Privacy and data protection
KVKK Privacy Notice
Information notice under Article 10 of Turkish Law No. 6698 for EnaTTO website visitors, form submitters and contact persons of customer organizations.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails. This document is pending legal review.
This information notice has been prepared by ENA Innovation, as data controller, under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the "Law") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
1. Data controller
| Item | Value |
|---|---|
| Legal name | ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş. ("ENA Innovation") |
| Address | Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye |
| Trade registry | Afyonkarahisar Trade Registry Office, registration no. 18590 |
| MERSİS no. | 0334130943400001 |
| Tax office / tax ID | Tınaztepe Tax Office / 3341309434 |
| D-U-N-S number | 448896706 |
| Personal data contact | support@enainnovation.com |
| Phone | +90 850 308 45 91 |
2. Who does this notice cover?
- Website visitors: people who visit www.enatto.com.
- Form submitters and people who contact us: people who fill in the contact or demo form, or reach us by email, phone or WhatsApp.
- Authorized persons and contacts of customer organizations: authorized persons, employees and contacts of organizations that use or are considering EnaTTO (contract, billing, setup and support processes).
Out of scope: for data processed in an organization's EnaTTO environment (for example the organization's users and directory, inventors, invention disclosures and other records, and data of people who use the organization's public pages such as the technology catalogue, demand, application and event registration forms or certificate verification), the organization using EnaTTO (the Customer) is the data controller; ENA Innovation processes this data as data processor. The organization concerned provides the privacy notice for this data.
3. Personal data processed
| Data subject group | Data category | Examples |
|---|---|---|
| Website visitor | Transaction security | IP address, browser and device information, page accessed, time |
| Website visitor (organization login page) | Transaction security | Organization code entered, IP address, browser information, country |
| Form submitter / person contacting us | Identity | Full name |
| Contact | Work email, phone | |
| Professional experience | Organization, sector, role | |
| Request / complaint management | Request type, expected scale of use, message and correspondence | |
| Marketing | Commercial electronic message approval and preferences (only if given) | |
| Customer authorized person / contact | Identity, contact, professional experience | Full name, title, work email and phone |
| Customer transaction | Quotes, orders, contracts, support requests | |
| Finance | Invoice details | |
| Legal transaction | Contract and correspondence records |
ENA Innovation does not ask for special categories of personal data in the processes covered by this notice. Please do not include such data, or confidential invention details, in your message.
4. Purposes and legal grounds
| Purpose | Legal ground |
|---|---|
| Running the website, ensuring information security, preventing misuse | Art. 5/2-f of the Law: legitimate interest of the data controller, provided it does not harm the data subject's fundamental rights and freedoms |
| Producing aggregate visit and performance statistics | Art. 5/2-f: legitimate interest |
| Redirecting users on the organization login page to the right organization address | Art. 5/2-c: performance of a contract; Art. 5/2-f: legitimate interest |
| Receiving, assessing and answering demo and contact requests | Art. 5/2-c: necessary to enter into a contract; Art. 5/2-f: legitimate interest |
| Entering into and performing customer contracts, setup, support and billing | Art. 5/2-c: entering into and performing a contract |
| Meeting obligations under tax and commercial law, providing information to competent authorities | Art. 5/2-ç: legal obligation |
| Protecting rights in legal disputes | Art. 5/2-e: establishing, exercising or protecting a right |
| Sending commercial electronic messages about product updates and events | Art. 5/1: explicit consent, and approval obtained under Article 6 of Law No. 6563 (optional; answering your request does not depend on this approval) |
5. Method of collection
Your personal data is collected:
- electronically through forms on the website;
- automatically through server logs of the website and the organization login redirect infrastructure;
- by email, phone, WhatsApp and in meetings;
- through documents issued in quote, contract and invoicing processes.
6. Transfers of personal data
Your personal data may be transferred to the following recipients, limited to the purposes above and in line with Articles 8 and 9 of the Law:
| Recipient | Purpose |
|---|---|
| Website hosting provider (Vercel) | Publishing and securing the website, aggregate statistics |
| Email delivery provider (Resend) | Forwarding form content to our team and sending you emails |
| Hosting provider of ENA Innovation's central infrastructure (Huawei Cloud) | Organization login redirect and notification infrastructure |
| Identity provider (Logto) | Creating the account of the customer organization's first administrator |
| Accounting, legal and audit advisers | Legal obligations and protection of rights |
| Competent public authorities | Requests from authorities empowered by law |
International transfers: Vercel's and Resend's infrastructure is located in the USA. Transfers to these providers are made under Article 9 of the Law and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, relying on appropriate safeguards such as the standard contracts announced by the Personal Data Protection Board; ENA Innovation makes the notifications required by law. If you contact us via WhatsApp, your messages are processed abroad on WhatsApp's (Meta's) infrastructure.
The current list of our service providers is on the Sub-processors page.
7. Retention period
Your personal data is kept for as long as the purpose of processing requires and for the periods set by applicable law; when the period ends, it is deleted, destroyed or anonymized. Retention periods are detailed in Section 10 of the Privacy Policy.
8. Your rights under Article 11 of the Law
By applying to the data controller, you have the right to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of processing and whether it is used for that purpose;
- know the third parties in Türkiye or abroad to whom it is transferred;
- request correction if it is incomplete or inaccurate;
- request deletion or destruction under the conditions in Article 7 of the Law;
- request that correction, deletion and destruction be notified to the third parties to whom the data was transferred;
- object to a result against you arising from analysis of the data exclusively by automated systems;
- claim compensation if you suffer damage due to unlawful processing.
9. How to apply
You can send requests regarding your rights in writing, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, to the address above or to support@enainnovation.com. Your application must include the information listed in the Communiqué (such as your full name, contact details and the subject of your request). Your application is concluded free of charge within 30 days at the latest; if the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. Application methods are detailed on the Data Subject Requests page.