Privacy and data protection
Privacy Policy
How ENA Innovation processes personal data on the www.enatto.com website and in the EnaTTO service.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails. This document is pending legal review.
This Privacy Policy explains how personal data is processed when you visit the www.enatto.com website, contact us by form, email or phone, when your organization is an EnaTTO customer, when you work with an organization that uses EnaTTO (for example as a researcher, inventor, evaluator or patent attorney), and when you use one of the public pages that an organization publishes with EnaTTO (technology catalogue, demand, application and event registration forms, certificate verification). The information required under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is also provided in the KVKK Privacy Notice, and the information for people in the European Economic Area, the United Kingdom and Switzerland is in the GDPR Privacy Notice.
1. Who we are
ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş. ("ENA Innovation", "we") is a technopark company located at Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye. EnaTTO is a product of ENA Innovation.
EnaTTO is software for technology transfer offices (TTOs), universities, research institutes, technoparks, hospitals and public research organizations. It helps them manage invention disclosures, intellectual property and patent applications, research projects and funding, industry collaboration, startups, training and events, and commercialization, together with the related workflows, committees, documents and reports.
EnaTTO does not give legal advice and does not make legal determinations. It does not assess patentability, ownership, inventor or institution rights, employee invention status or revenue shares; these are records entered by the organization's users. Deadlines suggested by the software are reminders and do not replace a legal calculation of time limits.
For questions about personal data: support@enainnovation.com
2. Our role: data controller or data processor?
| Activity | ENA Innovation's role | Data controller |
|---|---|---|
| Running the website; contact and demo requests | Data controller | ENA Innovation |
| Contracts, billing and support with customer organizations | Data controller | ENA Innovation |
| Commercial electronic messages you opted in to | Data controller | ENA Innovation |
| Data processed in an EnaTTO Customer Environment (directory of people, invention disclosures, IP and patent records, projects, committees, industry, startup, training and commercialization records, documents, data collected through the organization's public pages, users and audit records, etc.) | Data processor | The organization using EnaTTO (the Customer) |
If you are an inventor, researcher, student, company contact, startup founder, event participant or any other person whose data is recorded in an organization's EnaTTO environment, that organization is the data controller for your data. The purposes, legal basis and retention period are set out in the organization's own privacy notice. Please send requests about that data to the organization first. ENA Innovation processes such data only on the organization's instructions and to provide the service.
3. Data processed on the website
3.1. When you visit the website
- Technical logs: our website is hosted on Vercel. When you access the site, your IP address, browser and device information, the requested page and the time are processed in the hosting provider's server logs to run and secure the site.
- Aggregate visit statistics: we use Vercel Web Analytics and Speed Insights. These tools do not use cookies, do not track visitors across sites and give us only aggregate data such as page views, country, device type and page performance. See the Cookie Policy for details.
- Organization login redirect: when you enter your organization code on the "Login" page, your browser connects to ENA Innovation's central organization discovery service (discovery.enainnovation.com) to send you to your organization's EnaTTO address. This service keeps access logs that include IP address, browser information and country.
3.2. When you fill in a form or write to us
Our contact and demo forms ask for: full name, work email, phone, organization, sector, your role, request type, your message and, optionally, details about the expected scale of use. The form content is sent to our team as an email through ENA Innovation's notification infrastructure and its email service provider (Resend).
When you contact us by email, phone or WhatsApp, the content of the conversation and your contact details are processed. When you use WhatsApp, WhatsApp's (Meta's) own privacy terms also apply.
Please do not include confidential invention details, unpublished research results or special categories of personal data in forms or messages to us.
3.3. Commercial electronic messages
If you tick the optional box in a form, we may email you about product updates and events. This approval is obtained under Turkish Law No. 6563 on the Regulation of Electronic Commerce and its regulation, and, where required by law, is recorded in the Message Management System (İYS). You can withdraw your approval at any time using the link in each message or by writing to support@enainnovation.com.
