GDPR Privacy Notice

Tech Fabrika is committed to protecting your privacy and handling personal data in a transparent, secure and responsible manner.

This GDPR Privacy Notice explains how Tech Fabrika collects, uses, stores, shares and protects personal data when you:

• visit our website,
• contact us,
• request a demo or presentation,
• discuss a potential project or partnership,
• apply for a job,
• interact with our products, services or digital channels.

Where the General Data Protection Regulation (EU) 2016/679 (“GDPR”) applies, Tech Fabrika processes personal data in accordance with the GDPR and other applicable European data protection laws.

1. Who We Are

For the purposes of applicable data protection law, the relevant Tech Fabrika entity acts as the data controller for the personal data described in this Notice.

Tech Fabrika

Locations: Istanbul · Rotterdam · Düsseldorf Email: tech@techfabrika.co Phone / WhatsApp: +90 533 547 19 92

2. Personal Data We May Collect

Depending on how you interact with Tech Fabrika, we may collect and process the following categories of personal data.

Identity Data

• First name
• Last name

Contact Data

• Business or personal email address
• Telephone number
• WhatsApp contact details
• Other communication details you provide to us

Professional and Business Data

• Company name
• Job title
• Department
• Industry
• Business contact information
• LinkedIn profile
• Professional background

Enquiry and Project Data

When you contact us about a project, service or product, we may process information such as:

• Project descriptions
• Business requirements
• Technical requirements
• Product or service interests
• Budget or timeline information voluntarily provided
• Messages and correspondence
• Demo or presentation requests
• Partnership enquiries

Recruitment Data

If you apply for a role at Tech Fabrika, we may process:

• CV / résumé
• Education history
• Employment history
• Professional qualifications
• Skills and experience
• Portfolio
• LinkedIn profile
• GitHub profile
• Job application materials
• Interview notes
• Information voluntarily provided during the recruitment process

Please avoid sending special category or highly sensitive personal data unless it is specifically requested and legally necessary.

Technical and Usage Data

When you use our website, certain technical information may be generated automatically, including:

• IP address
• Browser type
• Device type
• Operating system
• Date and time of access
• Pages visited
• Referral source
• Security logs
• Error logs
• Website interaction data

Cookie and Analytics Data

Subject to your cookie preferences, we may collect data through cookies and similar technologies for analytics, functionality, security and, where applicable, marketing purposes.

For more information, please see our Cookie Policy.

3. How We Collect Personal Data

We may collect personal data directly from you when you:

• submit a contact form,
• request a demo,
• request a presentation,
• send us an email,
• contact us by telephone or WhatsApp,
• submit a job application,
• attend a meeting,
• communicate with us through LinkedIn or other professional channels.

We may also collect certain technical information automatically through:

• cookies,
• local storage,
• server logs,
• analytics tools,
• security systems,
• similar technologies.

In some cases, we may receive business contact information from publicly available professional sources, business partners or legitimate business directories.

4. Why We Process Your Personal Data

We may process your personal data for the following purposes:

• Responding to enquiries and communications
• Arranging demos and presentations
• Evaluating project opportunities
• Discussing potential business relationships
• Preparing proposals and quotations
• Providing information about our products and services
• Managing customer and prospect relationships
• Managing partnerships and supplier relationships
• Providing and improving our products and services
• Operating and securing our website
• Detecting technical problems and security incidents
• Understanding website performance
• Improving user experience
• Managing recruitment and job applications
• Meeting legal and regulatory obligations
• Establishing, exercising or defending legal claims
• Protecting our systems, users and business

Where permitted by law, we may also process business contact information for relevant B2B communications and relationship management.

5. Legal Bases for Processing

Under the GDPR, we rely on one or more of the following lawful bases.

Contractual Necessity

We may process personal data when it is necessary to:

• take steps at your request before entering into a contract,
• enter into a contract,
• perform our contractual obligations.

For example, this may apply when you request a proposal, demo or project discussion.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms.

