Privacy and data protection
Data Subject Requests
How inventors, researchers and other data subjects exercise their KVKK, GDPR, UK GDPR and Swiss FADP rights for EnaTTO data, and where to send the request.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails. This document is pending legal review.
This page explains how to exercise your rights over personal data processed with EnaTTO: the rights in Article 11 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), in Articles 15 to 22 of Regulation (EU) 2016/679 (the "GDPR") and the United Kingdom GDPR ("UK GDPR"), and in the Swiss Federal Act on Data Protection ("FADP"). Which law applies depends on who processes your data and where; this page does not decide that for you.
1. First, find out who is responsible for your data
Who you should write to depends on the data concerned. The same role split applies as in our Privacy Policy (Section 2) and Data Processing Agreement.
| Your situation | Data controller | Where to send your request |
|---|---|---|
| You are recorded in an organization's EnaTTO environment, for example as an inventor, researcher, project team member, committee member, mentor, trainer, evaluator, patent attorney or company contact | The organization using EnaTTO (the Customer), for example a technology transfer office or university | The organization's data protection contact or its technology transfer office |
| You used an organization's public page: technology interest form, industry demand form, startup application, event registration, feedback survey or certificate verification | The organization that published the page | The contact named on the page or in the organization's privacy notice |
| You use EnaTTO with a user account of an organization (your account, roles, record memberships, audit records) | The organization that invited you | Your organization's administrator or data protection contact |
| You visited www.enatto.com, filled in a contact or demo form, receive our commercial emails, or are the contact person of a customer or prospective customer | ENA Innovation | ENA Innovation directly (Section 3) |
For data in an organization's Customer Environment, ENA Innovation is only the data processor: it processes the data on the organization's instructions and does not decide whether a request is granted.
If such a request reaches us: we do not answer it ourselves. We forward it to the organization concerned within 5 business days and let you know that we have done so. We then help the organization answer it, normally within 10 business days of its written request. If we cannot tell from your request which organization is concerned, we will ask you; please do not send confidential invention details or copies of identity documents for this purpose.
2. If your data is in an organization's EnaTTO environment
2.1. What the organization can do with EnaTTO
With the Service's own tools, the organization can view and correct your directory entry and records, export lists as Excel or CSV, archive records, remove your user account or record access, and cancel event registrations. Where these tools are not enough, ENA Innovation provides technical assistance on the organization's request.
2.2. What you can do yourself
- Public form submissions: if you did not confirm a submission with the link in the email, it is deleted automatically after 48 hours. With the link in your confirmation email you can view an event registration and cancel it until the first session starts.
- Feedback surveys: responses are stored without your name; the organization sees only averages and comments.
- Expertise profile: academics with an account can edit their own expertise profile and remove imported publications.
2.3. Limits the organization may apply
Whether a request is granted is decided by the organization as data controller under the law that applies to it. For example, an organization may need to keep records of inventors, decisions, agreements and revenue sharing to protect intellectual property rights or meet legal obligations, and the audit log of the Service can only be appended to (names and email addresses in it are masked). The organization must explain its decision to you. ENA Innovation does not take these decisions.
3. Requests to ENA Innovation as data controller
3.1. How to apply
| Method | How |
|---|---|
| Write to support@enainnovation.com from the email address you gave us (for example in a form or in correspondence). Subject: "Data subject request". | |
| Written application | Send a signed letter to ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş., Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye. For applications under KVKK, please write "Information Request under the Personal Data Protection Law" on the envelope. |
| Secure electronic or mobile signature (KVKK) | Send your application signed with a secure electronic signature or mobile signature to support@enainnovation.com. |
You may write in Turkish, English or German.
3.2. What to include
- Your full name and, for written applications, your signature.
- Your contact address (email or postal) for our response.
- Which right you want to exercise and a clear description of your request.
- Any information that helps us find your data (for example the date of a form you sent or the organization you work for).
- For applications under KVKK: the information listed in Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller (the "Communiqué"), including your Turkish ID number (citizens of Türkiye) or nationality and passport or ID number (foreign nationals), and your residential or business address.
We may ask for additional information to verify that the request comes from you; we ask only for what we need for that. If you apply on someone else's behalf, please attach proof of your authority (for KVKK applications, a notarized power of attorney granting specific authority; for persons under parental authority or guardianship, a document showing that authority).
3.3. Your rights
| Right | KVKK (Art. 11) | GDPR / UK GDPR | FADP |
|---|---|---|---|
| Learn whether your data is processed, get information and a copy | Yes | Access, Art. 15 | Information, Art. 25 |
| Correction of inaccurate data | Yes | Art. 16 | Art. 32 |
| Deletion or destruction | Yes, under the conditions of Art. 7 | Art. 17 | Art. 32 |
| Notification of correction or deletion to recipients | Yes | Art. 19 | |
| Restriction of processing | Art. 18 | ||
| Data portability | Art. 20 | Art. 28 | |
| Objection (including to direct marketing) | To a result against you arising exclusively from automated analysis | Art. 21 | Art. 30–32 |
| Not to be subject to solely automated decisions | See above | Art. 22 | Art. 21 |
| Withdraw consent | Yes | Art. 7(3) | Yes |
| Compensation for damage from unlawful processing | Yes | Art. 82 | Under Swiss civil law |
You can withdraw consent to commercial emails at any time with the link in each message, without making a formal request.
3.4. Response time
- KVKK: as soon as possible depending on the nature of the request and within 30 days at the latest.
- GDPR and UK GDPR: within one month of receipt; for complex or numerous requests this can be extended by two further months, in which case we tell you why within the first month.
- FADP: information requests within 30 days; if this is not possible, we tell you within that period when you will receive it.
We reply in writing or electronically. If we refuse a request in whole or in part, we give the reasons.
3.5. Fees
Requests are free of charge. Under KVKK, if the action requires an additional cost, the tariff in Article 7 of the Communiqué may apply (for written responses over 10 pages, 1 Turkish lira for each page above 10; for responses on a recording medium, the cost of the medium); any fee charged is refunded if the application results from our error. Under the GDPR, the UK GDPR and the FADP, we may charge a reasonable fee or refuse to act only where a request is manifestly unfounded or excessive, as those laws allow.
4. Complaints to a supervisory authority
If you are not satisfied with the response, you can complain to a supervisory authority:
- Türkiye: the Personal Data Protection Board (KVKK Art. 14), within 30 days of learning of the response and in any case within 60 days of the application date. Under KVKK you must apply to the data controller first.
- European Economic Area: the supervisory authority of the country where you live or work or where the alleged infringement took place.
- United Kingdom: the Information Commissioner's Office (ICO).
- Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).
For data in an organization's environment, complaints concern that organization as data controller. Our representatives in the EU, the UK and Switzerland, where appointed, are listed in the GDPR Privacy Notice.
5. Contact
For questions about this process: support@enainnovation.com · +90 850 308 45 91
Address: ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş., Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye