1. Purpose, Scope and Data Controller
As Bando Creative Studio Reklam Anonim Şirketi (“Ba’ndo” or the “Company”) (TIN: 1400578014), residing at “Suadiye Mah. Noter Sok. No:11-13 Kat:2 D:3 Kadıköy / İstanbul”, we attach importance to the privacy of visitors to the website at www.wearebando.com (the “Website”). This text has been prepared pursuant to the Law No. 6698 on the Protection of Personal Data (the “PDPL”), secondary legislation, and the current principles and decisions published by the Personal Data Protection Board (the “Board”), in order to explain which personal data are processed through cookies and similar technologies used on the Website, for which purposes and on which legal grounds, to whom such data may be transferred, and how data subject rights may be exercised.
This text relates solely to cookies and similar technologies used within the scope of the Website. Separate privacy notices specific to the relevant process may apply to personal data processing activities carried out through job applications, service requests, customer/supplier relationships, email correspondence, or other channels.
The disclosure obligation is not subject to any approval. For activities requiring explicit consent, your selections are obtained separately through the cookie preferences panel; merely reading this text or continuing to visit the Website does not, by itself, mean that you have given explicit consent.
2. Privacy and Information Security
-
Ba’ndo exercises reasonable care to ensure that the information and content on the Website are presented in an up-to-date, accurate and secure manner. Nevertheless, without prejudice to its obligations arising from mandatory legislation, Ba’ndo does not warrant that content obtained from or based on third-party sources will always be complete, up to date, error-free or uninterrupted.
-
The Website may be temporarily interrupted due to maintenance, updates, infrastructure or communication failures, cyber incidents, decisions of competent authorities, or circumstances beyond Ba’ndo’s reasonable control. Ba’ndo takes appropriate measures to prevent these risks and mitigate their effects; however, it notes that the absolute security of communications over the internet and electronic storage methods cannot be guaranteed. This provision shall not be interpreted as excluding Ba’ndo’s obligations under the PDPL or other mandatory legislation.
-
Ba’ndo implements technical and administrative measures proportionate to the nature and risk level of the processing activity in order to protect the confidentiality, integrity and availability of personal data and the Website infrastructure. Such measures may include access and authorisation controls, user and transaction logs, secure communication methods, backups, update and vulnerability management, supplier controls, staff awareness, and encryption and security testing where necessary.
-
If it is determined that personal data have been obtained unlawfully or that an information security breach has occurred, Ba’ndo takes the necessary steps to contain the incident, remedy its effects and prevent recurrence, and duly informs the data subjects, the Board and other competent authorities where required under the PDPL and applicable legislation.
-
Visitors are also advised to ensure the security of their devices, operating systems and internet browsers, install updates, and protect their access credentials. Unauthorised access to the Website or its infrastructure, circumvention of security measures, transmission of malicious software, disruption of the Website, or use of the Website for unlawful purposes is prohibited.
3. Cookies and Similar Technologies
Cookies are small text files stored on your device through your browser when you visit a website. Cookies may be used to ensure the secure and proper operation of the Website, remember preferences, measure usage and performance, or, where you have given explicit consent, personalize content and communications.
Similar technologies include local storage, session storage, tags, pixels, web beacons, software development kits and device/browser identifiers. Unless otherwise stated, the term “cookie” in this text is used to include such similar technologies.
4. Classification of Cookies
According to Retention Period
Session Cookies: Temporary cookies used during the browser session and, as a rule, deleted when the browser is closed.
Persistent Cookies: Cookies that remain on the device for a specified period or until deleted by the user. The period varies according to the purpose of the cookie and the provider’s settings.
According to the Party Placing the Cookie
First-Party Cookies: Cookies placed directly by the www.wearebando.com domain or operating in connection with that domain.
Third-Party Cookies: Cookies placed by third parties providing services such as analytics, content, video, maps, social media or advertising. Such parties may also act as independent data controllers under their own privacy notices.
