KVKK Information Notice

Last updated: 11 September 2026

This notice is issued by U2 AI Studio Teknoloji Anonim Şirketi as data controller under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It explains which personal data we process through this website and the contact channels published on it, on which legal basis, how long we keep it, and how you can exercise your rights. It applies together with our Privacy Policy and Cookie Policy.

1. Data Controller

Under Law No. 6698, your personal data is processed by U2 AI Studio Teknoloji Anonim Şirketi ("U2 AI Studio") acting as data controller. Our identification and contact details are set out below.

Legal name	U2 AI Studio Teknoloji Anonim Şirketi (single-shareholder joint stock company)
MERSIS no	0883124471000001
Trade registry	Ankara Trade Registry, no. 434199
Tax office / no	Sincan, 8831244710
Registered office	Ahi Evran OSB Mah. Erkunt Cad. No: 3 Inner Door No: 41, Sincan / Ankara, Türkiye
Phone	+90 850 346 82 82 · +1 415 712 78 82
E-mail	[email protected]
Registered e-mail (KEP)	[email protected]

This notice covers u2aistudio.com and the contact channels published on it. Where you use one of our products or platforms through its own website or application, the notice published there applies to that use.

2. Personal Data We Process

Depending on the channel you use, we may process the following categories of personal data:

Identity: name, surname, title.
Contact: e-mail address, telephone number, address, company and role.
Request and complaint records: the subject and content of the message you send through the contact form or by e-mail, and the correspondence that follows.
Professional experience: the CV file and its attachments that you send through the career application channel — education, work history, references and any other content you choose to include.
Customer, business partner and transaction records: demo and proposal records, contract, order and invoice details.
Transaction security: IP address, time of request, browser and device information, and the server and security logs created while the site is delivered.

Special categories of personal data. Please do not include special categories of personal data — such as health, biometric or genetic data, criminal conviction records, religious, philosophical or political opinion, or trade-union membership — in your messages, in your CV or in its attachments. We do not request such data and do not use it in evaluating an application; if it nevertheless reaches us inside a document, it is not processed for any purpose and is removed at the first opportunity.

3. How We Collect Your Data

We collect personal data by wholly or partly automated means, through the following channels:

The contact form on the website, or the e-mail and KEP addresses published on it.
The application channel on the careers page — the career form or e-mail — including the CV file and attachments you send.
Telephone calls and written correspondence.
The documents and details you share while a business relationship is being established or performed.
Server and security records generated automatically while the site is served.

This website sets no cookies of its own. The technical records created by our infrastructure provider for security and bot protection are described in our Cookie Policy; the wider picture is in our Privacy Policy.

4. Purposes of Processing

Your personal data is processed for the following purposes:

Receiving and answering your requests, questions and complaints.
Running demo, proposal and other pre-contractual processes.
Establishing and performing contracts and managing the related invoicing and records.
Evaluating job applications and running the recruitment process.
Keeping requests, applications and correspondence on record as evidence in the event of a dispute.
Meeting our obligations under tax, commercial and personal data protection legislation.
Securing the website and the infrastructure that serves it, including spam and bot protection.

We do not use your data for profiling, for advertising targeting, or for any purpose beyond those listed above, and we do not sell or rent it.

5. Legal Basis

Your personal data is processed on the conditions listed in Article 5/2 of the KVKK, for which explicit consent is not required. The basis of each processing activity is set out separately below.

Processing activity	Data	Legal basis (KVKK Art. 5/2)
Answering a message sent through the contact form or by e-mail and running the pre-contractual process	Identity, contact, request records	(c) direct connection with the establishment or performance of a contract; (f) legitimate interest
Establishing and performing a contract, managing demo, proposal and delivery processes	Identity, contact, customer and transaction records	(c) establishment or performance of a contract
Evaluating a job application and keeping the CV during the process	Identity, contact, professional experience (CV)	(c) direct connection with the establishment of an employment contract; (f) legitimate interest
Keeping requests, applications and correspondence on record for possible disputes	All categories above	(e) processing necessary for the establishment, exercise or protection of a right
Bookkeeping, invoicing, tax obligations and responding to KVKK applications	Identity, contact, transaction records	(ç) compliance with a legal obligation of the data controller
Security of the site and infrastructure, spam and bot protection, log keeping	Transaction security data	(f) legitimate interest, provided your fundamental rights are not harmed

We do not rely on explicit consent. Explicit consent is governed by Article 5/1 of the KVKK and is a legal basis separate from those above; none of the processing described in this notice depends on it. A confirmation box on our forms, where present, is an acknowledgement that you have read this notice — it is not a consent, and not ticking it or withdrawing it does not change the basis on which your request is handled. Article 4 of the KVKK, which sets out the general principles (lawfulness and fairness, accuracy, purpose limitation, data minimisation and storage limitation), governs all of the processing above but is not itself a legal basis.