Our legitimate interests may include:

• responding to business enquiries,
• developing commercial relationships,
• improving our services,
• securing our systems,
• preventing fraud or misuse,
• improving website performance,
• maintaining business records.

Legal Obligation

We may process personal data where necessary to comply with legal, regulatory, accounting or tax obligations.

Consent

Where required by law, we may rely on your consent.

This may include certain:

• marketing communications,
• analytics cookies,
• advertising cookies,
• optional tracking technologies.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. Special Category Personal Data

Tech Fabrika does not generally seek to collect special categories of personal data through its website.

Special category data may include information relating to:

• health,
• racial or ethnic origin,
• political opinions,
• religious beliefs,
• trade union membership,
• genetic data,
• biometric data,
• sexual orientation.

Please do not provide such information unless it is specifically required and legally appropriate.

If special category data must be processed, we will rely on an appropriate legal basis under Article 9 of the GDPR.

7. How We Share Personal Data

We do not sell personal data.

We may share personal data with selected third parties where necessary for the operation of our business.

These may include:

• Cloud and hosting providers
• Email service providers
• CRM providers
• Analytics providers
• Cybersecurity providers
• Software infrastructure providers
• Collaboration and productivity platforms
• Recruitment tools
• Professional advisers
• Accountants
• Legal advisers
• Auditors
• Business partners
• Authorities or regulators where legally required

We expect service providers processing personal data on our behalf to apply appropriate confidentiality, security and data protection measures.

Where required, we enter into data processing agreements with relevant processors.

8. International Data Transfers

Tech Fabrika operates across Istanbul, Rotterdam and Düsseldorf and may use technology providers with infrastructure in multiple countries.

As a result, personal data may be transferred outside the European Economic Area (“EEA”).

Where personal data is transferred to a country that does not benefit from an adequacy decision, we use appropriate safeguards where required under the GDPR.

These safeguards may include:

• European Commission Standard Contractual Clauses,
• contractual and organisational safeguards,
• supplementary technical measures,
• other transfer mechanisms recognised under applicable law.

Where applicable, you may contact us for additional information about the safeguards used for international data transfers.

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected.

Retention periods may depend on:

• The nature of the relationship
• The purpose of processing
• Legal obligations
• Contractual requirements
• Limitation periods
• Security requirements
• The need to establish or defend legal claims

When personal data is no longer required, it will be deleted, anonymised or securely disposed of in accordance with applicable law and our internal policies.

10. Recruitment Data

If you apply for a job with Tech Fabrika, your personal data will be used to:

• Assess your application
• Communicate with you
• Conduct interviews
• Evaluate qualifications and experience
• Manage the recruitment process
• Maintain appropriate recruitment records

If your application is unsuccessful, we may retain your application data for a limited period where legally permitted.

Where we wish to retain your information for future opportunities beyond the normal recruitment period, we may request your consent where required.

11. Automated Decision-Making and AI

Tech Fabrika develops and uses artificial intelligence technologies.

However, simply visiting our website, submitting an enquiry or applying for a job does not mean that you will be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects.

If we introduce such automated decision-making in a context covered by Article 22 GDPR, we will provide the additional information and safeguards required by law.

Where AI-assisted tools are used internally, meaningful human oversight may be applied where appropriate.

12. Your Rights Under the GDPR

Subject to the conditions and limitations set out in the GDPR, you may have the following rights.

Right of Access

You may request confirmation as to whether we process your personal data and request a copy of that data.

Right to Rectification

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

In certain circumstances, you may request deletion of your personal data.

This is sometimes referred to as the “right to be forgotten”.

Right to Restriction of Processing

You may request that we restrict the processing of your personal data in certain circumstances.

Right to Data Portability

Where applicable, you may request personal data you have provided to us in a structured, commonly used and machine-readable format.

You may also have the right to request transmission of that data to another controller where technically feasible.

Right to Object

You may object to processing based on legitimate interests in certain circumstances.

You have the right to object at any time to the processing of your personal data for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights regarding decisions based solely on automated processing that produce legal or similarly significant effects.