According to Purpose of Use
| Category | Purpose | Legal Approach |
|---|---|---|
| Required / Essential | Technical operation of the Website, security, network management, page navigation, load balancing and recording cookie preferences. | Processing conditions under Art. 5/2 of the PDPL. |
| Functionality / Preference | Remembering language, region, display, user preferences or previous selections; providing enhanced features. | Explicit consent; whether the function is expressly requested by the user and strictly necessary is assessed separately. |
| Analytics / Performance | Visitor and session measurement, analysis of page and content interactions, error and performance measurement, and improvement of the Website. | Explicit consent. |
| Targeting / Advertising | Creating interest profiles, personalised advertising, retargeting, ad-frequency measurement and campaign-effectiveness measurement. | Explicit consent. |
| Social Media / Embedded Content | Social media sharing, display of video, music, maps or third-party content, and measurement of interactions with such content. | Explicit consent. |
| Security / Misuse Prevention | Detection and prevention of fraud, bot traffic, attacks, unauthorised access and technical misuse. | The applicable processing condition under Art. 5/2 of the PDPL; use must be proportionate and necessary. |
Ba’ndo does not necessarily use all of the above categories at all times. Cookies and similar technologies actually in use are listed in the inventory below. If a new technology is introduced, the inventory and preferences panel will be updated accordingly.
5. Personal Data Processed
Depending on the technology used and your preferences, the following categories of data may be processed through cookies and similar technologies:
Transaction Security Data: IP address, timestamp, browser and device information, error logs, and security and fraud signals.
Usage Data: Pages visited, page-view and interaction events, visit duration, referring page, session information and performance metrics.
Preference Data: Cookie acceptance/rejection preference, language, region, display and choices relating to the Website experience.
Online Identifiers: Cookie ID, client/session ID and, where explicit consent has been given, analytics or advertising identifiers.
Marketing and Profile Data: Interest inferences, campaign interactions and advertising measurement data, only where explicit consent has been given for the relevant category.
Ba’ndo does not intend to collect identity information such as your first and last name directly through cookies. However, online identifiers may constitute personal data when associated with an IP address or other data.
6. Technologies Currently in Use on the Website
The inventory below reflects the technologies actually in use on the published version of the Website. The cookies observed may vary depending on the browser, device, geographical location, provider settings and technical changes made to the Website. Analytics cookies are not pre-selected and are activated only through the user’s active choice; unless consent is given, the Google Analytics script is not loaded on the Website at all and no analytics cookie is created. If you withdraw your consent, measurement stops and any analytics cookies already created are deleted. No targeting or advertising cookies are used on the Website.
| Name | Type / Party | Purpose | Period | Category | Legal Ground |
|---|---|---|---|---|---|
| bando_consent | Cookie / First party | Storing your cookie preference and the time it was given; preventing the panel from being displayed again on every page and evidencing consent. | 12 months | Essential | Article 5/2-f of the PDPL: legitimate interest; implementing the preference expressly requested by the user and keeping a record of consent |
| bando_lang | Cookie / First party | Remembering your language preference (Turkish / English) and opening the Website in the same language on subsequent visits. | 12 months | Essential | Article 5/2-f of the PDPL: legitimate interest; providing the functionality expressly requested by the user |
| bando-theme | Local storage / First party | Remembering your light/dark appearance preference. | Until deleted by the user | Essential | Article 5/2-f of the PDPL: legitimate interest; providing the functionality expressly requested by the user |
| player.vimeo.com | Embedded content / Third party (Vimeo) | Playing the videos on project pages. The player is called with Vimeo’s “Do Not Track” parameter (dnt=1); in this mode Vimeo does not place tracking or advertising cookies and does not use playback data for personalisation. | Subject to Vimeo’s own policy | Embedded content | Your viewing of the page containing the video — Article 5/2-f of the PDPL; no processing for tracking purposes takes place |
| _ga | Cookie / First party; Google Analytics service | Creating an analytics identifier to distinguish users where explicit consent has been given. | Default 2 years* | Analytics / Performance | Explicit consent (Article 5/1 of the PDPL). |
| _ga_5WHH4JNDCZ | Cookie / First party; Google Analytics service | Maintaining the Google Analytics session state and measuring Website usage where explicit consent has been given. | Default 2 years* | Analytics / Performance | Explicit consent (Article 5/1 of the PDPL). |
* The periods specified for Google Analytics are the provider’s default periods. Browser restrictions or Ba’ndo/provider settings may result in a shorter period.
