Privacy and data protection
GDPR Privacy Notice
Information under the GDPR, the UK GDPR and the Swiss FADP for people in the EEA, the UK and Switzerland whose personal data ENA Innovation processes.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails. This document is pending legal review.
This notice is for people in the European Economic Area (EEA), the United Kingdom or Switzerland whose personal data is processed by ENA Innovation, for example when they visit www.enatto.com, contact us, or work for a customer organization. It supplements our Privacy Policy, which describes all processing in detail, and is given under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR"), the United Kingdom GDPR (the "UK GDPR") and the Swiss Federal Act on Data Protection (the "FADP"). For processing under Turkish law, see the KVKK Privacy Notice.
1. Controller
ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş., Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye. Contact for personal data: support@enainnovation.com.
Trade registry: Afyonkarahisar Trade Registry Office, registration no. 18590 · MERSİS no. 0334130943400001 · Tınaztepe Tax Office, tax ID 3341309434 · D-U-N-S number 448896706.
- EU representative (Art. 27 GDPR): If an appointment becomes required, the representative's details will be published on this page; until then, requests can be sent to support@enainnovation.com.
- UK representative (Art. 27 UK GDPR): If an appointment becomes required, the representative's details will be published on this page; until then, requests can be sent to support@enainnovation.com.
- Swiss representative (Art. 14 FADP): If an appointment becomes required, the representative's details will be published on this page; until then, requests can be sent to support@enainnovation.com.
- Data protection officer: we have not appointed a data protection officer, because we consider that the conditions of Article 37 GDPR do not apply to the processing we carry out as controller. Write to the address above for any data protection question.
2. When we are controller and when we are processor
We are the controller for the website, contact and demo requests, customer contracts, billing, support and commercial messages you opted in to.
We are a processor for data processed in an EnaTTO Customer Environment, for example the organization's users and directory of people, inventors and invention disclosures, IP, project, committee, industry, startup, training and commercialization records, documents, and data collected through the organization's public pages (technology catalogue, demand, application and event registration forms, feedback surveys and certificate verification). The organization that uses EnaTTO (for example a technology transfer office, university, research institute, technopark, hospital or public institution) is the controller for that data; it is the organization's responsibility to give you its own privacy notice and to determine the legal basis. We process such data only on the organization's documented instructions, under a Data Processing Agreement that contains the terms required by Article 28 GDPR. Please send requests about that data to the organization; requests that reach us are forwarded to it.
3. Data, purposes and legal bases
| Purpose | Data | Legal basis (Art. 6(1) GDPR / UK GDPR) |
|---|---|---|
| Running and securing the website | IP address, browser and device data, access logs | Legitimate interests (f): a secure, working website |
| Aggregate visit and performance statistics (no cookies) | Aggregate, non-identifying usage data | Legitimate interests (f): improving the website |
| Redirecting users on the login page to the right organization address | Organization code, IP address, browser data | Legitimate interests (f) |
| Answering demo and contact requests | Name, work contact details, organization, sector, role, expected scale of use, message | Steps prior to a contract (b); legitimate interests (f) |
| Customer contracts, billing and support | Contact persons' details, contract and invoice data, support correspondence | Contract (b); legal obligation (c) |
| Commercial e-mails | Name, e-mail, consent records | Consent (a), which you can withdraw at any time |
| Establishing or defending legal claims | Relevant records | Legitimate interests (f) |
Where we rely on legitimate interests, we have weighed them against your interests and rights; you can ask us for details. We do not process special categories of data as controller. When we receive your data from someone else (for example from a customer organization that employs you), it is limited to your name, work contact details and role.
For people covered by the FADP, the same purposes and data categories apply; processing follows the general principles of the FADP (Art. 6).
4. Recipients
We share data only with service providers acting as our processors (hosting, network protection, identity, e-mail delivery and error monitoring services; see Sub-processors), with professional advisers under confidentiality, and with public authorities where the law requires it. We do not sell personal data.
In the EnaTTO service, if an organization switches on the optional AI assistance (off by default), selected fields of public and internal records are sent to Google (Gemini) through ENA Innovation's AI gateway; confidential and strictly confidential records, company contact details and internal notes are never sent. If an organization joins benchmarking, only aggregate yearly indicators of the organization are shared, not personal data.
5. Transfers outside the EEA, the UK and Switzerland
ENA Innovation is established in Türkiye, so data you send to us is transferred to Türkiye, which has no adequacy decision of the European Commission, the United Kingdom or Switzerland. Some of our providers process data in other countries, including the USA (for example Vercel and Resend; Cloudflare for traffic to Customer Environments; and Google if an organization switches on AI assistance).
For these transfers we rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), for the UK on the International Data Transfer Addendum or the International Data Transfer Agreement (IDTA), for Switzerland on standard contractual clauses recognized by the Federal Data Protection and Information Commissioner (FDPIC), or, for providers certified under it, on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, together with supplementary measures such as encryption in transit. The safeguard that applies to each provider is set out in that provider's data processing terms. You can ask for a copy of the relevant safeguards at the address above.
The hosting region of a Customer Environment is set in the agreement with the organization, according to the organization's choice.
6. Retention
We keep data only as long as needed for the purpose and as required by law. The periods are listed in section 10 of the Privacy Policy; for example, contact requests that do not lead to a contract are deleted 2 years after the last contact.
7. Your rights
You have the right to:
- access your data (Art. 15) and receive a copy;
- have inaccurate data corrected (Art. 16);
- have data erased (Art. 17);
- restrict processing (Art. 18);
- data portability for data you gave us on the basis of consent or contract (Art. 20);
- object at any time to processing based on legitimate interests, and to direct marketing (Art. 21);
- withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3)).
People covered by the FADP have the right to information (Art. 25), to data portability (Art. 28) and to the protection of their personality rights, including correction and erasure (Art. 32).
Write to support@enainnovation.com (details: Data Subject Requests). We answer within one month; this can be extended by two months for complex requests, in which case we tell you why.
You also have the right to lodge a complaint with a supervisory authority: in the EEA, in particular in the country where you live, work or where the alleged infringement took place (for example, in Germany, the data protection authority of the relevant federal state, and in the Netherlands, the Autoriteit Persoonsgegevens); in the United Kingdom, with the Information Commissioner's Office (ICO); in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC).
8. Is providing data required?
Website use requires no personal data beyond technical logs. Information marked as required in our forms is needed to answer your request; without it we cannot respond. Contract data is needed to conclude and perform the contract.
9. Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22). The EnaTTO service does not take automated decisions about people: matching of experts to industry demands is rule-based and shows its reasons, AI suggestions must be applied by a person, and decisions on invention disclosures, applications and evaluations are recorded by the organization's staff and committees.
10. Changes
We may update this notice. The current version is published on this page with its effective and update dates.