13. How to Exercise Your Rights

You can submit a data protection request by contacting:

tech@techfabrika.co

To protect your information, we may ask you to provide reasonable information to verify your identity.

We will respond to valid requests within the timeframes required by applicable data protection law.

Under the GDPR, this will generally be within one month, subject to legally permitted extensions for complex or multiple requests.

14. Right to Lodge a Complaint

If you are located in the European Economic Area and believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority.

You may generally contact the data protection authority in:

• the country where you live,
• the country where you work,
• the country where the alleged infringement occurred.

You may also contact Tech Fabrika first so that we have an opportunity to address your concern.

15. Data Security

Tech Fabrika applies appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access,
• accidental loss,
• unlawful disclosure,
• alteration,
• destruction,
• misuse.

Depending on the system and risk level, these measures may include:

• Access controls
• Authentication mechanisms
• Encryption
• Secure communication protocols
• Logging and monitoring
• Backup systems
• Security updates
• Role-based permissions
• Security incident procedures
• Data minimisation practices

No internet-based system can be guaranteed to be completely secure. We therefore continually review and improve our security practices as appropriate.

16. Data Breaches

Where a personal data breach occurs, Tech Fabrika will assess the incident in accordance with applicable law.

Where required, we will notify the competent supervisory authority within the legally prescribed timeframe.

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also notify those individuals where required by law.

17. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Some cookies are strictly necessary for the operation and security of the website.

Other categories, such as analytics or marketing cookies, may be used only after consent where required.

You can manage your preferences through our cookie settings interface.

For more information, please see our Cookie Policy.

18. Website Assistant (Artificial Intelligence)

Our website provides an AI assistant that answers questions about our services and products.

Before a conversation begins, we ask for your name and a way to reach you (email or telephone). This data is processed on the basis of your explicit consent, and the consent is recorded together with a verbatim copy of the text shown to you.

In this context:

• Your name and contact details are stored and used to assess your enquiry and to get back to you.
• The messages you write and the assistant's replies are stored so that your enquiry is understood correctly and passed to our representative in full. The record is held in our admin panel, accessible only to authorised staff.
• Your questions are sent to a language model so that an answer can be produced. The model provider must hold an approved record in our processor inventory; no data is sent to a provider without one.
• Assistant answers can be wrong or incomplete. They are not a binding offer, commitment or professional advice.
• The assistant does not produce a decision about you that has legal or similarly significant effects.

Records are kept only as long as necessary for the purpose, and for no longer than twelve months.

19. Third-Party Websites

Our website may contain links to third-party websites or services, including professional and social media platforms.

These third parties operate independently and have their own privacy practices.

Tech Fabrika is not responsible for the privacy practices of third-party websites.

We encourage you to review their privacy notices before providing personal data.

20. Children’s Data

Tech Fabrika’s website and services are primarily intended for businesses and professional users.

We do not knowingly seek to collect personal data from children through our general website.

If you believe that personal data relating to a child has been provided to us without appropriate authorisation, please contact tech@techfabrika.co.

21. Data Protection by Design and Default

As a technology company developing AI, software and SaaS products, we recognise the importance of incorporating privacy and security into system design.

Where appropriate, we seek to apply principles such as:

• Data minimisation
• Purpose limitation
• Access control
• Least privilege
• Secure defaults
• Appropriate retention
• Privacy-aware architecture
• Security by design

throughout our technology and business processes.

22. Changes to This GDPR Privacy Notice

We may update this Notice from time to time to reflect:

• changes in our processing activities,
• changes in our products or services,
• legal or regulatory developments,
• changes in technology,
• changes in our organisation.

The latest version will be published on this page together with the updated revision date.

23. Contact Us

For questions about this GDPR Privacy Notice or the way Tech Fabrika processes personal data, please contact:

Tech Fabrika Istanbul · Rotterdam · Düsseldorf

Email: tech@techfabrika.co Phone / WhatsApp: +90 533 547 19 92

Privacy is part of how we build technology.

We believe responsible technology starts with clear rules, secure systems and respect for the people behind the data.