); no IP address, browser information or full address is kept. Your cookie choice is stored in a cookie in your browser; it holds only your choice (the categories asked and the permissions you gave), the policy version and the time, and is not recorded on our server.
• Website, only with your permission (Google Analytics 4): a random visitor ID and session information, pages viewed, referring address, the name of phone, WhatsApp and directions tap events, browser, device type, language and coarse location derived from the IP address (e.g. country; the city is not collected). Enhanced measurement in Google Analytics is on. Where the page has the relevant element, these events are measured automatically: scrolling until 90% of the page is visible; site search (the search term in the address of a search results page); playing an embedded YouTube video (video title, address, duration and percentage watched); file downloads (file name, extension, link text and address). Google Analytics also collects the first visit (first_visit), session start (session_start) and page-in-focus for at least one second (user_engagement) events automatically. Your IP address reaches Google by the nature of the request; Google Analytics 4 does not record it. E-mail addresses and query parameters that may carry personal data (e.g. name, phone, Turkish ID no., plate) are removed before sending. Google signals and ad personalisation are off. Granular location and device data collection is also off. We do not link Google Analytics to a Google Ads account, and we do not ask for or send user data (name, e-mail, phone) to Google. Legal basis: explicit consent (Art. 5(1)).
• Website, only with your permission (Meta Pixel): a random browser ID, the ad click ID if you came from a Facebook or Instagram ad, the page address, the page-view event, the name of the event if you tap a phone, WhatsApp or directions link, browser information and IP address. If you are logged in to Facebook or Instagram and your browser allows it, Meta may also read its own cookie. Only the page-view and tap events are sent, with no other information; other buttons and clicks are not scanned automatically; no name, phone or e-mail goes to Meta. Purpose: measuring the effect of our ads on Meta and being able to show our ads to people who visited our website. Meta may also use this data for its own purposes under its own terms; that use is Meta's responsibility. Legal basis: explicit consent (Art. 5(1)).
• Withdrawing permission: use "Çerez ayarları" in the website footer or at the end of the Cookie Policy page. The analytics and marketing cookies that our website set are deleted, and no request goes to Google or Meta on later pages. You can delete Meta's cookies on its own domain (e.g. fr) in your browser or in your Meta account. Withdrawal works for the future and does not undo earlier processing. Refusing or withdrawing does not limit your use of the website.
• Contact from the website: if you tap a phone, WhatsApp or e-mail link, the conversation continues in that channel. The WhatsApp link takes you to WhatsApp; the website does not see your message. You can also write outside office hours; we reply during working hours.

If this notice changes, we publish a new version number and date. Previous versions of the Turkish texts are available in their archive. The Turkish notice 2.1 replaces the separate Turkish notice for our website (last version 1.2).