7. Purposes and Legal Grounds for Processing Personal Data
| Processing Purpose | Data Categories | Legal Ground |
|---|---|---|
| Providing the Website securely and in working order; network and session management; recording the cookie preference. | Transaction security, preference and limited device/browser data. | Article 5/2-f of the PDPL: Processing is necessary for Ba’ndo’s legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subject. |
| Remembering preferences and providing personalised Website features. | Preference data and online identifiers. | Article 5/1 of the PDPL: Explicit consent; use that is strictly necessary for a service requested by the user may be assessed separately. |
| Measuring Website usage, improving performance and content, and generating visitor and session statistics. | Usage data, online identifiers and device/browser information. | Article 5/1 of the PDPL: Explicit consent. |
| Providing interest-based content/advertising, campaign measurement, retargeting or social media/embedded-content features. | Usage data, marketing/profile data and online identifiers. | Article 5/1 of the PDPL: Explicit consent. |
Not giving your explicit consent, or subsequently withdrawing it, does not prevent you from using the essential functions of the Website. However, a specific function, embedded content or personalisation feature for which you gave consent may not operate.
8. Transfer of Personal Data
Your personal data may be transferred, in a limited and proportionate manner for the purposes stated above, to suppliers providing the Website’s hosting, infrastructure, security, maintenance and analytics services, to authorised public institutions and organisations, and to legally authorised private persons. Whether service providers act as data processors or independent data controllers may vary according to the activities they perform.
If Google Analytics is enabled, analytics data may be processed through Google services. Where the service is provided through systems located outside Türkiye, this may result in a transfer of personal data abroad. A transfer abroad is carried out only where one of the transfer conditions set out in Article 9 of the PDPL is met and the required appropriate safeguards are in place. Explicit consent may be relied upon for transfers abroad only within the framework of the conditions under Article 9 of the PDPL and following a separate assessment.
In its supplier selection and contracting processes, Ba’ndo takes into account provisions concerning data security, confidentiality, retention periods, sub-processors and transfers abroad.
9. Management of Cookie Preferences
A cookie preferences panel is displayed on your first visit to the Website. The “Accept”, “Reject” and “Preferences” options are presented with equal accessibility, and non-essential categories are disabled by default. You may make a separate selection for each category requiring consent.
You may change your selections or withdraw your consent at any time through the “Cookie Preferences” link available on the Website.
Through your browser settings, you may view and delete cookies, block all cookies or third-party cookies, and receive a warning when a cookie is created.
If you clear local storage records, the Website may ask for your cookie preference again.
Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
If you block all cookies through your browser, some technical or preference functions of the Website may not operate as expected. For up-to-date information on browser settings, please consult the official help page of the browser you use. You may obtain detailed information on cookie management by clicking on your browser below.
-
Microsoft Edge: Please Click Here
-
Google Chrome: Please Click Here
-
Safari: Please Click Here
-
Mozilla Firefox: Please Click Here
-
Opera: Please Click Here
In Addition;
-
Please click here to disable Cookies managed by Google Analytics.
-
Please click here to manage the personalised advertising experience provided by Google.
-
Preferences concerning cookies used by many companies for advertising activities may be managed through Your Online Choices.
-
The settings menu of the mobile device may be used to manage Cookies on mobile devices.
-
For more detailed information about cookies, you may visit www.youronlinechoices.eu or www.aboutcookies.org, or use the “Privacy Badger” application.
10. Retention and Security of Personal Data
Cookies and the personal data obtained through them are retained for the period specified in the relevant inventory or for the period necessary for the processing purpose; unless a longer statutory retention obligation applies, they are deleted, destroyed or anonymised at the end of that period. Where explicit consent is withdrawn, the relevant consent-based processing is discontinued unless another legal ground applies.
Ba’ndo takes technical and administrative measures appropriate to the nature of the processing activity in order to prevent the unlawful processing of and access to personal data and to ensure their secure retention. Risks are assessed regularly, taking into account that the absolute security of data transmission over the internet cannot be guaranteed.
11. Third-Party Links and Embedded Content
The Website may contain links to social media, video, music, maps, publications or other third-party websites. If you click a link or enable embedded content by giving explicit consent, the relevant third party may use its own cookies and process personal data. The processing activities of such third parties are subject to their own privacy and cookie notices. Ba’ndo does not control the independent data processing activities of third parties.
12. Data Subject Rights and Applications
You may submit requests concerning your rights under Article 11 of the PDPL to Ba’ndo in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. You may review the PDPL Data Subject Application Form prepared for this purpose and available on the Website. You may send general questions about this text to privacy@wearebando.com.
13. Amendments to this Text
Ba’ndo may update this text due to changes in legislation, Board decisions, the functions of the Website, suppliers or the technologies used. The current text is effective from the date on which it is published on the Website. In the event of material amendments, additional information will be provided through the Website where appropriate, and your cookie preference will be obtained again if necessary.