Privacy Policy

As OctoXLabs Yazılım A.Ş. (“OctoXLabs or “Company”), we exercise due care to ensure the protection of personal data that we process while carrying out our commercial activities, in accordance with the Law on the Protection of Personal Data No. 6698 in Turkey, as well as other applicable data protection and privacy laws (“Applicable Law”) in the jurisdictions where we operate, and we are committed to fulfilling all obligations arising thereunder. In this regard, this Personal Data Protection Policy (“Policy”) has been prepared for the purpose of informing data subjects whose personal data is processed by OctoXLabs regarding the processes and principles of processing, namely the collection, use, sharing, and storage of personal data by OctoXLabs. The principles regarding the processing of personal data set out in this Policy cover OctoXLabs’s employees and employee candidates, customers, potential customers, resellers, suppliers, visitors, and other natural persons who are in a relationship with OctoXLabs.

DEFINITIONS

Explicit Consent: Consent that is related to a specific subject, based on information, and given with free will.
Anonymization: Rendering personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even when combined with other data.
Data Subject: The natural person whose personal data is processed.
Applicable Law: The Law on the Protection of Personal Data No. 6698 of Turkey and other applicable data protection and privacy laws in the jurisdictions where OctoXLabs operates.
Personal Data: Any information relating to an identified or identifiable natural person.
Processing of Personal Data: Any operation performed upon personal data, whether wholly or partly by automatic means or by non-automatic means as part of a data recording system, such as collection, recording, storage, retention, alteration, re-organization, disclosure, transfer, acquisition, making available, classification, or preventing its use.
Board: The Personal Data Protection Board of Turkey.
Special Categories of Personal Data (Sensitive Data): Data relating to a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA

OctoXLabs processes personal data in accordance with the procedures and principles set forth under Applicable Law. In this context, OctoXLabs fully complies with the following principles stipulated under the Applicable Law when processing personal data:

Lawfulness and Fairness: OctoXLabs carries out all personal data processing activities in compliance with the Applicable Law, and all other applicable legislation, and in line with the principle of good faith.
Accuracy and Keeping Data Up-to-Date When Necessary: OctoXLabs takes necessary measures to ensure that the personal data it processes is accurate and, where necessary, kept up to date. To this end, data subjects are provided with opportunities to update their personal data so that the information reflects the actual situation.
Processing for Specific, Explicit, and Legitimate Purposes: OctoXLabs processes personal data only for clearly defined, explicit, and legitimate purposes and does not process data for any purposes other than those declared. In this regard, OctoXLabs processes personal data only when it is relevant and necessary for its relationship with the data subjects.
Relevance, Proportionality, and Data Minimization: Personal data is processed by OctoXLabs in connection with, limited to, and proportionate to the purposes for which they are processed and as permitted under the Applicable Law. OctoXLabs avoids processing unnecessary personal data.
Retention for a Limited Period: Personal data processed by OctoXLabs is retained only for the period required under the relevant legislation or for the purposes for which it is processed. Where the legislation prescribes a specific retention period, OctoXLabs complies with such period; where no specific period is stipulated, personal data is retained only for as long as necessary to fulfill the processing purpose.

CONDITIONS FOR PROCESSING AND TRANSFERRING PERSONAL DATA

Except for cases where other lawful bases for processing under the Applicable Law exist, OctoXLabs processes personal data only by obtaining the Explicit Consent of the data subject. Where one of the conditions listed below under the Applicable Law is present, personal data may be processed without seeking the Explicit Consent of the data subject:

Where it is expressly stipulated by law,
Where it is necessary for the protection of the life or physical integrity of the data subject or another person who is unable to give consent due to actual impossibility or whose consent is not legally valid,
Where the processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract,
Where it is necessary for the data controller to fulfill its legal obligation,
Where the personal data has been made public by the data subject,
Where processing is necessary for the establishment, exercise, or protection of a right,
Where processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

With regard to the processing of sensitive personal data, OctoXLabs applies stricter safeguards. Such data shall be processed only in the presence of Explicit Consent of the data subject or in the following cases, provided that the additional measures determined by the Personal Data Protection Board are duly implemented:

Where it is expressly stipulated by law,
Where it is necessary for the protection of the life or physical integrity of the data subject or another person who is unable to give consent due to actual impossibility or whose consent is not legally valid,
Where the personal data has been made public by the data subject in line with their will of disclosure,
Where it is necessary for the establishment, exercise, or protection of a right,
Where it is necessary by persons or authorized institutions and organizations under confidentiality obligation, for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, or for the planning, management, and financing of health services,
Where it is necessary for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance,

OctoXLabs complies with the conditions set forth in the Applicable Law regarding the sharing of personal data, including sensitive personal data, with third parties. In this context, personal data are not shared with third parties without obtaining the Explicit Consent of the data subject.

However, where any of the legal grounds specified under the Applicable Law exist, personal data may be shared without Explicit Consent with natural persons or private legal entities, suppliers, the general public, or authorized public institutions and organizations.

CATEGORIES OF PERSONAL DATA AND PURPOSES OF PROCESSING

OctoXLabs collect and process certain categories of personal data, including identity, contact, personnel, customer transaction, physical security, transaction security, financial, professional experience, visual and audio recordings, marketing, health (for employees), criminal record and security measures (for employees), and signature data.