4. Data processed in the customer relationship
When your organization is, or is considering becoming, an EnaTTO customer, we process the full name, title and work contact details of authorized and contact persons, quote, contract and invoice details, and support requests and correspondence.
To set up a Customer Environment, we use the full name and email address of the organization's first administrator (owner). Accounts of organization users are kept with our identity provider, Logto.
5. Data processed in the EnaTTO service (as data processor)
5.1. One environment per organization
Each organization uses its own Customer Environment running at organizationcode.enatto.com: a separate server with its own application stack, its own file storage and its own database and database user. Organizations do not share records with each other. The hosting region is set in the agreement with the organization.
5.2. Data categories
Depending on the modules and settings the organization uses, the following data may be processed in a Customer Environment:
| Group | Data categories |
|---|---|
| Organization users (owner, administrator, TTO staff, members such as academics, students and industry users, institutional viewers, external experts such as evaluators and patent attorneys with time-limited access) | Name, email, roles and permissions, record memberships and their expiry, session information, notifications and tasks, audit records |
| People in the directory (with or without a user account, including external inventors, co-researchers, mentors, trainers and company contacts) | Name, title, email, phone, ORCID iD, unit and institution, link to a user account; expertise profile (summary, research areas, keywords, services offered); publications imported from OpenAlex or Crossref |
| Inventors and IP records | Invention disclosures (title, abstract, technical field, invention and disclosure dates, planned publications or presentations, funding source), inventors and their recorded contribution shares, assessments (completeness, technical, commercial, patentability, prior art, ownership) and their reports, institutional IP decisions, IP assets, patent applications (office, numbers, dates, status, attorney), office correspondence, deadlines and expenses |
| Projects and funding | Project ideas and proposals, team members and roles, person-months, partners, budgets and expenditure, milestones, deliverables and reports, submissions to funding calls |
| Committees | Members and roles, meetings and agendas, attendance, conflict of interest declarations, votes (as totals by default; per member if the organization enables it), decisions and reasons |
| Industry collaboration | Company profiles, company contacts (name, email, phone), demands and R&D problems, meeting records, agreements and payments received |
| Startups | Programs, calls, applications (venture, summary, problem, solution, market, team, contact details), evaluation scores, ventures and founders, mentors and mentoring sessions, milestones and status records (team size, customers, monthly revenue, investment), investment rounds, spin-off and exit records |
| Training and events | Registrations (name, email, institution type and name), waiting list, attendance, certificates (name, event, date, duration and verification code), anonymous feedback survey responses |
| Commercialization | Technologies and their sources, TRL and market assessments, licensee candidates and contacts, negotiation steps, licence and assignment agreements, revenues and revenue-sharing recipients and percentages |
| Documents | Uploaded files and their versions, which may contain any information the users upload |
| People using public pages | See Section 6 |
Confidentiality classes: every business record in EnaTTO carries one of four confidentiality classes: public, internal, confidential or strictly confidential. Invention disclosures open as confidential by default. Confidential and strictly confidential records are open only to the people assigned to the record and to explicitly authorized TTO staff; the owner and administrator roles do not give automatic read access. Elevated access needs a reason and is logged; for strictly confidential records the people responsible for the record are notified. Management reports show only the number of such records, not their titles or contents.
Invention disclosures and unpublished research results are Customer Data. ENA Innovation does not access their content except as needed to provide, support and secure the service on the Customer's instructions, and does not use it for any other purpose.
Purposes we do not use data for: data in a Customer Environment is not used for advertising, marketing or profiling, is not sold, is not shared with data brokers and is not used by ENA Innovation to train AI models.
5.3. External services the organization can switch on
The following features send limited data outside the Customer Environment. All are off by default or only work when a user starts them:
- AI assistance (optional, off by default): if the organization switches it on, selected fields of public and internal records are sent through ENA Innovation's AI gateway to its provider, Google (Gemini), to suggest keywords, sectors, matches or report drafts. Confidential and strictly confidential records are never sent; the server refuses them. For industry demands, company name, contact person, email, phone and internal notes are never sent; in matching, candidates are shown to the provider under neutral labels such as "Expert 3" instead of names. Report drafts are written only from aggregate indicators. Suggestions are not saved automatically; a user decides whether to apply them.