This website operates no newsletter or other commercial electronic message channel. If one is added, consent will be collected separately under Article 6 of Law No. 6563 on the Regulation of Electronic Commerce and Article 5/1 of the KVKK, and this notice will be updated.

6. Transfers and Cross-Border Transfers

Your data is shared only to the extent necessary for the purposes above, with:

Our hosting, content delivery and security provider (Cloudflare), which serves this website.
Our e-mail, file storage and office software providers.
Our professional advisors — independent accountant and legal counsel — who are bound by a duty of confidentiality.
Authorised public authorities and courts, where there is a statutory request or obligation.
Business partners, only where necessary to carry out the work you have asked for.

Some of these providers are established outside Türkiye. A cross-border transfer is made under Article 9 of the KVKK: on the basis of an adequacy decision of the Personal Data Protection Board where one exists; in the absence of such a decision, on one of the appropriate safeguards listed in Article 9/3 — most commonly the standard contract published by the Board, which must be notified to the Authority within five business days of signature; and where neither is available, only in the incidental cases listed in Article 9/6.

The fonts on this site are served from Google Fonts. When a font is requested, your IP address and browser information may be processed by Google, which can involve a transfer to the United States; see our Cookie Policy.

7. Retention Periods

We keep your data only for as long as the purpose of processing requires, and never for less than the minimum periods set by law.

Record	Retention period	Reason
Contact form or e-mail enquiry and the related correspondence	2 years from the last correspondence	Our practice; kept as evidence of the request (Art. 5/2-e and 5/2-f)
Job application, CV file and its attachments	1 year from the conclusion of the application process, then deleted	Our practice; deleted earlier if you ask
Contract, invoice and accounting records	10 years from the end of the calendar year in which the record was made	Article 82 of the Turkish Commercial Code No. 6102; books and documents kept for at least 5 years under Article 253 of the Tax Procedure Law No. 213
Server and security logs (IP address, time of request, browser information)	Up to 12 months	Security of the site and the infrastructure (Art. 5/2-f); held by our infrastructure provider on our behalf
KVKK applications and the responses we give	2 years from the date of the response	Our practice; kept to show that the response was given within the legal period

At the end of the period the data is deleted, destroyed or anonymised in accordance with Article 7 of the KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data; under Article 11 of that Regulation, a periodic destruction interval may not exceed six months.

8. Security and Automated Decisions

We apply technical and organisational measures under Article 12 of the KVKK: encryption in transit (TLS), access control on a least-privilege basis, separation of duties, and logging of access to records. No measure makes a system entirely free of risk, and we make no certification or accreditation claim for this website.

No decision producing a legal effect on you, or a comparably significant effect, is taken about you solely by automated means through this website. Job applications are reviewed by people within our human resources processes; no application is concluded by an automated system alone.

9. Your Rights Under Article 11

As a data subject, under Article 11 of the KVKK you have the right to:

learn whether your personal data is processed (Art. 11/1-a);
request information about it if it has been processed (b);
learn the purpose of processing and whether the data is used in accordance with that purpose (c);
know the third parties in Türkiye or abroad to whom the data is transferred (ç);
request correction of the data where it is incomplete or inaccurate (d);
request deletion or destruction of the data where the conditions in Article 7 are met (e);
request that a correction, deletion or destruction carried out under (d) and (e) be notified to the third parties to whom the data has been transferred (f);
object to a result to your detriment arising from analysis of the data exclusively by automated systems (g);
claim compensation for loss suffered as a result of unlawful processing (ğ).

10. How to Apply

You may submit a request under Article 11 through the channels set out in Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller:

In writing: Ahi Evran OSB Mah. Erkunt Cad. No: 3 Inner Door No: 41, Sincan / Ankara, Türkiye — delivered in person with identification, or through a notary.
Registered e-mail (KEP): [email protected]
Secure electronic signature or mobile signature: to [email protected]
From an e-mail address you have previously notified to us and that is registered in our system: to [email protected]

Under Article 5/2 of the Communiqué your application must state your name and surname, and your signature where the application is in writing; your Turkish identity number, or for foreign nationals your nationality, passport number or identity number if any; your address of residence or business for notification; your e-mail address, telephone and fax number if any; and the subject of your request.

Your application is concluded free of charge as soon as possible and within thirty days at the latest; where the process requires an additional cost, the fee in the tariff set by the Board may be charged (Article 13 of the KVKK). If your application is rejected, you find the response insufficient, or no response is given within the period, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning the response and in any event within sixty days of the date of the application (Article 14 of the KVKK).

For questions about this notice: [email protected]