These data are processed for purposes such as managing recruitment and employment obligations, ensuring workplace and data security, fulfilling legal and contractual requirements, carrying out business operations, finance and accounting, sales and after-sales services, marketing and promotional activities, event and organization management, performance evaluation, archiving, compliance with requests from authorities, and overall management of OctoXLabs’s commercial activities.

If you request a demo through our website, your personal data including your name, surname, e-mail address and company name will be processed by OctoXLabs for the purpose of fulfilling your demo request.

OctoXLabs may also process personal data for future operational and commercial needs in order to sustain and improve its business.

RETENTION AND DELETION OF PERSONAL DATA

Personal data collected by OctoXLabs are securely stored, either physically or electronically, for an appropriate period necessary to carry out the OctoXLabs’ business activities. In processing such data, OctoXLabs complies with all obligations set forth under the Applicable Law and other applicable legislation regarding data protection.

Unless a longer retention period is permitted or required under Applicable Law, personal data will be deleted once the purposes of processing have been fulfilled and there is no other legitimate ground for retention. Such deletion is carried out in accordance with the OctoXLabs’ Data Retention and Destruction Policy, either upon the OctoXLabs’ own initiative or at the request of the data subject. Where personal data are deleted by technical means, they will be destroyed in a manner that ensures they cannot be used or recovered in any way, in line with the OctoXLabs’ Data Retention and Destruction Policy.

DATA SECURITY

OctoXLabs takes all necessary technical and organizational measures to ensure the security of personal data. These measures are designed to prevent unauthorized access, unlawful processing, disclosure, alteration, or destruction of data, and to ensure secure storage and safe disposal where required.

TRANSFER OF PERSONAL DATA ABROAD

Personal data may be transferred abroad only under the following conditions:

If one of the legal bases set out under Articles 5 and 6 of the Law on the Protection of Personal Data No. 6698 exists, and an adequacy decision has been issued by the Data Protection Authority regarding the recipient country, sectors within that country, or relevant international organizations, personal data may be transferred abroad by data controllers and data processors.

In the absence of an adequacy decision, personal data may still be transferred abroad provided that one of the legal bases under Articles 5 and 6 of the Law on the Protection of Personal Data No. 6698 exists, and that the data subject has the opportunity to exercise their rights and to seek effective legal remedies in the recipient country, subject to the provision of one of the following appropriate safeguards:

The existence of an agreement, not constituting an international treaty, between public institutions and organizations or professional organizations in Turkey that are considered public institutions, and public institutions and organizations or international organizations abroad, provided that the Board grants permission for such transfer.
Binding corporate rules containing provisions on the protection of personal data, to which companies within the same group engaged in joint economic activity are subject, and which have been approved by the Board.
A standard contract announced by the Board, including elements such as data categories, purposes of transfer, recipients and recipient groups, technical and administrative measures to be taken by the data recipient, and additional measures for sensitive personal data.
A written undertaking including provisions ensuring adequate protection, provided that the Board grants permission for such transfer.

In the absence of an adequacy decision and where no appropriate safeguards are provided, personal data may only be transferred abroad on an occasional basis if one of the following conditions exists:

The data subject gives Explicit Consent to the transfer after being informed of the potential risks.
The transfer is necessary for the performance of a contract between the data subject and the data controller, or for the implementation of pre-contractual measures taken at the request of the data subject.
The transfer is necessary for the conclusion or performance of a contract made in the interest of the data subject between the data controller and another natural or legal person.
The transfer is necessary for reasons of overriding public interest.
The transfer is necessary for the establishment, exercise, or protection of a legal right.
The transfer is necessary to protect the life or physical integrity of the data subject or another person, where the data subject is physically or legally incapable of giving consent.
The transfer is made from a register that is open to the public or to persons with a legitimate interest, provided that the conditions laid down by the relevant legislation for access to such registers are met.

DATA SUBJECT RIGHTS

OctoXLabs has taken the necessary measures to ensure that data subjects can exercise their rights regarding the personal data processed in accordance with the principles set out in this Policy, pursuant to the relevant article of the Law on the Protection of Personal Data No. 6698 regulating the rights of data subjects. These rights are as follows:

To learn whether personal data is being processed,
To request information if personal data has been processed,
To learn the purpose of the processing of personal data and whether they are used in accordance with the purpose,
To know the third parties to whom personal data is transferred, whether domestically or abroad,
To request the correction of personal data if it is incomplete or incorrectly processed,
To request the deletion or destruction of personal data within the framework of the conditions stipulated in the relevant article of the Law on the Protection of Personal Data No. 6698 regulating the destruction of personal data,
To request notification of the correction, deletion, or destruction to third parties to whom personal data has been transferred,
To object to the occurrence of a result against the person themselves by means of the exclusive analysis of processed data through automated systems,
To demand compensation for damages in case of suffering harm due to the unlawful processing of personal data.

Data Subjects may have rights concerning their Personal Data. To exercise these privacy rights – please contact us by e-mail at [email protected] or by using any of the methods provided under the applicable legislation.