- Benchmarking (optional, opt-in): if the organization joins, once a year it sends selected aggregate indicator values for the last completed financial year (rates, durations and scores, and counts per 100 staff) to ENA Innovation's benchmarking service. No records, names, codes or amounts are sent. Peer statistics (lower quartile, median, upper quartile) are shown only for groups of at least 5 organizations. Leaving deletes all submissions.
- Academic and patent data sources: when a user starts it, EnaTTO looks up publications in OpenAlex or Crossref using only an ORCID iD or DOI, and published patent data in the European Patent Office's Open Patent Services using only a publication number. Names, emails, notes and unpublished application details are not sent.
6. Public pages of organizations
An organization can publish public pages with EnaTTO under its own address: a technology catalogue with an "I'm interested" form, an industry demand form, startup application forms, event registration forms, a feedback survey for event participants and a certificate verification page. The organization is the data controller for data collected through these pages, and its own privacy notice applies; ENA Innovation processes the data as data processor.
- Data collected: the fields of the form (for example company name, contact name, email, phone, demand or message text, venture details, institution type and name) and your consent statement.
- Email confirmation: a submission is accepted only after you confirm it with the link sent to your email address. Unconfirmed submissions are deleted automatically after 48 hours. Only a hash of the confirmation key is stored.
- Abuse protection: the number of submissions is limited per IP address and per email address; your IP address is processed for this purpose and for security logs. No CAPTCHA is used.
- Feedback surveys: survey links are single-use and valid for 30 days. Responses are anonymous: the organization sees only averages, the recommendation rate and comments, without the name of the person who wrote them.
- Certificate verification: anyone with a certificate code can see the holder's name, the event, the date, the duration and the issuer; for a revoked certificate only "invalid" is shown. Queries are rate-limited per IP address.
- Technology catalogue: only the code, title, public summary, sectors, keywords and current TRL of technologies the organization publishes are shown. Technical descriptions and confidential information are not shown.
7. Purposes and legal grounds (as data controller)
| Purpose | Data categories | Legal ground (KVKK Art. 5) |
|---|---|---|
| Running and securing the website | IP address, browser and device information, access logs | Legitimate interest (Art. 5/2-f) |
| Aggregate visit and performance statistics | Aggregate, non-identifying usage data | Legitimate interest (Art. 5/2-f) |
| Redirecting users on the login page to the right organization address | Organization code, IP address, browser information | Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Answering demo and contact requests | Identity, contact and professional details, request content | Necessary to enter into a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Entering into and performing customer contracts, billing, support | Identity, contact and professional details, customer transaction and financial details | Performance of a contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) |
| Legal obligations (tax and commercial law, requests from authorities) | Invoice and contract records | Legal obligation (Art. 5/2-ç) |
| Protecting rights in legal disputes | Relevant records | Establishing, exercising or protecting a right (Art. 5/2-e) |
| Sending commercial electronic messages | Name, email, preference and approval records | Explicit consent (Art. 5/1) and commercial message approval under Article 6 of Law No. 6563 |
Information for people covered by the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection (FADP) is in the GDPR Privacy Notice.
8. Recipients
We do not sell your personal data. Data is shared only with the following recipients, limited to the purpose:
- Our service providers (data processors): hosting, network protection, identity, email delivery and error monitoring services and, if an organization switches it on, the AI provider (Google; public and internal records only). Current list: Sub-processors. The website also uses Vercel (hosting and aggregate analytics).
- Competent public authorities: on request of authorities empowered by law.
- Professional advisers: lawyers, accountants and auditors, under confidentiality obligations.
- The customer organization: data we process as data processor is made available to the authorized users of the organization, which is the data controller.
9. International transfers
Some of our service providers are located abroad or use infrastructure abroad. In particular, our website is hosted on Vercel (USA), form content and service emails are sent through Resend (USA), and traffic to Customer Environments passes through Cloudflare (a global network headquartered in the USA). If an organization switches on AI assistance, selected fields of public and internal records are sent to Google (headquartered in the USA; processing locations as stated in Google's data processing terms). The hosting region of a Customer Environment is set in the agreement with the organization; the region may be outside Türkiye.
These transfers are made under Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. For transfers to countries without an adequacy decision, we rely on one of the appropriate safeguards provided in the law, such as the standard contracts announced by the Personal Data Protection Board; standard contracts are notified to the Personal Data Protection Authority within five business days of signature. In exceptional cases where an appropriate safeguard cannot be provided, transfers are made only under the incidental transfer conditions listed in Article 9/6 of the KVKK.
10. Retention periods
| Data | Retention period |
|---|---|
| Website server logs | For the hosting provider's standard log retention period (as set out in the provider's terms of service) |
| Aggregate analytics data | Kept as aggregate, non-identifying data |
| Demo and contact requests that do not lead to a contract | 2 years from the last contact |
| Customer contracts, invoices and related correspondence | 10 years from the end of the contract (taking into account the Turkish Commercial Code, tax law and the limitation periods in the Turkish Code of Obligations) |
| Commercial message approval and opt-out records | 3 years from withdrawal of approval (under the applicable regulation) |
| Data in a Customer Environment (as data processor) | Until the contract ends, unless the organization deletes it earlier; deleted from live systems within 30 days after the contract ends. Unconfirmed public form submissions are deleted after 48 hours and export files after 7 days. Encrypted backups (nightly database dumps and file storage archives) are kept for 14 days; the 10 most recent dumps and the most recent archive are always kept until the environment is deleted |
When the period ends, data is deleted, destroyed or anonymized.
11. Security measures
The main technical and organizational measures in the design of the service are:
- For each organization, a separate server with its own application stack, file storage, database and database user; one organization's data cannot be reached from another.
- All traffic encrypted in transit with TLS.
- Invite-based sign-in for organization users (Logto; optionally the organization's own single sign-on), time-limited access for external experts, and server-side checks of role, record membership and confidentiality class for every request; records a person may not see are answered as "not found".
- Viewing confidential and strictly confidential records and downloading their documents are written to the audit log; the audit log can only be appended to, and names and email addresses in it are masked.
- Exports contain only code and status for confidential and strictly confidential rows; internal notes and planned publications never appear in exports, notification texts or report details.
- Notification texts contain only a record code and a link, never confidential content.
- Nightly encrypted (AES-256) backups of the database and file storage, kept for 14 days; an encrypted database dump before each update.
- Confidentiality obligations for our staff and access limited to what their role requires.
No system is completely secure; if a data breach occurs, we make the notifications required by law. EnaTTO is designed to support organizations' legal obligations; these measures are not a statement of compliance or certification.
12. Your rights
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing; to know the recipients to whom it is transferred; to request correction, deletion or destruction; to request that these actions be notified to recipients; to object to a result against you arising from automated analysis; and to claim compensation for damage caused by unlawful processing. People covered by the GDPR, the UK GDPR or the FADP also have the rights to restriction of processing, data portability and objection.
You can send requests to support@enainnovation.com. If your request concerns data processed in an organization's EnaTTO environment, we recommend that you contact that organization first; we forward such requests that reach us to the organization concerned. Application methods and response times are explained on the Data Subject Requests page.
13. Children
Our website and EnaTTO are aimed at organizations and professionals and are not directed at children. Whether an organization records data of minors (for example students registering for an event) is decided by that organization, which is responsible for any consent this requires.
14. Changes
We may update this policy. The current version is published on this page with its effective and update dates.
15. Contact
- Legal name: ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş.
- Address: Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye
- Trade registry: Afyonkarahisar Trade Registry Office, registration no. 18590
- MERSİS no.: 0334130943400001
- Tax office / tax ID: Tınaztepe Tax Office / 3341309434
- Personal data: support@enainnovation.com
- Phone: +90 850 308 45 91